Config

Notes for `alerts.customRoutes[]`

Additional custom routes: Additional route receivers that will be added to the configuration of alertmanager

Note

See the upstream documentation for reference.

Notes for `alerts.runbookUrls.alertmanager`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.backupStatus`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.blackbox`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.certManager`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.clusterApi`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.clusterAutoscaler`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.clusterCapacityManagement`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.configReloaders`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.coreDns`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.dailyChecks`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.diskPerf`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.falco`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.fluentd`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.general`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.harbor`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.hnc`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.kubeStateMetrics`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kubernetesApps`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kubernetesResources`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kubernetesStorage`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kubernetesSystem`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kured`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.missingMetrics`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.nodeExporter`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.nodeNetwork`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.opensearch`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.openstack`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.packetsDropped`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.prometheus`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.prometheusOperator`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.thanos`

Runbooks for thanos alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://github.com/thanos-io/thanos/tree/main/mixin/runbook.md

Notes for `alerts.runbookUrls.webhook`

Runbooks for alerts: Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

`certmanager`¶

cert-manager Config: Configure cert-manager, used to provision certificates either self-signed or via Let's Encrypt.

Key	Type	Default	Title and Description
certmanager.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
certmanager.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
certmanager.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
certmanager.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
certmanager.cainjector¶	object	—	Common Resource: This is meant to describe the base class if you will, for Welkin resources.
certmanager.cainjector.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
certmanager.cainjector.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
certmanager.cainjector.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
certmanager.cainjector.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
certmanager.cainjector.enabled¶	boolean	—	—
certmanager.cainjector.extraArgs[]¶	array of string	—	Extra Arguments: Extra arguments passed to a container
certmanager.cainjector.nodeSelector¶	object	—	See note
certmanager.cainjector.resources¶	object	—	See note
certmanager.cainjector.resources.limits¶	object	—	Kubernetes Quantity Map
certmanager.cainjector.resources.requests¶	object	—	Kubernetes Quantity Map
certmanager.cainjector.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
certmanager.cainjector.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
certmanager.extraArgs[]¶	array of string	—	Extra Arguments: Extra arguments passed to a container
certmanager.nodeSelector¶	object	—	See note
certmanager.resources¶	object	—	See note
certmanager.resources.limits¶	object	—	Kubernetes Quantity Map
certmanager.resources.requests¶	object	—	Kubernetes Quantity Map
certmanager.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
certmanager.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
certmanager.webhook¶	object	—	Common Resource: This is meant to describe the base class if you will, for Welkin resources.
certmanager.webhook.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
certmanager.webhook.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
certmanager.webhook.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
certmanager.webhook.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
certmanager.webhook.enabled¶	boolean	—	—
certmanager.webhook.extraArgs[]¶	array of string	—	Extra Arguments: Extra arguments passed to a container
certmanager.webhook.nodeSelector¶	object	—	See note
certmanager.webhook.resources¶	object	—	See note
certmanager.webhook.resources.limits¶	object	—	Kubernetes Quantity Map
certmanager.webhook.resources.requests¶	object	—	Kubernetes Quantity Map
certmanager.webhook.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
certmanager.webhook.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.

Notes for `certmanager.cainjector.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `certmanager.cainjector.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `certmanager.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `certmanager.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `certmanager.webhook.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `certmanager.webhook.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`clusterAdmin`¶

Cluster Admin: Configure the cluster admins.

Key	Type	Default	Title and Description
clusterAdmin.groups[]¶	array of string	—	Admin Groups: Configure the cluster admin groups.
clusterAdmin.users[]¶	array of string	—	Admin Users: Configure the cluster admin users.

`clusterApi`¶

ClusterAPI Config: Set to true if kubernetes is installed with cluster-api.

Key	Type	Default	Title and Description
clusterApi.clusters[]¶	array of string	—	Clusters: List of clusters to monitor. Used when monitoring clusters for autoscaling.
clusterApi.enabled¶	boolean	—	ClusterAPI Enabled
clusterApi.monitoring¶	object	—	ClusterAPI Monitoring: Enable autoscaling monitoring of cluster API clusters.
clusterApi.monitoring.enabled¶	boolean	—	ClusterAPI Autoscaling Monitoring Enabled

`crossplane`¶

Crossplane Config: Configure Crossplane

Key	Type	Default	Title and Description
crossplane.debugEnabled¶	boolean	—	Enable debug logging for Crossplane
crossplane.enabled¶	boolean	—	Enable Crossplane
crossplane.functions¶	object	—	Crossplane Function resource configuration: Crossplane Function resource configuration
crossplane.functions.<name>.debugEnabled¶	boolean	—	Enable debug logging for the function
crossplane.functions.<name>.resources¶	object	—	See note
crossplane.functions.<name>.resources.limits¶	object	—	Kubernetes Quantity Map
crossplane.functions.<name>.resources.requests¶	object	—	Kubernetes Quantity Map
crossplane.providers¶	object	—	Crossplane Provider resource configuration: Crossplane Provider resource configuration
crossplane.providers.<name>.debugEnabled¶	boolean	—	Enable debug logging for the provider
crossplane.providers.<name>.resources¶	object	—	See note
crossplane.providers.<name>.resources.limits¶	object	—	Kubernetes Quantity Map
crossplane.providers.<name>.resources.requests¶	object	—	Kubernetes Quantity Map
crossplane.rbacManager¶	object	—	Crossplane RBAC manager configuration: Crossplane RBAC manager configuration
crossplane.resources¶	object	—	See note
crossplane.resources.limits¶	object	—	Kubernetes Quantity Map
crossplane.resources.requests¶	object	—	Kubernetes Quantity Map

Notes for `crossplane.functions..resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `crossplane.providers..resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `crossplane.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`dex`¶

Dex Config: Configure Dex, the federated OIDC Identity Provider.

Note

Dex is installed in the service cluster, so this configuration mainly applies there.

Key	Type	Default	Title and Description
dex.additionalKubeloginRedirects[]¶	array of string	—	Dex Kubelogin Redirects: Configure Dex with additional Kubelogin redirects.
dex.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
dex.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
dex.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
dex.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
dex.contentSecurityPolicy¶	object	—	Content-Security-Policy rules: Configure Content-Security-Policy header rules Reference: https://content-security-policy.com/
dex.enableStaticLogin¶	boolean	`True`	Dex Static Login: Configure Dex with a static password login `admin@example.com`.
dex.expiry¶	object	—	Dex Expiry: Configure expiry when authenticating with Dex.
dex.expiry.deviceRequests¶	string	—	See note
dex.expiry.idToken¶	string	—	See note
dex.expiry.refreshTokens¶	object	—	Dex Expiry Refresh Tokens: Configure expiry of refresh tokens when authenticating with Dex.
dex.expiry.refreshTokens.absoluteLifetime¶	string	—	See note
dex.expiry.refreshTokens.reuseInterval¶	string	—	See note
dex.expiry.refreshTokens.validIfNotUsedFor¶	string	—	See note
dex.expiry.signingKeys¶	string	—	See note
dex.google¶	object	—	Dex Google Config: Configure Dex with specific options when using the Google connector.
dex.google.SASecretName¶	string	—	Dex Google Service Account Secret Name
dex.google.groupSupport¶	boolean	—	Dex Google Group Support Enabled
dex.nodeSelector¶	object	—	See note
dex.replicaCount¶	number	`2`	Dex Replicas
dex.resources¶	object	—	See note
dex.resources.limits¶	object	—	Kubernetes Quantity Map
dex.resources.requests¶	object	—	Kubernetes Quantity Map
dex.serviceMonitor¶	object	—	Dex Service Monitor: Configure the Service Monitor collecting metrics from Dex.
dex.serviceMonitor.enabled¶	boolean	`True`	Dex Service Monitor Enabled
dex.subdomain¶	string	`dex`	See note
dex.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
dex.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.

Notes for `dex.expiry.deviceRequests`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.idToken`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.refreshTokens.absoluteLifetime`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.refreshTokens.reuseInterval`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.refreshTokens.validIfNotUsedFor`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.signingKeys`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `dex.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `dex.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `dex.subdomain`

Dex Subdomain: Subdomain of baseDomain that the Ingress to Dex will be created with.

Note

Must be set for both service and workload clusters.

`externalDns`¶

External DNS Config: Configure External DNS.

External DNS manages DNS records based on Kubernetes resources, and can automatically configure DNS records from:

CRD resources
Ingress resources
Service resources

Currently only AWS Route 53 is supported as the DNS provider.

Note

See the upstream documentation for reference.

Key	Type	Default	Title and Description
externalDns.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
externalDns.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
externalDns.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
externalDns.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
externalDns.domains[]¶	array of string	—	External DNS Domains: Configure the domains External DNS should manage.
externalDns.enabled¶	boolean	—	External DNS Enabled
externalDns.endpoints[]¶	array of object	—	See note
externalDns.extraArgs[]¶	array of string	—	Extra Arguments: Extra arguments passed to a container
externalDns.logLevel¶	string	—	See note
externalDns.namespaced¶	boolean	—	External DNS Namespaced
externalDns.provider¶	string	—	See note
externalDns.resources¶	object	—	See note
externalDns.resources.limits¶	object	—	Kubernetes Quantity Map
externalDns.resources.requests¶	object	—	Kubernetes Quantity Map
externalDns.sources¶	object	—	External DNS Sources: Configure the sources External DNS should manage DNS records for.
externalDns.sources.crd¶	boolean	—	External DNS CRD
externalDns.sources.ingress¶	boolean	—	External DNS Ingress
externalDns.sources.service¶	boolean	—	External DNS Service
externalDns.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
externalDns.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
externalDns.txtPrefix¶	string	—	External DNS TXT Prefix: Configure a prefix to TXT records. This is required with AWS Route 53 if CNAME records are preferred over A/AAAA records as it cannot handle both at the same time.

Notes for `externalDns.endpoints[]`

External DNS Endpoints: Configure the endpoints to create DNS records for.

Requires externalDns.sources.crd to be enabled.

Configure an endpoint to create a DNS record for.

Notes for `externalDns.logLevel`

External DNS Log Level

Examples:

info

Notes for `externalDns.provider`

External DNS Provider

Examples:

aws

Notes for `externalDns.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`externalTrafficPolicy`¶

External Traffic Policy: Configure global ingress external traffic policy.

Key	Type	Default	Title and Description
externalTrafficPolicy.local¶	boolean	`True`	Local External Traffic Policy
externalTrafficPolicy.whitelistRange¶	object	—	See note

Notes for `externalTrafficPolicy.whitelistRange`

Allowlist Range: Configure allowlist CIDR ranges for ingresses.

This is done via the ingress annotation nginx.ingress.kubernetes.io/whitelist-source-range.

Set to false to explicitly opt-out of this annotation.

`falco`¶

Falco Config: Configuration for Falco, runtime security tool and threat detection.

Key	Type	Default	Title and Description
falco.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
falco.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
falco.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
falco.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
falco.alerts¶	object	—	Falco Alerts: Configure Falco alerts sent from Falco sidekick.
falco.alerts.enabled¶	boolean	—	Falco Alerts Enabled
falco.alerts.hostPort¶	string	`http://alertmanager-operated.monitoring:9093`	Falco Alerts Host Port: Configure the notification channel for Falco alerts.
falco.alerts.priority¶	string	`notice`	Falco Alerts Priority: Configure the notification priority for Falco alerts.
falco.alerts.type¶	string	`alertmanager`	See note
falco.artifact¶	object	—	Falcoctl Artifact: Configure Falcoctl artefact management. See the upstream repository for reference.
falco.artifact.install¶	object	—	Falcoctl Artifact Install: Configure Falcoctl artefact install.
falco.artifact.install.enabled¶	boolean	—	See note
falco.customIndexes[]¶	array of object	—	Falcoctl Custom Artifact Indices: Configure custom artefact indices for Falcoctl. Configure custom artefact index for Falcoctl.
falco.customRules¶	object	—	See note
falco.driver¶	object	—	Falco Driver: Configuration for the Falco syscall driver used to collect events. See the upstream documentation for more information.
falco.driver.kind¶	string	`kmod`	See note
falco.enabled¶	boolean	`True`	Falco Enabled
falco.falcoSidekick¶	object	—	Falco Sidekick: Basic configuration for Falco Sidekick, the deployment that forwards Falco alerts to Alertmanager.
falco.falcoSidekick.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
falco.falcoSidekick.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
falco.falcoSidekick.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
falco.falcoSidekick.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
falco.falcoSidekick.nodeSelector¶	object	—	See note
falco.falcoSidekick.resources¶	object	—	See note
falco.falcoSidekick.resources.limits¶	object	—	Kubernetes Quantity Map
falco.falcoSidekick.resources.requests¶	object	—	Kubernetes Quantity Map
falco.falcoSidekick.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
falco.nodeSelector¶	object	—	See note
falco.resources¶	object	—	See note
falco.resources.limits¶	object	—	Kubernetes Quantity Map
falco.resources.requests¶	object	—	Kubernetes Quantity Map
falco.rulesFiles¶	object	—	Falco Rule Files: Configure standard rules to use in Falco. See the upstream documentation for reference.
falco.rulesFiles.default¶	object	—	Falco Default Rules: Configure Falco default rules
falco.rulesFiles.default.enabled¶	boolean	`True`	Falco Default Rules Enabled
falco.rulesFiles.default.version¶	string	`3.0.1`	Falco Default Rules Version
falco.rulesFiles.incubating¶	object	—	Falco Incubating Rules: Configure Falco incubating rules
falco.rulesFiles.incubating.enabled¶	boolean	—	Falco Incubating Rules Enabled
falco.rulesFiles.incubating.version¶	string	`3.0.1`	Falco Incubating Rules Version
falco.rulesFiles.sandbox¶	object	—	Falco Sandbox Rules: Configure Falco sandbox rules
falco.rulesFiles.sandbox.enabled¶	boolean	—	Falco Sandbox Rules Enabled
falco.rulesFiles.sandbox.version¶	string	`3.0.1`	Falco Sandbox Rules Version
falco.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
falco.tty¶	boolean	`True`	Falco Allocate TTY: Attach the Falco process to a TTY inside the container. Needed to flush Falco logs as soon as they are emitted.
falco.useContainerEngine¶	boolean	`True`	Use the new containerEngine collector: Use the new container engine collector that replaces the old docker, containerd, crio and podman collectors.

Notes for `falco.alerts.type`

Falco Alerts Type: Configure the notification channel for Falco alerts.

Possible values:

alertmanager

slack

none

Notes for `falco.artifact.install.enabled`

Falcoctl Artifact Install Enabled: Configure Falcoctl to install additional artifacts before Falco starts.

Set this to false in an air-gapped environment, unless artifacts are self-hosted and customIndexes are configured.

Notes for `falco.customRules`

Falco Custom Rules: Configure custom rules to use in Falco.

Note

See the upstream documentation for reference.

The keys will become the file name of the generated rule file, and all files are parsed in alphabetical order.

Notes for `falco.driver.kind`

Falco Driver Kind

Possible values:

kmod

modern_ebpf

ebpf

Notes for `falco.falcoSidekick.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `falco.falcoSidekick.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `falco.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `falco.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`fluentd`¶

Fluentd Config: Configuration for Fluentd.

Fluentd automatically collects logs from all containers running in the environment.

In the service cluster audit, application, and platform logs can be shipped to object storage. In the workload cluster audit logs can be shipped to object storage and application and platform logs to OpenSearch running in the service cluster.

Logs are collected using a daemon set, and in the workload cluster two sets are deployed, one for the system nodes and one for the worker nodes. Application developer can modify two ConfigMaps to add additional configuration and plugins to the set running on the worker nodes.

When logs are shipped to object storage a stateful aggregator is deployed that buffers logs with persistence before they are shipped. When logs are shipped to OpenSearch it is done directly from the forwarder daemons.

Shipping audit and service cluster logs requires that objectStorage is configured, and will use the bucket or container set in objectStorage.buckets.audit and objectStorage.buckets.scLogs respectively.

Note

Fluentd is installed in both service cluster and workload cluster, so this configuration applies there with some exceptions.

Key	Type	Default	Title and Description
fluentd.aggregator¶	object	—	Fluentd Aggregator: Configure Fluentd aggregator, used to buffer logs with persistence before they are shipped to object storage.
fluentd.aggregator.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
fluentd.aggregator.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
fluentd.aggregator.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
fluentd.aggregator.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
fluentd.aggregator.buffer¶	object	—	See note
fluentd.aggregator.buffer.chunkLimitSize¶	string	—	See note
fluentd.aggregator.buffer.flushInterval¶	string	—	See note
fluentd.aggregator.buffer.flushMode¶	string	—	See note
fluentd.aggregator.buffer.flushThreadBurstInterval¶	number	—	See note
fluentd.aggregator.buffer.flushThreadCount¶	integer	—	Flush Thread Count: The number of threads to flush/write chunks in parallel. Flushing parameters
fluentd.aggregator.buffer.retryForever¶	boolean	—	See note
fluentd.aggregator.buffer.retryMaxInterval¶	integer	—	See note
fluentd.aggregator.buffer.retryType¶	string	—	See note
fluentd.aggregator.buffer.timekey¶	string	—	See note
fluentd.aggregator.buffer.timekeyUseUtc¶	boolean	—	Timekey Use UTC: Output plugin decides to use UTC or not to format placeholders using timekey. Common/Time parameters
fluentd.aggregator.buffer.timekeyWait¶	string	—	See note
fluentd.aggregator.buffer.totalLimitSize¶	string	—	See note
fluentd.aggregator.nodeSelector¶	object	—	See note
fluentd.aggregator.persistence¶	object	—	Fluentd Aggregator Persistence: Configure Fluentd aggregator persistence.
fluentd.aggregator.persistence.storage¶	string	`10Gi`	Fluentd Aggregator Storage
fluentd.aggregator.resources¶	object	—	See note
fluentd.aggregator.resources.limits¶	object	—	Kubernetes Quantity Map
fluentd.aggregator.resources.requests¶	object	—	Kubernetes Quantity Map
fluentd.aggregator.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
fluentd.audit¶	object	—	Fluentd Audit: Configure Fluentd audit log collection.
fluentd.audit.compaction¶	object	—	Log Manager Compaction: Configure the compaction of logs stored in object storage.
fluentd.audit.compaction.days¶	number	—	Log Manager Job Enabled: Configure the days to consider for compaction or the days to retain.
fluentd.audit.compaction.enabled¶	boolean	`True`	Log Manager Job Enabled
fluentd.audit.compaction.ephemeralVolumes¶	object	—	Log Manager Job Ephemeral Volume: Configure the job to run with an ephemeral volume if the nodes risk running out of storage.
fluentd.audit.compaction.ephemeralVolumes.enabled¶	boolean	—	Log Manager Job Ephemeral Volume Enabled
fluentd.audit.compaction.schedule¶	string	—	—
fluentd.audit.enabled¶	boolean	—	Fluentd Audit Enabled
fluentd.audit.filters¶	string	—	Fluentd Audit Filters: Configure Fluentd audit log filter stages. To capture audit logs label the logs with the `@AUDIT` label.
fluentd.audit.retention¶	object	—	Log Manager Retention: Configure the retention of logs stored in object storage.
fluentd.audit.retention.days¶	number	—	Log Manager Job Enabled: Configure the days to consider for compaction or the days to retain.
fluentd.audit.retention.enabled¶	boolean	`True`	Log Manager Job Enabled
fluentd.audit.retention.schedule¶	string	—	—
fluentd.enabled¶	boolean	`True`	Fluentd Enabled
fluentd.extraConfigMaps¶	object	—	See note
fluentd.forwarder¶	object	—	Fluentd Forwarder: Configure Fluentd forwarder, used to collect and forward logs on system nodes.
fluentd.forwarder.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
fluentd.forwarder.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
fluentd.forwarder.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
fluentd.forwarder.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
fluentd.forwarder.buffer¶	object	—	See note
fluentd.forwarder.buffer.chunkLimitSize¶	string	—	See note
fluentd.forwarder.buffer.flushInterval¶	string	—	See note
fluentd.forwarder.buffer.flushMode¶	string	—	See note
fluentd.forwarder.buffer.flushThreadBurstInterval¶	number	—	See note
fluentd.forwarder.buffer.flushThreadCount¶	integer	—	Flush Thread Count: The number of threads to flush/write chunks in parallel. Flushing parameters
fluentd.forwarder.buffer.retryForever¶	boolean	—	See note
fluentd.forwarder.buffer.retryMaxInterval¶	integer	—	See note
fluentd.forwarder.buffer.retryType¶	string	—	See note
fluentd.forwarder.buffer.timekey¶	string	—	See note
fluentd.forwarder.buffer.timekeyUseUtc¶	boolean	—	Timekey Use UTC: Output plugin decides to use UTC or not to format placeholders using timekey. Common/Time parameters
fluentd.forwarder.buffer.timekeyWait¶	string	—	See note
fluentd.forwarder.buffer.totalLimitSize¶	string	—	See note
fluentd.forwarder.image¶	object	—	Fluentd Forwarder Image Config: Configure Fluentd forwarder image repository and tag
fluentd.forwarder.image.repository¶	string	`ghcr.io/elastisys/fluentd-forwarder`	—
fluentd.forwarder.image.tag¶	string	`v4.7.5-ck8s1`	—
fluentd.forwarder.livenessThresholdSeconds¶	number	`900`	—
fluentd.forwarder.nodeSelector¶	object	—	See note
fluentd.forwarder.requestTimeout¶	string	`60s`	—
fluentd.forwarder.resources¶	object	—	See note
fluentd.forwarder.resources.limits¶	object	—	Kubernetes Quantity Map
fluentd.forwarder.resources.requests¶	object	—	Kubernetes Quantity Map
fluentd.forwarder.stuckThresholdSeconds¶	number	`1200`	—
fluentd.forwarder.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
fluentd.logManager¶	object	—	Log Manager: Configure log-manager, used to manage compaction and retention of logs store in object storage.
fluentd.logManager.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
fluentd.logManager.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
fluentd.logManager.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
fluentd.logManager.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
fluentd.logManager.compaction¶	object	—	Log Manager Compaction: Configure log-manager compaction.
fluentd.logManager.compaction.azureCopyBufferGB¶	number	—	Configure the memory buffer size in GB (accepts decimals) for Azure copy operations.
fluentd.logManager.compaction.azureCopyConcurrency¶	number	—	Configure the maximum number of concurrent download requests for Azure copy operations.
fluentd.logManager.compaction.resources¶	object	—	See note
fluentd.logManager.compaction.resources.limits¶	object	—	Kubernetes Quantity Map
fluentd.logManager.compaction.resources.requests¶	object	—	Kubernetes Quantity Map
fluentd.logManager.compaction.volume¶	object	—	Log Manager Compaction Volume: Configure log-manager compaction volume.
fluentd.logManager.compaction.volume.storage¶	string	`5Gi`	Log Manager Compaction Volume Size: Configure log-manager compaction volume size.
fluentd.logManager.nodeSelector¶	object	—	See note
fluentd.logManager.retention¶	object	—	Log Manager Retention: Configure log-manager retention.
fluentd.logManager.retention.resources¶	object	—	See note
fluentd.logManager.retention.resources.limits¶	object	—	Kubernetes Quantity Map
fluentd.logManager.retention.resources.requests¶	object	—	Kubernetes Quantity Map
fluentd.logManager.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
fluentd.objectStorage¶	object	—	Object Storage Configuration.: Configuration options for using object storage specific to Fluentd.
fluentd.objectStorage.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
fluentd.objectStorage.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
fluentd.objectStorage.s3.region¶	string	—	S3 Region: Region to store data.
fluentd.objectStorage.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
fluentd.objectStorage.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
fluentd.scLogs¶	object	—	Fluentd SC Logs: Configure Fluentd service cluster log collection.
fluentd.scLogs.compaction¶	object	—	Log Manager Compaction: Configure the compaction of logs stored in object storage.
fluentd.scLogs.compaction.days¶	number	—	Log Manager Job Enabled: Configure the days to consider for compaction or the days to retain.
fluentd.scLogs.compaction.enabled¶	boolean	`True`	Log Manager Job Enabled
fluentd.scLogs.compaction.ephemeralVolumes¶	object	—	Log Manager Job Ephemeral Volume: Configure the job to run with an ephemeral volume if the nodes risk running out of storage.
fluentd.scLogs.compaction.ephemeralVolumes.enabled¶	boolean	—	Log Manager Job Ephemeral Volume Enabled
fluentd.scLogs.compaction.schedule¶	string	—	—
fluentd.scLogs.enabled¶	boolean	`True`	Fluentd SC Logs Enabled
fluentd.scLogs.retention¶	object	—	Log Manager Retention: Configure the retention of logs stored in object storage.
fluentd.scLogs.retention.days¶	number	—	Log Manager Job Enabled: Configure the days to consider for compaction or the days to retain.
fluentd.scLogs.retention.enabled¶	boolean	`True`	Log Manager Job Enabled
fluentd.scLogs.retention.schedule¶	string	—	—
fluentd.user¶	object	—	Fluentd Forwarder User: Configure Fluentd forwarder, used to collect and forward logs on worker nodes that applications developers run their workload on.
fluentd.user.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
fluentd.user.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
fluentd.user.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
fluentd.user.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
fluentd.user.nodeSelector¶	object	—	See note
fluentd.user.resources¶	object	—	See note
fluentd.user.resources.limits¶	object	—	Kubernetes Quantity Map
fluentd.user.resources.requests¶	object	—	Kubernetes Quantity Map
fluentd.user.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration

Notes for `fluentd.aggregator.buffer`

Fluentd Buffer Config: Fluentd buffer configuration parameters.

Note

See upstream documentation for reference, set keys will be converted from camelCase to snake_case.

Notes for `fluentd.aggregator.buffer.chunkLimitSize`

Chunk Limit Size: Events will be written into chunks until the size of chunks become chunkLimitSize.

Examples:

50MB

Notes for `fluentd.aggregator.buffer.flushInterval`

Flush Interval: Flushes the buffer each flushInterval, if flushMode is equal to interval.

Examples:

15m

Notes for `fluentd.aggregator.buffer.flushMode`

Flush Mode: The flush mode to use.

Possible values:

lazy

interval

immediate

Notes for `fluentd.aggregator.buffer.flushThreadBurstInterval`

Flush Thread Burst Interval: The sleep interval (seconds) for threads between flushes when the output plugin flushes the waiting chunks to the next ones.

Notes for `fluentd.aggregator.buffer.retryForever`

Retry Forever: If true, plugin will ignore retryTimeout and retryMaxTimes options and retry flushing forever.

Notes for `fluentd.aggregator.buffer.retryMaxInterval`

Retry Max Interval: The maximum interval (seconds) for exponential backoff between retries while failing.

Notes for `fluentd.aggregator.buffer.retryType`

Retry Type: The retry algorithm type to use.

Possible values:

exponential_backoff

periodic

Notes for `fluentd.aggregator.buffer.timekey`

Time Key: Output plugin will flush chunks per specified time (enabled when time is specified in chunk keys).

Examples:

10m

Notes for `fluentd.aggregator.buffer.timekeyWait`

Timekey wait: Output plugin will write chunks after timekey_wait seconds later after timekey expiration.

If a user configures timekey 60m, output plugin will wait delayed events for flushed timekey and write the chunk at 10 minutes of each hour.

Examples:

1m

Notes for `fluentd.aggregator.buffer.totalLimitSize`

Total Limit Size: The size limitation of this buffer plugin instance.

Once the total size of stored buffer reached this threshold, all append operations will fail with error (and data will be lost).

Examples:

9GB

Notes for `fluentd.aggregator.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `fluentd.aggregator.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `fluentd.extraConfigMaps`

Fluentd Extra ConfigMaps: Configure extra ConfigMaps for Fluentd.

Note

This is only applicable for Fluentd forwarder running on system nodes in the workload cluster.

Notes for `fluentd.forwarder.buffer`

Fluentd Buffer Config: Fluentd buffer configuration parameters.

Note

See upstream documentation for reference, set keys will be converted from camelCase to snake_case.

Notes for `fluentd.forwarder.buffer.chunkLimitSize`

Chunk Limit Size: Events will be written into chunks until the size of chunks become chunkLimitSize.

Examples:

50MB

Notes for `fluentd.forwarder.buffer.flushInterval`

Flush Interval: Flushes the buffer each flushInterval, if flushMode is equal to interval.

Examples:

15m

Notes for `fluentd.forwarder.buffer.flushMode`

Flush Mode: The flush mode to use.

Possible values:

lazy

interval

immediate

Notes for `fluentd.forwarder.buffer.flushThreadBurstInterval`

Flush Thread Burst Interval: The sleep interval (seconds) for threads between flushes when the output plugin flushes the waiting chunks to the next ones.

Notes for `fluentd.forwarder.buffer.retryForever`

Retry Forever: If true, plugin will ignore retryTimeout and retryMaxTimes options and retry flushing forever.

Notes for `fluentd.forwarder.buffer.retryMaxInterval`

Retry Max Interval: The maximum interval (seconds) for exponential backoff between retries while failing.

Notes for `fluentd.forwarder.buffer.retryType`

Retry Type: The retry algorithm type to use.

Possible values:

exponential_backoff

periodic

Notes for `fluentd.forwarder.buffer.timekey`

Time Key: Output plugin will flush chunks per specified time (enabled when time is specified in chunk keys).

Examples:

10m

Notes for `fluentd.forwarder.buffer.timekeyWait`

Timekey wait: Output plugin will write chunks after timekey_wait seconds later after timekey expiration.

If a user configures timekey 60m, output plugin will wait delayed events for flushed timekey and write the chunk at 10 minutes of each hour.

Examples:

1m

Notes for `fluentd.forwarder.buffer.totalLimitSize`

Total Limit Size: The size limitation of this buffer plugin instance.

Once the total size of stored buffer reached this threshold, all append operations will fail with error (and data will be lost).

Examples:

9GB

Notes for `fluentd.forwarder.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `fluentd.forwarder.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `fluentd.logManager.compaction.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `fluentd.logManager.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `fluentd.logManager.retention.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `fluentd.user.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `fluentd.user.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`gatekeeper`¶

OPA Gatekeeper Config: Configure OPA Gatekeeper to give application developer access to Custom Resource Definitions.

Some preconfigured services can be found under the key user.

Note

See the admin docs for context.

Key	Type	Default	Title and Description
gatekeeper.additionalMutationResources[]¶	array	—	Additional Mutation Resources: Allow Gatekeeper the ability to look at and use Gatekeeper mutations on specified additional resources.
gatekeeper.additionalValidationDeleteResources[]¶	array	—	Additional Validation Delete Resources: Allow Gatekeeper the ability to look at and use Gatekeeper constraints with the less used DELETE operation, on specified additional resources.
gatekeeper.additionalValidationResources[]¶	array	—	Additional Validation Resources: Allow Gatekeeper the ability to look at and use Gatekeeper constraints on specified additional resources.
gatekeeper.allowUserCRDs¶	object	—	Allow Dev CRDs: Configure access to Custom Resource Definitions for application developers.
gatekeeper.allowUserCRDs.adminConfUser¶	string	`kubernetes-admin`	Dev CRDs Admin Config User: Configure the admin config user of the `/etc/kubernetes/admin.conf` found on the control plane nodes. This is necessary if Kubespray is used for managing the cluster.
gatekeeper.allowUserCRDs.enabled¶	boolean	—	Dev CRDs Enabled
gatekeeper.allowUserCRDs.enforcement¶	string	`deny`	See note
gatekeeper.allowUserCRDs.extraCRDs[]¶	array of object	—	Dev CRDs Extra CRDs: Configure extra CRDs to allow for application developers. Configure extra CRDs to allow for application developers.
gatekeeper.allowUserCRDs.extraServiceAccounts[]¶	array of object	—	See note
gatekeeper.enabled¶	boolean	`True`	Gatekeeper Enabled

Notes for `gatekeeper.allowUserCRDs.enforcement`

Dev CRDs Enforcement

Possible values:

deny

warn

dryrun

Notes for `gatekeeper.allowUserCRDs.extraServiceAccounts[]`

Dev CRDs Extra Service Accounts: Configure extra service accounts to allow access to configured CRDs.

Configure an extra service account to allow access to configured CRDs.

Examples:

[{'namespace': 'example-namespace', 'name': 'example-controller'}]

`global`¶

Global options: Some common options used in various helm charts.

Key	Type	Default	Title and Description
global.baseDomain¶	string	—	See note
global.ck8sCloudProvider¶	string	—	See note
global.ck8sConfigSerial¶	string	—	See note
global.ck8sEnvironmentName¶	string	—	See note
global.ck8sFlavor¶	string	—	See note
global.ck8sK8sInstaller¶	string	—	See note
global.ck8sVersion¶	string	—	See note
global.clusterDns¶	string	`10.233.0.3`	IP of the cluster DNS in kubernetes
global.clusterName¶	string	—	—
global.clustersMonitoring[]¶	array of string	—	Clusters Monitoring: Configure the names of the workload clusters that sends metrics to the service cluster. Mainly used to filter metrics.
global.containerRuntime¶	string	`containerd`	See note
global.enforceIPFamilies¶	boolean	—	See note
global.enforceIPFamilyPolicy¶	boolean	—	See note
global.ipFamilies[]¶	array of string	`['IPv4']`	Global setting for ipFamilies for services: Used to set the ipFamilyPolicy for all configurable services.
global.ipFamilyPolicy¶	string	`SingleStack`	See note
global.issuer¶	string	`letsencrypt-staging`	See note
global.opsDomain¶	string	—	See note
global.scDomain¶	string	—	If baseDomain for wc and sc are not the same, set the domain of the sc cluster.
global.scOpsDomain¶	string	—	If opsDomain for wc and sc are not the same, set the ops domain of the sc cluster.
global.verifyTls¶	boolean	`True`	Verify ingress certificates

Notes for `global.baseDomain`

Base Domain: Domain intended for ingress usage in the workload cluster and to reach application developer facing services such as Grafana, Harbor and OpenSearch Dashboards. E.g. with 'prod.domain.com', OpenSearch Dashboards is reached via 'opensearch.prod.domain.com'.

Notes for `global.ck8sCloudProvider`

Possible values:

aws

azure

baremetal

citycloud

elastx

exoscale

none

safespring

upcloud

openstack

Notes for `global.ck8sConfigSerial`

Timestamp of last migration: This property is used during migrations to track state and ensure that the same version is used during ck8s upgrade prepare as during ck8s upgrade apply.

Examples:

2025-04-29T08:34:21+00:00

Notes for `global.ck8sEnvironmentName`

Environment name

Examples:

my-welkin-cluster

Notes for `global.ck8sFlavor`

Possible values:

prod

dev

air-gapped

Notes for `global.ck8sK8sInstaller`

Possible values:

capi

kubespray

none

Notes for `global.ck8sVersion`

Welkin Apps version: Use version number if you are exactly at a release tag. Otherwise use full commit hash of current commit. any, can be used to disable this validation.

Examples:

v0.42.1

any

424442541a567646c232d949bad1af2b5b7cb885

Notes for `global.containerRuntime`

Container runtime

Possible values:

containerd

docker

Notes for `global.enforceIPFamilies`

Enforce ipFamilies to all services that doesn't explicitly set it.: Enforce ipFamilyPolicy to all services that doesn't explicitly set it. This is done using a mutating webhook to all services that doesn't set this. The value it sets is taken from .global.ipFamilies

Notes for `global.enforceIPFamilyPolicy`

Enforce ipFamilyPolicy to all services that doesn't explicitly set it.: Enforce ipFamilyPolicy to all services that doesn't explicitly set it. This is done using a mutating webhook to all services that doesn't set this. The value it sets is taken from .global.ipFamilyPolicy

Notes for `global.ipFamilyPolicy`

Global setting for ipFamilyPolicy for services: Used to set the ipFamilyPolicy for all configurable services.

Examples:

SingleStack

PreferDualStack

RequireDualStack

Possible values:

SingleStack

PreferDualStack

RequireDualStack

Notes for `global.issuer`

Default cert-manager issuer to use for issuing certificates for ingresses. Normally one of letsencrypt-staging or letsencrypt-prod.

Examples:

letsencrypt-staging

letsencrypt-prod

selfsigned

Notes for `global.opsDomain`

Domain intended for ingress usage in the service cluster and to reach non-user facing services such as Thanos and OpenSearch. E.g. with 'ops.prod.domain.com', OpenSearch is reached via 'opensearch.ops.prod.domain.com'.

`gpu`¶

GPU Config: Configure the GPU Operator and its dependencies

Key	Type	Default	Title and Description
gpu.daemonsets¶	object	—	GPU Daemonsets Config: Configure GPU Daemonsets
gpu.daemonsets.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
gpu.devicePlugin¶	object	—	Device Plugin Configuration: Configuration for the device plugin, e.g. timeslicing
gpu.enabled¶	boolean	—	GPU Operator Enabled
gpu.extraMetrics¶	boolean	—	Enable Additional DCGM Metrics: Adds some profiling metrics in DCGM if it's available in your GPU setup
gpu.mig¶	object	—	MIG Configuration: Configure MIG options like strategy
gpu.mig.strategy¶	string	—	See note
gpu.nodeFeatureDiscovery¶	object	—	Node Feature Discovery Config: Configure Node Feature Discovery
gpu.nodeFeatureDiscovery.controlPlane¶	object	—	Node Feature Discovery Control Plane Config: Configure Node Feature Discovery Control Plane
gpu.nodeFeatureDiscovery.controlPlane.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
gpu.nodeFeatureDiscovery.controlPlane.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
gpu.nodeFeatureDiscovery.controlPlane.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
gpu.nodeFeatureDiscovery.controlPlane.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
gpu.nodeFeatureDiscovery.controlPlane.resources¶	object	—	See note
gpu.nodeFeatureDiscovery.controlPlane.resources.limits¶	object	—	Kubernetes Quantity Map
gpu.nodeFeatureDiscovery.controlPlane.resources.requests¶	object	—	Kubernetes Quantity Map
gpu.nodeFeatureDiscovery.controlPlane.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
gpu.nodeFeatureDiscovery.worker¶	object	—	Node Feature Discovery worker Config: Configure Node Feature Discovery workers
gpu.nodeFeatureDiscovery.worker.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
gpu.nodeFeatureDiscovery.worker.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
gpu.nodeFeatureDiscovery.worker.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
gpu.nodeFeatureDiscovery.worker.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
gpu.nodeFeatureDiscovery.worker.resources¶	object	—	See note
gpu.nodeFeatureDiscovery.worker.resources.limits¶	object	—	Kubernetes Quantity Map
gpu.nodeFeatureDiscovery.worker.resources.requests¶	object	—	Kubernetes Quantity Map
gpu.nodeFeatureDiscovery.worker.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
gpu.operator¶	object	—	GPU Operator Config: Configure GPU Operator
gpu.operator.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
gpu.operator.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
gpu.operator.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
gpu.operator.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
gpu.operator.resources¶	object	—	See note
gpu.operator.resources.limits¶	object	—	Kubernetes Quantity Map
gpu.operator.resources.requests¶	object	—	Kubernetes Quantity Map
gpu.operator.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration

Notes for `gpu.mig.strategy`

MIG Strategy: None ignores MIG entirely, single makes MIG devices a standard GPU resource, and shared creates one resource type for each MIG configuration

Possible values:

mixed

single

none

Notes for `gpu.nodeFeatureDiscovery.controlPlane.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `gpu.nodeFeatureDiscovery.worker.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `gpu.operator.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`grafana`¶

Grafana Config: Configure Grafana, the metrics visualisation dashboard.

Welkin hosts two instances of Grafana one for the Platform Administrator and one for the Application Developer.

Note

Grafana is installed in the service cluster, so this configuration mainly applies there.

Key	Type	Default	Title and Description
grafana.ops¶	object	—	Grafana: Configure Grafana.
grafana.ops.additionalConfigValues¶	string	—	Grafana Additional Config Values
grafana.ops.additionalDatasources¶	object	—	Grafana Additional Datasources
grafana.ops.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
grafana.ops.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
grafana.ops.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
grafana.ops.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
grafana.ops.contentSecurityPolicy¶	object	—	Content-Security-Policy rules: Configure Content-Security-Policy header rules Reference: https://content-security-policy.com/
grafana.ops.dataproxy¶	object	—	Grafana dataproxy values: Configure Grafana dataproxy values
grafana.ops.dataproxy.timeout¶	number	`600`	Grafana dataproxy timeout
grafana.ops.enabled¶	boolean	`True`	Grafana Enabled
grafana.ops.nodeSelector¶	object	—	See note
grafana.ops.oidc¶	object	—	Grafana OIDC: Configure authentication to Grafana via Dex.
grafana.ops.oidc.allowedDomains[]¶	array of string	—	Grafana OIDC Allowed Domains: Configure the domains of the users allowed to authenticate to Grafana.
grafana.ops.oidc.enabled¶	boolean	`True`	Grafana OIDC Enabled
grafana.ops.oidc.jwtEnabled¶	boolean	—	Enable authentication through JWT: This setting can weaken the security stance for authentication and should only be used in testing.
grafana.ops.oidc.scopes¶	string	`openid profile email groups`	Grafana OIDC Scopes
grafana.ops.oidc.skipRoleSync¶	boolean	—	Grafana Skip Role Sync: When enabled the roles for user can be managed within Grafana.
grafana.ops.oidc.userGroups¶	object	—	Grafana OIDC Groups: Configure the roles for groups.
grafana.ops.oidc.userGroups.grafanaAdmin¶	string	`grafana_admin`	Grafana OIDC Admin Group
grafana.ops.oidc.userGroups.grafanaEditor¶	string	`grafana_editor`	Grafana OIDC Editor Group
grafana.ops.oidc.userGroups.grafanaViewer¶	string	`grafana_viewer`	Grafana OIDC Viewer Group
grafana.ops.plugins[]¶	array	—	Grafana Additional Plugins
grafana.ops.resources¶	object	—	See note
grafana.ops.resources.limits¶	object	—	Kubernetes Quantity Map
grafana.ops.resources.requests¶	object	—	Kubernetes Quantity Map
grafana.ops.sidecar¶	object	—	Grafana Sidecar: Configure the sidecar provisioning dashboards from ConfigMaps in Grafana.
grafana.ops.sidecar.resources¶	object	—	See note
grafana.ops.sidecar.resources.limits¶	object	—	Kubernetes Quantity Map
grafana.ops.sidecar.resources.requests¶	object	—	Kubernetes Quantity Map
grafana.ops.subdomain¶	string	`grafana`	See note
grafana.ops.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
grafana.ops.trailingDots¶	boolean	`True`	See note
grafana.ops.viewersCanEdit¶	boolean	`True`	Grafana Viewers Can Edit
grafana.user¶	object	—	Grafana: Configure Grafana.
grafana.user.additionalConfigValues¶	string	—	Grafana Additional Config Values
grafana.user.additionalDatasources¶	object	—	Grafana Additional Datasources
grafana.user.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
grafana.user.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
grafana.user.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
grafana.user.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
grafana.user.contentSecurityPolicy¶	object	—	Content-Security-Policy rules: Configure Content-Security-Policy header rules Reference: https://content-security-policy.com/
grafana.user.dataproxy¶	object	—	Grafana dataproxy values: Configure Grafana dataproxy values
grafana.user.dataproxy.timeout¶	number	`600`	Grafana dataproxy timeout
grafana.user.enabled¶	boolean	`True`	Grafana Enabled
grafana.user.nodeSelector¶	object	—	See note
grafana.user.oidc¶	object	—	Grafana OIDC: Configure authentication to Grafana via Dex.
grafana.user.oidc.allowedDomains[]¶	array of string	—	Grafana OIDC Allowed Domains: Configure the domains of the users allowed to authenticate to Grafana.
grafana.user.oidc.enabled¶	boolean	`True`	Grafana OIDC Enabled
grafana.user.oidc.jwtEnabled¶	boolean	—	Enable authentication through JWT: This setting can weaken the security stance for authentication and should only be used in testing.
grafana.user.oidc.scopes¶	string	`openid profile email groups`	Grafana OIDC Scopes
grafana.user.oidc.skipRoleSync¶	boolean	—	Grafana Skip Role Sync: When enabled the roles for user can be managed within Grafana.
grafana.user.oidc.userGroups¶	object	—	Grafana OIDC Groups: Configure the roles for groups.
grafana.user.oidc.userGroups.grafanaAdmin¶	string	`grafana_admin`	Grafana OIDC Admin Group
grafana.user.oidc.userGroups.grafanaEditor¶	string	`grafana_editor`	Grafana OIDC Editor Group
grafana.user.oidc.userGroups.grafanaViewer¶	string	`grafana_viewer`	Grafana OIDC Viewer Group
grafana.user.plugins[]¶	array	—	Grafana Additional Plugins
grafana.user.resources¶	object	—	See note
grafana.user.resources.limits¶	object	—	Kubernetes Quantity Map
grafana.user.resources.requests¶	object	—	Kubernetes Quantity Map
grafana.user.sidecar¶	object	—	Grafana Sidecar: Configure the sidecar provisioning dashboards from ConfigMaps in Grafana.
grafana.user.sidecar.resources¶	object	—	See note
grafana.user.sidecar.resources.limits¶	object	—	Kubernetes Quantity Map
grafana.user.sidecar.resources.requests¶	object	—	Kubernetes Quantity Map
grafana.user.subdomain¶	string	`grafana`	See note
grafana.user.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
grafana.user.trailingDots¶	boolean	`True`	See note
grafana.user.viewersCanEdit¶	boolean	`True`	Grafana Viewers Can Edit

Notes for `grafana.ops.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `grafana.ops.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `grafana.ops.sidecar.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `grafana.ops.subdomain`

Grafana Subdomain: For Admin Grafana the subdomain of opsDomain that the Ingress to Admin Grafana will be created with.

For Dev Grafana the subdomain of baseDomain that the Ingress to Dev Grafana will be created with.

Note

Must be set for both service and workload clusters.

Notes for `grafana.ops.trailingDots`

Grafana Trailing Dots: Configure Grafana to use absolute domain names.

Warning

Some operating systems and web browsers may have problems accessing Grafana when with this enabled.

Notes for `grafana.user.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `grafana.user.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `grafana.user.sidecar.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `grafana.user.subdomain`

Grafana Subdomain: For Admin Grafana the subdomain of opsDomain that the Ingress to Admin Grafana will be created with.

For Dev Grafana the subdomain of baseDomain that the Ingress to Dev Grafana will be created with.

Note

Must be set for both service and workload clusters.

Notes for `grafana.user.trailingDots`

Grafana Trailing Dots: Configure Grafana to use absolute domain names.

Warning

Some operating systems and web browsers may have problems accessing Grafana when with this enabled.

`grafanaLabelEnforcer`¶

Grafana Label Enforcer Config: Configure Grafana Label Enforcer, responsible to filter metrics from different clusters for Grafana datasources.

Key	Type	Default	Title and Description
grafanaLabelEnforcer.resources¶	object	—	See note
grafanaLabelEnforcer.resources.limits¶	object	—	Kubernetes Quantity Map
grafanaLabelEnforcer.resources.requests¶	object	—	Kubernetes Quantity Map

Notes for `grafanaLabelEnforcer.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`harbor`¶

Harbor Config: Configuration options for Harbor.

Harbor is a container registry that deployed for the application developers to use when deploying their applications.

Note

See upstream documentation for reference. All config variables that exists in harbor are not exposed via our config.

Key	Type	Default	Title and Description
harbor.alerts¶	object	—	Alert Config: Configuration options for Harbor Alerts.
harbor.alerts.HarborP50LatencyHigherThan10Seconds¶	object	—	Config for HarborP50LatencyHigherThan10Seconds alert: Configuration options for HarborP50LatencyHigherThan10Seconds alert.
harbor.alerts.HarborP50LatencyHigherThan10Seconds.enabled¶	boolean	`True`	Enable HarborP50LatencyHigherThan10Seconds alert
harbor.alerts.HarborP99LatencyHigherThan55Seconds¶	object	—	Config for HarborP99LatencyHigherThan55Seconds alert: Configuration options for HarborP99LatencyHigherThan55Seconds alert.
harbor.alerts.HarborP99LatencyHigherThan55Seconds.enabled¶	boolean	`True`	Enable HarborP99LatencyHigherThan55Seconds alert
harbor.alerts.maxTotalArtifacts¶	number	`3000`	Alert For Max Total Artifacts: Alert when the total number of artifacts is above the set number.
harbor.alerts.maxTotalStorageUsedGB¶	number	`1500`	Alert For Max Total Storage Used (GB): Alert when the total storage usage is above the set number.
harbor.backup¶	object	—	Backup Job Config: Configuration options for Backup Job.
harbor.backup.enabled¶	boolean	`True`	Enable Harbor Backup
harbor.backup.ephemeralBackupStore¶	object	—	Ephemeral Backup Store Config: EphemeralBackupStore configuration for Harbor `StorageSize` defines how large the ephemeral volumes will be.
harbor.backup.ephemeralBackupStore.enabled¶	boolean	—	Enable Ephemeral Backup Store
harbor.backup.ephemeralBackupStore.storageSize¶	string	`10Gi`	Storage Size
harbor.backup.retentionDays¶	number	`7`	Backup Retention Days: `RetentionDays` defines how old a backup should be before deleting it.
harbor.backup.schedule¶	string	—	—
harbor.core¶	object	—	Core Config: Configuration options for Core.
harbor.core.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.core.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.core.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.core.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.core.replicas¶	number	`1`	Core replication: Number of Core pods
harbor.core.resources¶	object	—	See note
harbor.core.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.core.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.database¶	object	—	See note
harbor.database.external¶	object	—	External Database Config: Configuration options for External Database.
harbor.database.external.coreDatabase¶	string	`registry`	Core Database: Name of the database for Core
harbor.database.external.notaryServerDatabase¶	string	`notaryserver`	Notary Server Database: Name of the database for Notary Server
harbor.database.external.notarySignerDatabase¶	string	`notarysigner`	Notary Signer Database: Name of the database for Notary Signer
harbor.database.external.port¶	string	`5432`	Database Port: Database listening port
harbor.database.external.sslmode¶	string	`disable`	See note
harbor.database.internal¶	object	—	Internal Database Config: Configuration options for Internal Database.
harbor.database.internal.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.database.internal.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.database.internal.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.database.internal.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.database.internal.persistentVolumeClaim¶	object	—	Kubernetes Persistent Volume Claim: PersistentVolumeClaim
harbor.database.internal.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.database.internal.resources¶	object	—	See note
harbor.database.internal.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.database.internal.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.database.type¶	string	`internal`	—
harbor.enabled¶	boolean	`True`	Enable Harbor
harbor.exporter¶	object	—	Exporter Config: Configuration options for Exporter.
harbor.exporter.external¶	object	—	External: External configuration
harbor.exporter.external.coreDatabase¶	string	—	See note
harbor.exporter.external.port¶	string	—	See note
harbor.exporter.resources¶	object	—	See note
harbor.exporter.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.exporter.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.gc¶	object	—	GC (Garbage Collection) Config: Configuration options for GC (Garbage Collection).
harbor.gc.enabled¶	boolean	`True`	Enable GC (Garbage Collection)
harbor.gc.forceConfigure¶	boolean	—	Force Configure
harbor.gc.schedule¶	string	`0 0 0 * * SUN`	See note
harbor.ingress¶	object	—	Ingress Config: Configuration options for Ingress.
harbor.ingress.additionalAnnotations¶	object	—	Additional Annotations
harbor.ingress.defaultAnnotations¶	object	—	DefaultAnnotations: Default annotations for ingress
harbor.ingress.defaultAnnotations.nginx.ingress.kubernetes.io/proxy-buffering¶	string	—	Nginx Config proxy-buffering
harbor.ingress.defaultAnnotations.nginx.ingress.kubernetes.io/proxy-request-buffering¶	string	—	Nginx Config proxy-request-buffering
harbor.jobservice¶	object	—	Jobservice Config: Configuration options for Jobservice.
harbor.jobservice.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.jobservice.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.jobservice.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.jobservice.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.jobservice.jobLog¶	object	—	JobLog Config: Job log configuration
harbor.jobservice.jobLog.persistentVolumeClaim¶	object	—	Kubernetes Persistent Volume Claim: PersistentVolumeClaim
harbor.jobservice.jobLog.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.jobservice.jobLoggers[]¶	array of string	—	JobLoggers Config: Configuration options for JobLoggers
harbor.jobservice.replicas¶	number	`1`	Jobservice replication: Number of Jobservice pods
harbor.jobservice.resources¶	object	—	See note
harbor.jobservice.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.jobservice.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.jobservice.scanDataExports¶	object	—	Scan Data Exports Config: Scan data exports configuration
harbor.jobservice.scanDataExports.persistentVolumeClaim¶	object	—	Kubernetes Persistent Volume Claim: PersistentVolumeClaim
harbor.jobservice.scanDataExports.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.mpuCleaner¶	object	—	MultipartUpload cleaner job configuration: Configuration options for MultipartUpload cleaner job
harbor.mpuCleaner.enabled¶	boolean	`True`	Enable Harbor MultipartUpload cleaner
harbor.mpuCleaner.maxAgeDays¶	number	`7`	Max age: `maxAgeDays` defines how old an unfinished multipartupload is allowed to be before deleting it.
harbor.mpuCleaner.schedule¶	string	—	—
harbor.nodeSelector¶	object	—	See note
harbor.notary¶	object	—	Notary Config: Configuration options for Notary.
harbor.notary.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.notary.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.notary.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.notary.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.notary.replicas¶	number	`1`	—
harbor.notary.resources¶	object	—	See note
harbor.notary.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.notary.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.notary.subdomain¶	string	`notary.harbor`	—
harbor.notarySigner¶	object	—	NotarySigner Config: Configuration options for Notary signer.
harbor.notarySigner.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.notarySigner.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.notarySigner.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.notarySigner.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.notarySigner.resources¶	object	—	See note
harbor.notarySigner.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.notarySigner.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.objectStorage¶	object	—	Object Storage Configuration.: Configuration options for using object storage specific to harbor.
harbor.objectStorage.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
harbor.objectStorage.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
harbor.objectStorage.s3.region¶	string	—	S3 Region: Region to store data.
harbor.objectStorage.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
harbor.objectStorage.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
harbor.oidc¶	object	—	OIDC (OpenID Connector) Config: Configuration options for OIDC.
harbor.oidc.adminGroupName¶	string	—	—
harbor.oidc.groupClaimName¶	string	`groups`	—
harbor.oidc.scope¶	string	`openid,email,profile,offline_access,groups`	—
harbor.persistence¶	object	—	Persistence Config: Configuration options for Persistence.
harbor.persistence.disableRedirect¶	boolean	—	See note
harbor.persistence.type¶	string	—	See note
harbor.portal¶	object	—	Portal Config: Configuration options for Portal.
harbor.portal.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.portal.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.portal.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.portal.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.portal.replicas¶	number	`1`	—
harbor.portal.resources¶	object	—	See note
harbor.portal.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.portal.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.redis¶	object	—	See note
harbor.redis.external¶	object	—	External Redis Config: Configuration options when external Redis is set
harbor.redis.external.addr¶	string	—	See note
harbor.redis.external.sentinelMasterSet¶	string	—	—
harbor.redis.internal¶	object	—	Internal Redis Config: Configuration options when internal Redis is set
harbor.redis.internal.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.redis.internal.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.redis.internal.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.redis.internal.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.redis.internal.persistentVolumeClaim¶	object	—	Kubernetes Persistent Volume Claim: PersistentVolumeClaim
harbor.redis.internal.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.redis.internal.resources¶	object	—	See note
harbor.redis.internal.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.redis.internal.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.redis.type¶	string	`internal`	—
harbor.registry¶	object	—	Registry config: Registry configuration
harbor.registry.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.registry.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.registry.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.registry.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.registry.controller¶	object	—	Controller: Controller configuration
harbor.registry.controller.resources¶	object	—	See note
harbor.registry.controller.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.registry.controller.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.registry.persistentVolumeClaim¶	object	—	Kubernetes Persistent Volume Claim: PersistentVolumeClaim
harbor.registry.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.registry.replicas¶	number	`1`	—
harbor.registry.resources¶	object	—	See note
harbor.registry.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.registry.resources.requests¶	object	—	Kubernetes Quantity Map
harbor.s3¶	object	—	Storage Driver S3 Config: Configuration options for S3. Storage Driver S3
harbor.s3.multipartcopychunksize¶	-integer- -string-	—	Multi Part Copy Chunk Size: Default chunk size for all but the last S3 Multipart Upload part when copying stored objects.
harbor.s3.multipartcopymaxconcurrency¶	-integer- -string-	—	Multi Part Copy Max Concurrency: Max number of concurrent S3 Multipart Upload operations when copying stored objects.
harbor.s3.multipartcopythresholdsize¶	string	`536870912`	Multi Part Copy Threshold Size: Default object size above which S3 Multipart Upload will be used when copying stored objects.
harbor.subdomain¶	string	`harbor`	Sub Domain
harbor.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
harbor.trivy¶	object	—	Trivy Config: Configuration options for Trivy.
harbor.trivy.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
harbor.trivy.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.trivy.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.trivy.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.trivy.extraEnvVars[]¶	array of object	—	Trivy extra environment variables: Array of additional environment variables to pass to Trivy name/value combination
harbor.trivy.persistentVolumeClaim¶	object	—	Kubernetes Persistent Volume Claim: PersistentVolumeClaim
harbor.trivy.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.trivy.replicas¶	number	`1`	—
harbor.trivy.resources¶	object	—	See note
harbor.trivy.resources.limits¶	object	—	Kubernetes Quantity Map
harbor.trivy.resources.requests¶	object	—	Kubernetes Quantity Map

Notes for `harbor.core.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.database`

Database Config: Configuration options for Database used by Harbor

Set type to define which type of redis Harbor should use.

Only external or internal database can be enabled at the same time.

External: Defines an external postgres that harbor will use. For more details how to configure harbor to use an external database check the README

Internal: Use the internal database that is packaged with harbor.

Notes for `harbor.database.external.sslmode`

SSL mode type

Possible values:

disable

require

verify-ca

verify-full

Notes for `harbor.database.internal.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.exporter.external.coreDatabase`

Core Database

Examples:

registry

Notes for `harbor.exporter.external.port`

Database Port

Examples:

Notes for `harbor.exporter.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.gc.schedule`

Schedule: Defines a CRON schedule when the garbage collection job should run. Uses a special Cron format that adds "seconds" as the first entry. Order: "seconds, minutes, hours, day of month, month, day of week".

Notes for `harbor.jobservice.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `harbor.notary.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.notarySigner.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.persistence.disableRedirect`

Harbor registry disable object storage redirect: Controls whether or not Harbor registry redirects users to the object storage endpoint. Set this to true if the object storage is not reachable by users when pushing images to Harbor, e.g. if you run into this timeout error:

dial tcp <IP>:<PORT>: i/o timeout

Notes for `harbor.persistence.type`

Persistence type: This should match what is set in global config

Possible values:

filesystem

swift

objectStorage

Notes for `harbor.portal.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.redis`

Redis Config: Configuration options for Redis used by Harbor

Set type to define which type of redis Harbor should use.

Only external or internal redis can be enabled at the same time.

External: Defines an external redis that harbor will use. For more details how to configure harbor to use an external redis check the README

Internal: Use the internal redis that is packaged with harbor.

Notes for `harbor.redis.external.addr`

Examples:

rfs-redis-harbor.redis-system.svc.cluster.local:26379

Notes for `harbor.redis.internal.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.registry.controller.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.registry.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.trivy.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`hnc`¶

HNC (Hierarchical Namespace Controller) Config: Configuration for Hierarchical Namespace Controller.

Note

See upstream documentation for reference.

Key	Type	Default	Title and Description
hnc.additionalAllowPropagateResources[]¶	array of object	—	See note
hnc.enabled¶	boolean	`True`	Enable HNC: Enable HNC
hnc.excludedNamespaces[]¶	array of string	—	See note
hnc.ha¶	boolean	`True`	Enable Ha (High Availability): Enable HA mode for hnc webhooks.
hnc.includedNamespacesRegex¶	string	—	See note
hnc.managedNamespaceAnnotations[]¶	array of string	—	Managed Namespace Annotations: Annotations that will be propagated to subnamespaces (allows regex).
hnc.managedNamespaceLabels[]¶	array of string	—	Managed Namespace Labels: Labels that will be propagated to subnamespaces (allows regex). Labels in particular must also be configured in the HierarchyConfiguration object to be propagated.
hnc.manager¶	object	—	Common Resource: This is meant to describe the base class if you will, for Welkin resources.
hnc.manager.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
hnc.manager.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
hnc.manager.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
hnc.manager.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
hnc.manager.enabled¶	boolean	—	—
hnc.manager.extraArgs[]¶	array of string	—	Extra Arguments: Extra arguments passed to a container
hnc.manager.nodeSelector¶	object	—	See note
hnc.manager.resources¶	object	—	See note
hnc.manager.resources.limits¶	object	—	Kubernetes Quantity Map
hnc.manager.resources.requests¶	object	—	Kubernetes Quantity Map
hnc.manager.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
hnc.manager.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
hnc.serviceMonitor¶	object	—	Service Monitor: Service monitor for Hierarchical Namespace Controller.
hnc.serviceMonitor.relabelings[]¶	array	—	Relabelings: Relabeling
hnc.unpropagatedAnnotations[]¶	array	—	Unpropagated Annotations: Annotations that will be stripped from propagated objects
hnc.webhook¶	object	—	Webhook Config: Webhook for Hierarchical Namespace Controller.
hnc.webhook.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
hnc.webhook.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
hnc.webhook.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
hnc.webhook.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
hnc.webhook.nodeSelector¶	object	—	See note
hnc.webhook.replicaCount¶	integer	—	—
hnc.webhook.resources¶	object	—	See note
hnc.webhook.resources.limits¶	object	—	Kubernetes Quantity Map
hnc.webhook.resources.requests¶	object	—	Kubernetes Quantity Map
hnc.webhook.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
hnc.webhook.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
hnc.webhookMatchConditions¶	boolean	—	Webhook Match Conditions Enable: Fine grained mach conditions for webhook. This feature is only available in Kubernetes v1.28+.

Notes for `hnc.additionalAllowPropagateResources[]`

Additional Allow Propagate Resources List: Additional resources to enable opt-in propagation for. Objects that should be propagated must have one of the annotations listed here https://github.com/kubernetes-sigs/hierarchical-namespaces/blob/master/docs/user-guide/how-to.md#limit-the-propagation-of-an-object-to-descendant-namespaces

Additional allow propagate resources for hnc.

Examples:

{'resource': 'secrets'}

{'resource': 'networkpolicies', 'group': 'networking.k8s.io'}

Including and excluding namespaces

Notes for `hnc.excludedNamespaces[]`

Excluded Namespaces: Namespaces excluded by HNC, here you can configure a list of namespaces to exclude from HNC in addition to the default excluded namespaces.

Including and excluding namespaces

Notes for `hnc.includedNamespacesRegex`

Included Namespaces Regex: Included namespaces, empty string will include all.

Notes for `hnc.manager.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `hnc.manager.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `hnc.webhook.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `hnc.webhook.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`images`¶

Images Configuration: Configure individual container URI for images of all Welkin components, and (optionally) enable support for global registry and/or repository.

Key	Type	Default	Title and Description
images.calico¶	object	—	Calico stack image configuration: Calico stack image configuration
images.calico.accountant¶	string	—	See note
images.certManager¶	object	—	cert-manager stack image configuration: cert-manager stack image configuration
images.certManager.cainjector¶	string	—	See note
images.certManager.controller¶	string	—	See note
images.certManager.startupapicheck¶	string	—	See note
images.certManager.webhook¶	string	—	See note
images.crossplane¶	object	—	crossplane stack image configuration: crossplane stack image configuration
images.crossplane.configurations¶	object	—	Crossplane Configuration packages configuration: Crossplane Configuration packages configuration
images.crossplane.functions¶	object	—	Crossplane Function images configuration: Crossplane Function images configuration
images.crossplane.image¶	string	—	See note
images.crossplane.kubectl¶	string	—	See note
images.crossplane.providers¶	object	—	Crossplane Provider images configuration: Crossplane Provider images configuration
images.dex¶	object	—	Dex stack image configuration: Dex stack image configuration
images.dex.image¶	string	—	See note
images.externalDns¶	object	—	ExternalDNS stack image configuration: ExternalDNS stack image configuration
images.externalDns.image¶	string	—	See note
images.falco¶	object	—	falco stack image configuration: falco stack image configuration
images.falco.driverLoaderInit¶	string	—	See note
images.falco.falcoctl¶	string	—	See note
images.falco.image¶	string	—	See note
images.falco.sidekick¶	string	—	See note
images.fluentd¶	object	—	Fluentd stack image configuration: Fluentd stack image configuration
images.fluentd.aggregator¶	string	—	See note
images.fluentd.forwarder¶	string	—	See note
images.fluentd.logManager¶	string	—	See note
images.gatekeeper¶	object	—	Gatekeeper stack image configuration: Gatekeeper stack image configuration
images.gatekeeper.image¶	string	—	See note
images.gatekeeper.kubectl¶	string	—	See note
images.gatekeeper.postInstallLabelNamespace¶	string	—	See note
images.gatekeeper.preInstallCRDs¶	string	—	See note
images.global¶	object	—	See note
images.global.registry¶	object	—	Global image registry: If enabled it will be used as the registry of images that don't supply their own.
images.global.registry.enabled¶	boolean	—	Enable the global image registry
images.global.registry.uri¶	string	—	See note
images.global.repository¶	object	—	Global image repository: If enabled it will be used as the repository of images that don't supply their own.
images.global.repository.enabled¶	boolean	—	Enable the global image repository
images.global.repository.uri¶	string	—	See note
images.gpuOperator¶	object	—	GPU operator stack image configuration: GPU operator stack image configuration
images.gpuOperator.nodeFeatureDiscovery¶	string	—	See note
images.gpuOperator.operator¶	string	—	See note
images.harbor¶	object	—	Harbor stack image configuration: Harbor stack image configuration
images.harbor.backupJob¶	string	—	See note
images.harbor.core¶	string	—	See note
images.harbor.database¶	string	—	See note
images.harbor.exporter¶	string	—	See note
images.harbor.initJob¶	string	—	See note
images.harbor.jobservice¶	string	—	See note
images.harbor.mpuCleaner¶	string	—	See note
images.harbor.portal¶	string	—	See note
images.harbor.redis¶	string	—	See note
images.harbor.registry¶	string	—	See note
images.harbor.registryController¶	string	—	See note
images.harbor.trivyAdapter¶	string	—	See note
images.hnc¶	object	—	HNC stack image configuration: HNC stack image configuration
images.hnc.image¶	string	—	See note
images.ingressNginx¶	object	—	ingress-nginx stack image configuration: ingress-nginx stack image configuration
images.ingressNginx.admissionWebhooksPatch¶	string	—	See note
images.ingressNginx.controller¶	string	—	See note
images.ingressNginx.controllerChroot¶	string	—	See note
images.ingressNginx.defaultBackend¶	string	—	See note
images.ingressNginx.fileCopier¶	string	—	See note
images.kured¶	object	—	Kured stack image configuration: Kured stack image configuration
images.kured.image¶	string	—	See note
images.kyverno¶	object	—	kyverno stack image configuration: kyverno stack image configuration
images.kyverno.crdsMigration¶	string	—	See note
images.kyverno.init¶	string	—	See note
images.kyverno.main¶	string	—	See note
images.kyverno.webhooksCleanup¶	string	—	See note
images.monitoring¶	object	—	Monitoring stack image configuration: Monitoring stack image configuration
images.monitoring.admissionWebhooksPatch¶	string	—	See note
images.monitoring.alertmanager¶	string	—	See note
images.monitoring.blackboxExporter¶	string	—	See note
images.monitoring.configReloader¶	string	—	See note
images.monitoring.grafana¶	string	—	See note
images.monitoring.grafanaLabelEnforcer¶	string	—	See note
images.monitoring.grafanaSidecar¶	string	—	See note
images.monitoring.kubeStateMetrics¶	string	—	See note
images.monitoring.metricsServer¶	string	—	See note
images.monitoring.nodeExporter¶	string	—	See note
images.monitoring.prometheus¶	string	—	See note
images.monitoring.prometheusOperator¶	string	—	See note
images.monitoring.s3Exporter¶	string	—	See note
images.monitoring.trivyOperator¶	string	—	See note
images.nodeLocalDns¶	object	—	NodeLocal DNSCache stack image configuration: NodeLocal DNSCache stack image configuration
images.nodeLocalDns.image¶	string	—	See note
images.opensearch¶	object	—	opensearch stack image configuration: opensearch stack image configuration
images.opensearch.configurerJob¶	string	—	See note
images.opensearch.curatorCronjob¶	string	—	See note
images.opensearch.dashboards¶	string	—	See note
images.opensearch.exporter¶	string	—	See note
images.opensearch.image¶	string	—	See note
images.opensearch.initSysctl¶	string	—	See note
images.rclone¶	object	—	Rclone stack image configuration: Rclone stack image configuration
images.rclone.image¶	string	—	See note
images.tekton¶	object	—	Tekton stack image configuration: Tekton stack image configuration
images.tekton.controller¶	string	—	See note
images.tekton.remoteResolvers¶	string	—	See note
images.tekton.webhook¶	string	—	See note
images.thanos¶	object	—	Thanos stack image configuration: Thanos stack image configuration
images.thanos.image¶	string	—	See note
images.velero¶	object	—	Velero stack image configuration: Velero stack image configuration
images.velero.image¶	string	—	See note
images.velero.kubectl¶	string	—	See note
images.velero.pluginAws¶	string	—	See note
images.velero.pluginAzure¶	string	—	See note
images.velero.pluginGcp¶	string	—	See note

Notes for `images.calico.accountant`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.certManager.cainjector`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.certManager.controller`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.certManager.startupapicheck`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.certManager.webhook`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.crossplane.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.crossplane.kubectl`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.dex.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.externalDns.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.falco.driverLoaderInit`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.falco.falcoctl`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.falco.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.falco.sidekick`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.fluentd.aggregator`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.fluentd.forwarder`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.fluentd.logManager`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gatekeeper.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gatekeeper.kubectl`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gatekeeper.postInstallLabelNamespace`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gatekeeper.preInstallCRDs`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.global`

Global image settings: Global image registry and repository settings.

If a global registry is supplied and enabled, and an image is specified that doesn't have a registry, the global registry will be used instead.

If a global repository is supplied and enabled, and an image is specified that doesn't have a repository, the global repository will be used instead.

Notes for `images.global.registry.uri`

Global image registry URI

Examples:

registry.k8s.io

Notes for `images.global.repository.uri`

Global image repository

Examples:

ingress-nginx

Notes for `images.gpuOperator.nodeFeatureDiscovery`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gpuOperator.operator`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.backupJob`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.core`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.database`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.exporter`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.initJob`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.jobservice`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.mpuCleaner`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.portal`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.redis`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.registry`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.registryController`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.trivyAdapter`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.hnc.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.admissionWebhooksPatch`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.controller`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.controllerChroot`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.defaultBackend`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.fileCopier`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kured.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kyverno.crdsMigration`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kyverno.init`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kyverno.main`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kyverno.webhooksCleanup`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.admissionWebhooksPatch`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.alertmanager`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.blackboxExporter`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.configReloader`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.grafana`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.grafanaLabelEnforcer`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.grafanaSidecar`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.kubeStateMetrics`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.metricsServer`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.nodeExporter`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.prometheus`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.prometheusOperator`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.s3Exporter`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.trivyOperator`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.nodeLocalDns.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.configurerJob`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.curatorCronjob`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.dashboards`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.exporter`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.initSysctl`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.rclone.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.tekton.controller`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.tekton.remoteResolvers`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.tekton.webhook`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.thanos.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.image`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.kubectl`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.pluginAws`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.pluginAzure`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.pluginGcp`

URI for a container image

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

`ingressNginx`¶

Ingress-NGINX Controller Config: Configure Ingress-NGINX, the ingress controller.

Key	Type	Default	Title and Description
ingressNginx.controller¶	object	—	Ingress-NGINX Controller: Configure the controller daemonset of Ingress-NGINX.
ingressNginx.controller.additionalConfig¶	object	—	See note
ingressNginx.controller.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
ingressNginx.controller.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
ingressNginx.controller.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
ingressNginx.controller.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
ingressNginx.controller.allowSnippetAnnotations¶	boolean	—	See note
ingressNginx.controller.chroot¶	boolean	`True`	See note
ingressNginx.controller.config¶	object	—	Ingress-NGINX Config: Configure the Ingress-NGINX controller.
ingressNginx.controller.config.annotationsRiskLevel¶	string	`Critical`	See note
ingressNginx.controller.config.useProxyProtocol¶	boolean	—	Ingress-NGINX PROXY Protocol
ingressNginx.controller.enableAnnotationValidations¶	boolean	`True`	Ingress-NGINX Annotation Validation: When enabled annotations on Ingress resources are validated. This is disabled by default due to the maturity of the feature and lack of documentation.
ingressNginx.controller.enablepublishService¶	boolean	—	See note
ingressNginx.controller.extraArgs¶	object	—	Ingress NGINX Extra Args: Configure extra args to pass to Ingress NGINX Controller.
ingressNginx.controller.extraEnvs[]¶	array	—	Ingress NGINX Extra Environment Variables: Configure extra environment variables to Ingress NGINX Controller.
ingressNginx.controller.nodeSelector¶	object	—	See note
ingressNginx.controller.resources¶	object	—	See note
ingressNginx.controller.resources.limits¶	object	—	Kubernetes Quantity Map
ingressNginx.controller.resources.requests¶	object	—	Kubernetes Quantity Map
ingressNginx.controller.service¶	object	—	Ingress-NGINX Service: Configure the Service for traffic to Ingress-NGINX.
ingressNginx.controller.service.allocateLoadBalancerNodePorts¶	boolean	—	See note
ingressNginx.controller.service.annotations¶	object	—	Service Annotations
ingressNginx.controller.service.clusterIP¶	string	—	Service ClusterIP
ingressNginx.controller.service.enabled¶	boolean	—	Ingress-NGINX Service Enabled
ingressNginx.controller.service.internal¶	object	—	Ingress-NGINX Internal Service: Configure the Internal Service for traffic to Ingress-NGINX.
ingressNginx.controller.service.internal.allocateLoadBalancerNodePorts¶	boolean	—	See note
ingressNginx.controller.service.internal.annotations¶	object	—	Service Annotations
ingressNginx.controller.service.internal.clusterIP¶	string	—	Service ClusterIP
ingressNginx.controller.service.internal.enabled¶	boolean	—	Ingress-NGINX Service Enabled
ingressNginx.controller.service.internal.ipFamilyPolicy¶	string	`SingleStack`	See note
ingressNginx.controller.service.internal.loadBalancerIP¶	string	—	See note
ingressNginx.controller.service.internal.loadBalancerSourceRanges[]¶	array of string	—	Load Balancer Source Ranges: Configure the source ranges to allow via the Load Balancer Service.
ingressNginx.controller.service.internal.nodePorts¶	object	—	Node Ports: Configure the node ports to allocate for the Service.
ingressNginx.controller.service.internal.nodePorts.http¶	integer	—	—
ingressNginx.controller.service.internal.nodePorts.https¶	integer	—	—
ingressNginx.controller.service.internal.type¶	string	—	See note
ingressNginx.controller.service.ipFamilies[]¶	array of string	`['IPv4']`	See note
ingressNginx.controller.service.ipFamilyPolicy¶	string	`SingleStack`	See note
ingressNginx.controller.service.loadBalancerIP¶	string	—	See note
ingressNginx.controller.service.loadBalancerSourceRanges[]¶	array of string	—	Load Balancer Source Ranges: Configure the source ranges to allow via the Load Balancer Service.
ingressNginx.controller.service.nodePorts¶	object	—	Node Ports: Configure the node ports to allocate for the Service.
ingressNginx.controller.service.nodePorts.http¶	integer	—	—
ingressNginx.controller.service.nodePorts.https¶	integer	—	—
ingressNginx.controller.service.type¶	string	—	See note
ingressNginx.controller.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
ingressNginx.controller.useHostPort¶	boolean	—	See note
ingressNginx.defaultBackend¶	object	—	Ingress-NGINX Default Backend: Configure the default backend deployment of Ingress-NGINX.
ingressNginx.defaultBackend.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
ingressNginx.defaultBackend.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
ingressNginx.defaultBackend.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
ingressNginx.defaultBackend.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
ingressNginx.defaultBackend.nodeSelector¶	object	—	See note
ingressNginx.defaultBackend.resources¶	object	—	See note
ingressNginx.defaultBackend.resources.limits¶	object	—	Kubernetes Quantity Map
ingressNginx.defaultBackend.resources.requests¶	object	—	Kubernetes Quantity Map
ingressNginx.defaultBackend.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
ingressNginx.defaultBackend.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
ingressNginx.subDomain¶	string	—	Ingress-NGINX Subdomain

Notes for `ingressNginx.controller.additionalConfig`

Ingress-NGINX Additional Config: Configure additional configuration for Ingress-NGINX controller.

Note

See the upstream documentation for reference.

Notes for `ingressNginx.controller.allowSnippetAnnotations`

Ingress-NGINX Allow Snippet Annotations: When enabled annotations on Ingress resources can add snippets to the config of NGINX.

[!danger] Only enable this after evaluating the risks it poses.

Note

See the upstream documentation for reference.

Notes for `ingressNginx.controller.chroot`

Ingress-NGINX Controller Chroot: When enabled NGINX itself will run in a chroot under the controller namespace for increased separation between the controller and the proxy.

This requires a special seccomp profile to be available to give the controller the SYS_ADMIN capability, which will be provided by a separate daemon set.

Notes for `ingressNginx.controller.config.annotationsRiskLevel`

Ingress-NGINX Annotations Risk Level: Configure the accepted risk level of annotations on Ingress resources.

Note

See the upstream documentation for reference.

Possible values:

Critical

High

Medium

Low

Notes for `ingressNginx.controller.enablepublishService`

Ingress-NGINX Publish Service: When enabled it allows customisation of the IP or FQDN to report the external address of the Service in the Ingress status field.

When disabled it reports the IPs of the nodes where the controller pods are running.

Notes for `ingressNginx.controller.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `ingressNginx.controller.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `ingressNginx.controller.service.allocateLoadBalancerNodePorts`

Load Balancer Node Ports: When enabled node ports will be allocated for the Load Balancer Service.

This should be enabled when the cluster is fronted by a proxy load balancer regardless if it is external or internal, and disabled if the cluster uses direct routing of ingress traffic.

See reference

Notes for `ingressNginx.controller.service.internal.allocateLoadBalancerNodePorts`

Load Balancer Node Ports: When enabled node ports will be allocated for the Load Balancer Service.

This should be enabled when the cluster is fronted by a proxy load balancer regardless if it is external or internal, and disabled if the cluster uses direct routing of ingress traffic.

See reference

Notes for `ingressNginx.controller.service.internal.ipFamilyPolicy`

Service IP Family Policy: Represents the dual-stack-ness requested or required by this Service. When utilizing an internal loadbalancer service (ie MetalLB), set this field to "RequireDualStack" if you want both IPv4 and IPv6 connectivity. The ipFamilies and clusterIPs fields depend on the value of this field.

See reference

Possible values:

SingleStack

PreferDualStack

RequireDualStack

Notes for `ingressNginx.controller.service.internal.loadBalancerIP`

Load Balancer IP: Configure the Load Balancer IP to use an existing IP if supported by the infrastructure provider.

Important

With OpenStack Octavia the floating IP can be created via the CLI beforehand, and one should set the annotation loadbalancer.openstack.org/keep-floatingip: "true" to prevent the floating IP to be deleted.

Notes for `ingressNginx.controller.service.internal.type`

Service Type: Configure the type of the Service.

Possible values:

ClusterIP

LoadBalancer

NodePort

Notes for `ingressNginx.controller.service.ipFamilies[]`

Service IP Families: List of IP families (e.g. IPv4, IPv6) assigned to the service. Default is IPv4 only. When utilizing an internal loadbalancer service (ie MetalLB), IPv6 would also need to be included in order for the ingress service to allocate an address in that family.

Notes for `ingressNginx.controller.service.ipFamilyPolicy`

Service IP Family Policy: Represents the dual-stack-ness requested or required by this Service. When utilizing an internal loadbalancer service (ie MetalLB), set this field to "RequireDualStack" if you want both IPv4 and IPv6 connectivity. The ipFamilies and clusterIPs fields depend on the value of this field.

See reference

Possible values:

SingleStack

PreferDualStack

RequireDualStack

Notes for `ingressNginx.controller.service.loadBalancerIP`

Load Balancer IP: Configure the Load Balancer IP to use an existing IP if supported by the infrastructure provider.

Important

With OpenStack Octavia the floating IP can be created via the CLI beforehand, and one should set the annotation loadbalancer.openstack.org/keep-floatingip: "true" to prevent the floating IP to be deleted.

Notes for `ingressNginx.controller.service.type`

Service Type: Configure the type of the Service.

Possible values:

ClusterIP

LoadBalancer

NodePort

Notes for `ingressNginx.controller.useHostPort`

Ingress-NGINX Host Port: When enabled ingress traffic is directly forwarded from target ports on the nodes to reach Ingress-NGINX.

This requires the namespace to use Pod Security Standard privileged.

Notes for `ingressNginx.defaultBackend.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `ingressNginx.defaultBackend.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`issuers`¶

Issuers Config: Configure issuers for cert-manager.

Key	Type	Default	Title and Description
issuers.extraIssuers[]¶	array	—	Extra Issuers
issuers.letsencrypt¶	object	—	Issuers Let's Encrypt: Configure issuers for cert-manager using Let's Encrypt.
issuers.letsencrypt.enabled¶	boolean	`True`	Let's Encrypt Enabled
issuers.letsencrypt.prod¶	object	—	Let's Encrypt Prod: Configure Let's Encrypt production issuer.
issuers.letsencrypt.prod.solvers[]¶	array	—	Issuer Solver
issuers.letsencrypt.staging¶	object	—	Let's Encrypt Staging: Configure Let's Encrypt staging issuer.
issuers.letsencrypt.staging.solvers[]¶	array	—	Issuer Solver

`kubeStateMetrics`¶

Kube State Metrics: Configure the kube-state-metrics exporter.

Key	Type	Default	Title and Description
kubeStateMetrics.resources¶	object	—	See note
kubeStateMetrics.resources.limits¶	object	—	Kubernetes Quantity Map
kubeStateMetrics.resources.requests¶	object	—	Kubernetes Quantity Map

Notes for `kubeStateMetrics.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`kured`¶

Kured Config: Configuration for Kured (Kubernetes Reboot Daemon).

Kured orchestrates node reboots to allow nodes to automatically perform system updates and patches.

Key	Type	Default	Title and Description
kured.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
kured.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
kured.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
kured.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
kured.configuration¶	object	—	See note
kured.configuration.drainTimeout¶	string	—	See note
kured.configuration.endTime¶	string	`86399`	Kured Schedule End Time: Schedule reboots only before this time of day.
kured.configuration.lockReleaseDelay¶	string	—	See note
kured.configuration.period¶	string	—	See note
kured.configuration.rebootDays[]¶	array of string	`['mo', 'tu', 'we', 'th', 'fr', 'sa', 'su']`	Kured Schedule Reboot Days: Only reboot on these days.
kured.configuration.startTime¶	string	`0:00`	Kured Schedule Start Time: Schedule reboots only after this time of day.
kured.configuration.timeZone¶	string	`UTC`	Kured Schedule Time Zone
kured.dsAnnotations¶	object	—	—
kured.enabled¶	boolean	—	Kured Enabled
kured.extraArgs[]¶	array of string	—	Extra Arguments: Extra arguments passed to a container
kured.extraEnvVars¶	object	—	—
kured.metrics¶	object	—	Kured Metrics: Configuration for Kured metrics
kured.metrics.enabled¶	boolean	`True`	Kured Metrics Enabled
kured.metrics.interval¶	string	—	See note
kured.metrics.labels¶	object	—	Kured Metrics Labels
kured.nodeSelector¶	object	—	See note
kured.notification¶	object	—	Kured Notification: Send notification from Kured when nodes are rebooted.
kured.notification.slack¶	object	—	Kured Slack Notification: Send notification from Kured to Slack when nodes are rebooted.
kured.notification.slack.channel¶	string	—	Kured Slack Notification Channel
kured.notification.slack.enabled¶	boolean	—	Kured Slack Notification Enabled
kured.resources¶	object	—	See note
kured.resources.limits¶	object	—	Kubernetes Quantity Map
kured.resources.requests¶	object	—	Kubernetes Quantity Map
kured.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration

Notes for `kured.configuration`

Kured Config: Kured configuration parameters.

See the upstream documentation for reference. Most parameters are mapped from camelCase to --kebab-case, others can be set via extraArgs.

Notes for `kured.configuration.drainTimeout`

Duration String: A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `kured.configuration.lockReleaseDelay`

Duration String: A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `kured.configuration.period`

Duration String: A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `kured.metrics.interval`

Duration String: A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `kured.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `kured.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`kyverno`¶

Kyverno Config: Configure Kyverno and Kyverno Policies

Key	Type	Default	Title and Description
kyverno.enabled¶	boolean	—	Enable Kyverno
kyverno.nodeAffinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
kyverno.nodeAffinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
kyverno.nodeAffinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
kyverno.nodeAffinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
kyverno.nodeSelector¶	object	—	See note
kyverno.podAffinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
kyverno.podAffinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
kyverno.podAffinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
kyverno.podAffinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
kyverno.policies¶	object	—	Kyverno policies: Kyverno policies configuration
kyverno.policies.verifyImageSignature¶	object	—	Verify Image Signature Kyverno policy: A policy that requires that all images in HNC controlled namespaces are signed
kyverno.policies.verifyImageSignature.attestor¶	string	—	See note
kyverno.policies.verifyImageSignature.enabled¶	boolean	—	Enable the Verify Image Signature policy
kyverno.policies.verifyImageSignature.ignoreRekorTlog¶	boolean	—	Ignore Rekor transparency log when verifying image signatures
kyverno.policies.verifyImageSignature.type¶	string	—	See note
kyverno.resources¶	object	—	See note
kyverno.resources.limits¶	object	—	Kubernetes Quantity Map
kyverno.resources.requests¶	object	—	Kubernetes Quantity Map
kyverno.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
kyverno.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.

Notes for `kyverno.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `kyverno.policies.verifyImageSignature.attestor`

A public key (Cosign) or certificate (Notary) used to verify image signatures

Examples:

-----BEGIN PUBLIC KEY-----
MFkwEwY...
-----END PUBLIC KEY-----

-----BEGIN CERTIFICATE-----
MIIDTTCCA...
-----END CERTIFICATE-----

Notes for `kyverno.policies.verifyImageSignature.type`

Method of signature validation

Possible values:

Cosign

Notary

Notes for `kyverno.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`metricsServer`¶

Metrics Server: Configure the metrics-server exporter, used to provide for the metrics API in Kubernetes.

Key	Type	Default	Title and Description
metricsServer.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
metricsServer.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
metricsServer.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
metricsServer.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
metricsServer.enabled¶	boolean	`True`	Metrics Server Enabled
metricsServer.resources¶	object	—	See note
metricsServer.resources.limits¶	object	—	Kubernetes Quantity Map
metricsServer.resources.requests¶	object	—	Kubernetes Quantity Map
metricsServer.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration

Notes for `metricsServer.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`networkPlugin`¶

Network Plugin: Configure the network plugin used in the cluster.

Key	Type	Default	Title and Description
networkPlugin.calico¶	object	—	Calico network plugin: Configuration when network plugin is set to calico
networkPlugin.calico.calicoAccountant¶	object	—	Calico Accountant: Configure Calico accountant, used to collect metrics about packets affected by Network Policies when using Calico.
networkPlugin.calico.calicoAccountant.backend¶	string	`nftables`	See note
networkPlugin.calico.calicoAccountant.enabled¶	boolean	`True`	—
networkPlugin.calico.calicoAccountant.resources¶	object	—	See note
networkPlugin.calico.calicoAccountant.resources.limits¶	object	—	Kubernetes Quantity Map
networkPlugin.calico.calicoAccountant.resources.requests¶	object	—	Kubernetes Quantity Map
networkPlugin.calico.calicoAccountant.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
networkPlugin.calico.calicoFelixMetrics¶	object	—	Calico Felix Metrics: Configure Calico Felix metrics, used to collect metrics about Calico.
networkPlugin.calico.calicoFelixMetrics.enabled¶	boolean	`True`	Calico Felix Metrics Enabled
networkPlugin.type¶	string	—	See note

Notes for `networkPlugin.calico.calicoAccountant.backend`

Calico Accountant Backend

Possible values:

iptables

nftables

Notes for `networkPlugin.calico.calicoAccountant.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `networkPlugin.type`

Network plugin type: Configure the type of network plugin

Possible values:

calico

cilium

`networkPolicies`¶

Network Policies Config: Configure Network Policies.

Most common Network Policy rules can be updated by running ./bin/ck8s update-ips <both|sc|wc>.

Key	Type	Default	Title and Description
networkPolicies.additional¶	string	—	Network Policies Additional Policies: Configure additional network policies.
networkPolicies.additionalEgressPolicies[]¶	array	—	Network Policies Egress Policies
networkPolicies.additionalIngressPolicies[]¶	array	—	Network Policies Ingress Policies
networkPolicies.alertmanager¶	object	—	Network Policies Alertmanager: Configure Alertmanager network policy rules.
networkPolicies.alertmanager.alertReceivers¶	object	—	IP And Port List: Network policy rule Kubernetes network policies
networkPolicies.alertmanager.alertReceivers.enabled¶	boolean	—	—
networkPolicies.alertmanager.alertReceivers.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.alertmanager.alertReceivers.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.alertmanager.enabled¶	boolean	—	Network Policies Alertmanager Enabled
networkPolicies.allowedNameSpaces[]¶	array	—	Network Policies Allowed Namespaces
networkPolicies.certManager¶	object	—	Network Policies cert-manager: Configure cert-manager network policy rules.
networkPolicies.certManager.dns01¶	object	—	Network Policies cert-manager DNS-01: Configure network policy rule to allow cert-manager perform DNS-01 challenges.
networkPolicies.certManager.dns01.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.certManager.enabled¶	boolean	`True`	Network Policies cert-manager Enabled
networkPolicies.certManager.http01¶	object	—	Network Policies cert-manager HTTP-01: Configure network policy rule to allow cert-manager perform HTTP-01 challenges on other endpoints than the ingress-controller.
networkPolicies.certManager.http01.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.certManager.letsencrypt¶	object	—	See note
networkPolicies.certManager.namespaces[]¶	array of string	—	See note
networkPolicies.coredns¶	object	—	Network Policies CoreDNS: Configure CoreDNS network policy rules.
networkPolicies.coredns.enabled¶	boolean	`True`	Network Policies CoreDNS
networkPolicies.coredns.externalDns¶	object	—	Network Policies CoreDNS External DNS: Configure network policy rule to allow CoreDNS to query the upstream DNS servers.
networkPolicies.coredns.serviceIp¶	object	—	Network Policies CoreDNS Service IP: Configure network policy rule to allow CoreDNS to query the internal service IP.
networkPolicies.crossplane¶	object	—	Network Policies Crossplane: Configure Crossplane network policy rules.
networkPolicies.crossplane.enabled¶	boolean	`True`	Network Policies Crossplane Enabled
networkPolicies.crossplane.packageRegistry¶	object	—	Crossplane Package Registry: Configure network policy rules to allow Crossplane to access the Package registry
networkPolicies.crossplane.packageRegistry.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.defaultDeny¶	boolean	—	—
networkPolicies.dex¶	object	—	Network Policies Dex: Configure Dex network policy rules.
networkPolicies.dex.connectors¶	object	—	Network Policies Dex Connectors: Configure network policy rule to allow Dex to reach configured connectors.
networkPolicies.dex.connectors.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.dex.enabled¶	boolean	`True`	Network Policies Dex Enabled
networkPolicies.dnsAutoscaler¶	object	—	Network Policies DNS Autoscaler: Configure DNS Autoscaler network policy rules.
networkPolicies.dnsAutoscaler.enabled¶	boolean	`True`	Network Policies DNS Autoscaler Enabled
networkPolicies.enableAlerting¶	boolean	`True`	Network Policies Alerting Enabled
networkPolicies.enabled¶	boolean	`True`	Network Policies Enabled
networkPolicies.externalDns¶	object	—	Network Policies ExternalDNS: Configure ExternalDNS network policy rules.
networkPolicies.externalDns.enabled¶	boolean	—	—
networkPolicies.externalDns.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.falco¶	object	—	Network Policies Falco: Configure Falco network policy rules.
networkPolicies.falco.enabled¶	boolean	`True`	Network Policies Falco Enabled
networkPolicies.falco.plugins¶	object	—	Network Policies Falco Plugins: Configure network policy rules to allow Falco to install plugins during startup.
networkPolicies.falco.plugins.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.fluentd¶	object	—	Network Policies Fluentd: Configure Fluentd network policy rules.
networkPolicies.fluentd.enabled¶	boolean	`True`	Network Policies Fluentd Enabled
networkPolicies.fluentd.extraOutput¶	object	—	Extra Output Rule: Configure extra output egress rules. This may be used to allow application developers to send logs externally from user Fluentd with extra config and plugins.
networkPolicies.fluentd.extraOutput.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.fluentd.extraOutput.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.gatekeeper¶	object	—	Network Policies Gatekeeper: Configure Gatekeeper network policy rules.
networkPolicies.gatekeeper.enabled¶	boolean	`True`	Network Policies Gatekeeper Enabled
networkPolicies.global¶	object	—	Network Policies Global: Configure global network policy rules.
networkPolicies.global.externalLoadBalancer¶	boolean	—	Network Policies External Load Balancer: When enabled create Network Policy rules for ingress via external load balancer.
networkPolicies.global.ingressUsingHostNetwork¶	boolean	—	Network Policies Ingress Host Network: When enabled create Network Policy rules for ingress via host network.
networkPolicies.global.objectStorage¶	object	—	See note
networkPolicies.global.objectStorage.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.global.objectStorage.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.global.objectStorageSwift¶	object	—	See note
networkPolicies.global.objectStorageSwift.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.global.scApiserver¶	object	—	See note
networkPolicies.global.scApiserver.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.global.scApiserver.port¶	integer	—	—
networkPolicies.global.scIngress¶	object	—	See note
networkPolicies.global.scIngress.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.global.scNodes¶	object	—	See note
networkPolicies.global.scNodes.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.global.trivy¶	object	—	Network Policies Trivy: Configure Trivy network policy rules. Used for Trivy to fetch vulnerability databases both in Harbor and Trivy Operator.
networkPolicies.global.trivy.port¶	integer	—	—
networkPolicies.global.wcApiserver¶	object	—	See note
networkPolicies.global.wcApiserver.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.global.wcApiserver.port¶	integer	—	—
networkPolicies.global.wcIngress¶	object	—	See note
networkPolicies.global.wcIngress.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.global.wcNodes¶	object	—	See note
networkPolicies.global.wcNodes.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.harbor¶	object	—	Network Policies Harbor: Configure Harbor network policy rules.
networkPolicies.harbor.database¶	object	—	Network Policies Harbor Database: Configure network policies for the database used by Harbor.
networkPolicies.harbor.database.externalEgress¶	object	—	Network Policies Harbor Database External Egress: Configure network policy egress rules to the external database of Harbor.
networkPolicies.harbor.database.externalEgress.peers[]¶	array	—	Network Policy Peers
networkPolicies.harbor.database.externalEgress.ports[]¶	array	—	Network Policy Ports
networkPolicies.harbor.database.internalIngress¶	object	—	Network Policies Harbor Database Internal Ingress: Configure network policy ingress rules to the internal database of Harbor.
networkPolicies.harbor.database.internalIngress.peers[]¶	array	—	Network Policy Peers
networkPolicies.harbor.database.internalIngress.ports[]¶	array	—	Network Policy Ports
networkPolicies.harbor.enabled¶	boolean	`True`	Network Policies Harbor Enabled
networkPolicies.harbor.jobservice¶	object	—	Network Policies Harbor Job Service: Configure network policies for the job service in Harbor.
networkPolicies.harbor.jobservice.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.harbor.redis¶	object	—	Network Policies Harbor Redis: Configure network policies for the Redis used by Harbor.
networkPolicies.harbor.redis.externalEgress¶	object	—	Network Policies Harbor Redis External Egress: Configure network policy egress rules to the external Redis of Harbor.
networkPolicies.harbor.redis.externalEgress.peers[]¶	array	—	Network Policy Peers
networkPolicies.harbor.redis.externalEgress.ports[]¶	array	—	Network Policy Ports
networkPolicies.harbor.registries¶	object	—	Network Policies Harbor Registries: Configure network policies for external registries used by Harbor. Applies to harbor-core and harbor-jobservice when replication is enabled.
networkPolicies.harbor.registries.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.harbor.trivy¶	object	—	Network Policies Harbor Trivy: Configure network policies for the Trivy scanner in Harbor.
networkPolicies.harbor.trivy.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.ingressNginx¶	object	—	Network Policies Ingress NGINX: Configure Ingress NGINX network policy rules.
networkPolicies.ingressNginx.enabled¶	boolean	`True`	Network Policies Ingress NGINX Enabled
networkPolicies.ingressNginx.ingressOverride¶	object	—	Network Policies Ingress Override: Configure override to the ingress rules for Ingress NGINX. Required when cluster ingress uses direct routing.
networkPolicies.ingressNginx.ingressOverride.enabled¶	boolean	—	Network Policies Ingress Override Enabled
networkPolicies.kubeSystem¶	object	—	Network Policies Kube System: Configure kube-system network policy rules.
networkPolicies.kubeSystem.enabled¶	boolean	`True`	Network Policies Kube System Enabled
networkPolicies.kubeSystem.openstack¶	object	—	Network Policies OpenStack: Configure OpenStack network policy rules.
networkPolicies.kubeSystem.openstack.enabled¶	boolean	—	Network Policies OpenStack Enabled
networkPolicies.kubeSystem.openstack.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.kubeSystem.openstack.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.kubeSystem.upcloud¶	object	—	Network Policies UpCloud: Configure UpCloud network policy rules.
networkPolicies.kubeSystem.upcloud.enabled¶	boolean	—	Network Policies UpCloud Enabled
networkPolicies.kubeSystem.upcloud.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.kubeSystem.upcloud.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.kured¶	object	—	Network Policies Kured: Configure Kured network policy rules.
networkPolicies.kured.enabled¶	boolean	`True`	Network Policies Kured Enabled
networkPolicies.kured.notificationSlack¶	object	—	Network Policies Kured Notifications Slack: Configure network policy rules to allow Kured to send Slack notifications.
networkPolicies.kured.notificationSlack.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.kyverno¶	object	—	Network Policies Kyverno: Configure Kyverno network policy rules.
networkPolicies.kyverno.enabled¶	boolean	`True`	Network Policies Kyverno Enabled
networkPolicies.kyverno.imageRegistry¶	object	—	Network Policies Kyverno Image Registry: Configure network policy that allows Kyverno to access image registries. This is required for signed image verification.
networkPolicies.monitoring¶	object	—	Network Policies Monitoring: Configure monitoring network policy rules.
networkPolicies.monitoring.enabled¶	boolean	`True`	Network Policies Monitoring Enabled
networkPolicies.monitoring.grafana¶	object	—	Network Policies Grafana: Configure Grafana network policy rules.
networkPolicies.monitoring.grafana.externalDashboardProvider¶	object	—	Grafana External Dashboards: Configure network policy rules to allow Grafana to use external dashboards.
networkPolicies.monitoring.grafana.externalDashboardProvider.ips[]¶	array of string	—	List Of IP Netmasks: List of IP netmasks A IP address with netmask
networkPolicies.monitoring.grafana.externalDashboardProvider.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.monitoring.grafana.externalDataSources¶	object	—	Grafana External Datasources: Configure network policy rules to allow Grafana to use external datasources.
networkPolicies.monitoring.grafana.externalDataSources.enabled¶	boolean	—	Grafana External Datasources Enabled
networkPolicies.opensearch¶	object	—	Network Policies OpenSearch: Configure OpenSearch network policy rules.
networkPolicies.opensearch.enabled¶	boolean	`True`	Network Policies OpenSearch Enabled
networkPolicies.opensearch.plugins¶	object	—	Network Policies OpenSearch Plugins: Configure network policy rules to allow OpenSearch to install plugins during startup.
networkPolicies.opensearch.plugins.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.prometheus¶	object	—	Network Policies Prometheus: Configure Prometheus network policy rules.
networkPolicies.prometheus.internalAccess¶	object	—	See note
networkPolicies.prometheus.internalAccess.enabled¶	boolean	—	Prometheus Internal Access Enabled
networkPolicies.prometheus.internalAccess.namespaces[]¶	array of string	—	Prometheus Internal Access Namespaces: Configure the namespaces to allow internal access to Prometheus.
networkPolicies.rclone¶	object	—	Network Policies Rclone: Configure Rclone network policy rules.
networkPolicies.rclone.enabled¶	boolean	—	Network Policies Rclone Enabled
networkPolicies.rclone.sync¶	object	—	Network Policies Rclone Sync: Configure network policy rules to allow rclone to sync.
networkPolicies.rclone.sync.objectStorage¶	object	—	Network Policies Rclone Sync Object Storage: Configure network policy rules to allow rclone to sync object storage.
networkPolicies.rclone.sync.objectStorage.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.rclone.sync.objectStorageSwift¶	object	—	Network Policies Rclone Sync Object Storage: Configure network policy rules to allow rclone to sync object storage with Swift.
networkPolicies.rclone.sync.objectStorageSwift.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.rclone.sync.secondaryUrl¶	object	—	Network Policies Rclone Sync Object Storage: Configure network policy rules to allow rclone to sync with a secondary URL.
networkPolicies.rclone.sync.secondaryUrl.ports[]¶	array of integer	—	Port Number List: A 16 bit unsigned integer
networkPolicies.rookCeph¶	object	—	Network Policies Rook Ceph: Configure Rook Ceph network policy rules.
networkPolicies.rookCeph.enabled¶	boolean	—	Network Policies Rook Ceph Enabled
networkPolicies.s3Exporter¶	object	—	Network Policies S3 Exporter: Configure S3 exporter network policy rules.
networkPolicies.s3Exporter.enabled¶	boolean	`True`	Network Policies S3 Exporter Enabled
networkPolicies.tektonPipelines¶	object	—	Network Policies Tekton Pipeline: Enable network policies for tekton and the pipeline.
networkPolicies.tektonPipelines.enabled¶	boolean	`True`	Network Policies Tekton Enabled
networkPolicies.tektonPipelines.pipeline¶	object	—	See note
networkPolicies.thanos¶	object	—	Network Policies Thanos: Configure Thanos network policy rules.
networkPolicies.thanos.enabled¶	boolean	`True`	Network Policies Thanos Enabled
networkPolicies.velero¶	object	—	Network Policies Velero: Configure Velero network policy rules.
networkPolicies.velero.enabled¶	boolean	`True`	Network Policies Velero Enabled

Notes for `networkPolicies.certManager.letsencrypt`

Network Policies cert-manager Let's Encrypt: Configure network policy rule to allow cert-manager to reach Let's Encrypt.

Note

Let's Encrypt by choice does not publish a list of their endpoints, so this is required to be ips: [ 0.0.0.0/0 ].

Notes for `networkPolicies.certManager.namespaces[]`

Network Policies cert-manager namespaces: Configure namespaces to allow cert-manager HTTP-01 perform HTTP-01 challenges.

Examples:

['dex', 'harbor', 'monitoring', 'opensearch-system', 'thanos']

Notes for `networkPolicies.global.objectStorage`

Network Policies ObjectStorage: Configure object storage network policy rules.

This configuration should match the object storage service configured under objectStorage.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.objectStorageSwift`

Network Policies ObjectStorage Swift: Configure OpenStack Swift object storage network policy rules.

This configuration should match the object storage service configured under objectStorage.swift if used by any component.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.scApiserver`

Network Policies SC API Server: Configure service cluster API server network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.scIngress`

Network Policies SC Ingress: Configure service cluster ingress network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.scNodes`

Network Policies SC Nodes: Configure service cluster nodes network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.wcApiserver`

Network Policies WC API Server: Configure workload cluster API server network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.wcIngress`

Network Policies WC Ingress: Configure workload cluster ingress network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.wcNodes`

Network Policies WC Nodes: Configure workload cluster nodes network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.prometheus.internalAccess`

Network Policies Prometheus Internal Access: Configure network policy rules to allow internal access to Prometheus.

This requires the allowed namespaces to be configured under namespaces and the allowed pods to be labeled elastisys.io/prometheus-access: allowed.

Notes for `networkPolicies.tektonPipelines.pipeline`

Network Policies Tekton Pipeline: Add required networkpolicies for the pipeline under the section pipeline.

The networkpolicies should follow the network policies generator. As such, it is possible to use pre-defined network policies rules. The pre-defined rules can be found here.

  pipeline:
    clone-config-pod:
      podSelectorLabels:
        tekton.dev/pipeline: upgrade-pipeline
      ingress: {}
      egress:
        - rule: egress-rule-dns # pre-defined network policies rule.
        - name: egress-rule-config-access
          peers:
            - cidr: 1.2.3.4/32
          ports:
            - tcp: 22

`nodeLocalDns`¶

Node Local DNS: Configure node-local-dns, node local DNS resolving and caching.

Key	Type	Default	Title and Description
nodeLocalDns.customConfig¶	string	—	See note
nodeLocalDns.hostZone¶	object	—	Host zone for node-local-dns: Configure the host zone for node-local-dns
nodeLocalDns.hostZone.extraConfig¶	string	—	See note
nodeLocalDns.resources¶	object	—	See note
nodeLocalDns.resources.limits¶	object	—	Kubernetes Quantity Map
nodeLocalDns.resources.requests¶	object	—	Kubernetes Quantity Map

Notes for `nodeLocalDns.customConfig`

Custom Config: Configure custom options for the CoreDNS instance running as part of node-local-dns.

Note

See the upstream documentation for reference.

Examples:

example.com:53 {
  errors
  cache 30
  reload
  loop
  forward . 127.0.0.1:9005
}

Notes for `nodeLocalDns.hostZone.extraConfig`

Extra config for host zone: Configure extra config for the host zone .53 for node-local-dns.

Note

See the upstream documentation for reference.

Examples:

template ANY ANY {
  rcode NXDOMAIN
}

Notes for `nodeLocalDns.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`objectStorage`¶

Object Storage Config: Configuration options for using object storage in Welkin

This is used for:

Fluentd audit logs
Fluentd service cluster logs
Harbor database backups and registry storage
OpenSearch workload cluster log snapshots
Rclone object storage sync source and restore destination
Thanos metrics storage
Velero resource backups and volume snapshots

Harbor, Rclone, and Thanos have additional configuration to use Swift.

Key	Type	Default	Title and Description
objectStorage.azure¶	object	—	Azure Backend Config: Only supports Azure Public Cloud.
objectStorage.azure.resourceGroup¶	string	—	Azure Resource Group: Resource group of the storage account.
objectStorage.azure.storageAccountName¶	string	—	Azure Storage Account Name: Name of the storage account
objectStorage.buckets¶	object	—	See note
objectStorage.restore¶	object	—	See note
objectStorage.restore.addTargetsFromSync¶	boolean	—	Rclone Restore Targets From Sync: Automatically configure the restore from a secondary site to the primary site. Essentially this will configure Rclone restore to do the inverse of Rclone sync.
objectStorage.restore.decrypt¶	object	—	Rclone Crypt: Encrypt data when syncing and decrypt data when restoring.
objectStorage.restore.decrypt.directoryNames¶	boolean	—	Rclone Crypt Crypt Directory Names: Encrypt directory names when syncing, requires file names to be encrypted.
objectStorage.restore.decrypt.enabled¶	boolean	—	Rclone Crypt Enable
objectStorage.restore.decrypt.fileNames¶	boolean	—	Rclone Crypt Crypt File Names: Encrypt file names when syncing.
objectStorage.restore.destinations¶	object	—	Rclone Restore Destinations: Allows for complete or partial overrides of the destinations of the restore, the main object storage configuration.
objectStorage.restore.destinations.azure¶	object	—	Azure Backend Config: Only supports Azure Public Cloud.
objectStorage.restore.destinations.azure.resourceGroup¶	string	—	Azure Resource Group: Resource group of the storage account.
objectStorage.restore.destinations.azure.storageAccountName¶	string	—	Azure Storage Account Name: Name of the storage account
objectStorage.restore.destinations.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
objectStorage.restore.destinations.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
objectStorage.restore.destinations.s3.region¶	string	—	S3 Region: Region to store data.
objectStorage.restore.destinations.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
objectStorage.restore.destinations.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
objectStorage.restore.destinations.swift¶	object	—	Swift Backend Config: > [!note] > Supported as an option only for Harbor, Rclone, and Thanos.
objectStorage.restore.destinations.swift.authUrl¶	string	—	OpenStack Authentication URL: OpenStack authentication URL. Make sure to prepend the protocol (e.g. `https://`) and append the authentication version (e.g. `/v3`).
objectStorage.restore.destinations.swift.authVersion¶	integer	—	OpenStack Authentication Version: OpenStack authentication version. Set `0` for auto detect from authentication url.
objectStorage.restore.destinations.swift.domainId¶	string	—	OpenStack Domain ID: The user domain ID to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.restore.destinations.swift.domainName¶	string	—	OpenStack Domain Name: The user domain name to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.restore.destinations.swift.projectDomainId¶	string	—	OpenStack Project Domain ID: The project domain ID to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.restore.destinations.swift.projectDomainName¶	string	—	OpenStack Project Domain Name: The project domain name to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.restore.destinations.swift.projectId¶	string	—	OpenStack Project ID: The project ID to use. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.restore.destinations.swift.projectName¶	string	—	OpenStack Project Name: The project name to use, requires project domain to be set. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.restore.destinations.swift.region¶	string	—	OpenStack Region: OpenStack region.
objectStorage.restore.destinations.swift.segmentsContainerSuffix¶	string	`+segments`	Swift Segments Container Suffix: The container suffix to use for segment containers. These are created to store large objects with SLOs/DLOs, and with s3api middleware for multipart uploads.
objectStorage.restore.dryrun¶	boolean	—	Rclone Restore Dryrun: Deploy Rclone with dryrun enabled.
objectStorage.restore.enabled¶	boolean	—	Rclone Restore Enable
objectStorage.restore.sources¶	object	—	Rclone Restore Sources: Allows for complete or partial overrides of the sources of the restore, the sync object storage configuration.
objectStorage.restore.sources.azure¶	object	—	Azure Backend Config: Only supports Azure Public Cloud.
objectStorage.restore.sources.azure.resourceGroup¶	string	—	Azure Resource Group: Resource group of the storage account.
objectStorage.restore.sources.azure.storageAccountName¶	string	—	Azure Storage Account Name: Name of the storage account
objectStorage.restore.sources.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
objectStorage.restore.sources.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
objectStorage.restore.sources.s3.region¶	string	—	S3 Region: Region to store data.
objectStorage.restore.sources.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
objectStorage.restore.sources.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
objectStorage.restore.sources.swift¶	object	—	Swift Backend Config: > [!note] > Supported as an option only for Harbor, Rclone, and Thanos.
objectStorage.restore.sources.swift.authUrl¶	string	—	OpenStack Authentication URL: OpenStack authentication URL. Make sure to prepend the protocol (e.g. `https://`) and append the authentication version (e.g. `/v3`).
objectStorage.restore.sources.swift.authVersion¶	integer	—	OpenStack Authentication Version: OpenStack authentication version. Set `0` for auto detect from authentication url.
objectStorage.restore.sources.swift.domainId¶	string	—	OpenStack Domain ID: The user domain ID to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.restore.sources.swift.domainName¶	string	—	OpenStack Domain Name: The user domain name to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.restore.sources.swift.projectDomainId¶	string	—	OpenStack Project Domain ID: The project domain ID to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.restore.sources.swift.projectDomainName¶	string	—	OpenStack Project Domain Name: The project domain name to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.restore.sources.swift.projectId¶	string	—	OpenStack Project ID: The project ID to use. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.restore.sources.swift.projectName¶	string	—	OpenStack Project Name: The project name to use, requires project domain to be set. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.restore.sources.swift.region¶	string	—	OpenStack Region: OpenStack region.
objectStorage.restore.sources.swift.segmentsContainerSuffix¶	string	`+segments`	Swift Segments Container Suffix: The container suffix to use for segment containers. These are created to store large objects with SLOs/DLOs, and with s3api middleware for multipart uploads.
objectStorage.restore.targets[]¶	array of object	—	Rclone Restore Targets: Targets to restore Details of a bucket to restore.
objectStorage.restore.timestamp¶	string	—	Rclone Restore Timestamp: Perform point-in-time restore if possible. This is only supported for S3 sources.
objectStorage.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
objectStorage.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
objectStorage.s3.region¶	string	—	S3 Region: Region to store data.
objectStorage.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
objectStorage.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
objectStorage.swift¶	object	—	Swift Backend Config: > [!note] > Supported as an option only for Harbor, Rclone, and Thanos.
objectStorage.swift.authUrl¶	string	—	OpenStack Authentication URL: OpenStack authentication URL. Make sure to prepend the protocol (e.g. `https://`) and append the authentication version (e.g. `/v3`).
objectStorage.swift.authVersion¶	integer	—	OpenStack Authentication Version: OpenStack authentication version. Set `0` for auto detect from authentication url.
objectStorage.swift.domainId¶	string	—	OpenStack Domain ID: The user domain ID to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.swift.domainName¶	string	—	OpenStack Domain Name: The user domain name to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.swift.projectDomainId¶	string	—	OpenStack Project Domain ID: The project domain ID to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.swift.projectDomainName¶	string	—	OpenStack Project Domain Name: The project domain name to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.swift.projectId¶	string	—	OpenStack Project ID: The project ID to use. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.swift.projectName¶	string	—	OpenStack Project Name: The project name to use, requires project domain to be set. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.swift.region¶	string	—	OpenStack Region: OpenStack region.
objectStorage.swift.segmentsContainerSuffix¶	string	`+segments`	Swift Segments Container Suffix: The container suffix to use for segment containers. These are created to store large objects with SLOs/DLOs, and with s3api middleware for multipart uploads.
objectStorage.sync¶	object	—	Rclone Sync Config: Sync object storage from the primary site to a secondary site with Rclone.
objectStorage.sync.activeDeadlineSeconds¶	number	`14400`	Rclone Cronjob Active Deadline Seconds: The maximum amount of time that the Rclone job is allowed to run (in seconds).
objectStorage.sync.azure¶	object	—	Azure Backend Config: Only supports Azure Public Cloud.
objectStorage.sync.azure.resourceGroup¶	string	—	Azure Resource Group: Resource group of the storage account.
objectStorage.sync.azure.storageAccountName¶	string	—	Azure Storage Account Name: Name of the storage account
objectStorage.sync.buckets[]¶	array of object	—	Rclone Sync Buckets: Additional buckets to sync. List of buckets to sync when `syncDefaultBuckets` is false
objectStorage.sync.defaultSchedule¶	string	—	—
objectStorage.sync.destinationType¶	string	—	See note
objectStorage.sync.dryrun¶	boolean	—	Rclone Sync Dryrun: Deploy Rclone with dryrun enabled.
objectStorage.sync.enabled¶	boolean	—	Rclone Sync Enable
objectStorage.sync.encrypt¶	object	—	Rclone Crypt: Encrypt data when syncing and decrypt data when restoring.
objectStorage.sync.encrypt.directoryNames¶	boolean	—	Rclone Crypt Crypt Directory Names: Encrypt directory names when syncing, requires file names to be encrypted.
objectStorage.sync.encrypt.enabled¶	boolean	—	Rclone Crypt Enable
objectStorage.sync.encrypt.fileNames¶	boolean	—	Rclone Crypt Crypt File Names: Encrypt file names when syncing.
objectStorage.sync.resources¶	object	—	See note
objectStorage.sync.resources.limits¶	object	—	Kubernetes Quantity Map
objectStorage.sync.resources.requests¶	object	—	Kubernetes Quantity Map
objectStorage.sync.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
objectStorage.sync.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
objectStorage.sync.s3.region¶	string	—	S3 Region: Region to store data.
objectStorage.sync.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
objectStorage.sync.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
objectStorage.sync.secondaryUrl¶	string	—	Rclone Sync Secondary URL
objectStorage.sync.sourceType¶	string	—	See note
objectStorage.sync.swift¶	object	—	Swift Backend Config: > [!note] > Supported as an option only for Harbor, Rclone, and Thanos.
objectStorage.sync.swift.authUrl¶	string	—	OpenStack Authentication URL: OpenStack authentication URL. Make sure to prepend the protocol (e.g. `https://`) and append the authentication version (e.g. `/v3`).
objectStorage.sync.swift.authVersion¶	integer	—	OpenStack Authentication Version: OpenStack authentication version. Set `0` for auto detect from authentication url.
objectStorage.sync.swift.domainId¶	string	—	OpenStack Domain ID: The user domain ID to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.sync.swift.domainName¶	string	—	OpenStack Domain Name: The user domain name to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.sync.swift.projectDomainId¶	string	—	OpenStack Project Domain ID: The project domain ID to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.sync.swift.projectDomainName¶	string	—	OpenStack Project Domain Name: The project domain name to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.sync.swift.projectId¶	string	—	OpenStack Project ID: The project ID to use. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.sync.swift.projectName¶	string	—	OpenStack Project Name: The project name to use, requires project domain to be set. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.sync.swift.region¶	string	—	OpenStack Region: OpenStack region.
objectStorage.sync.swift.segmentsContainerSuffix¶	string	`+segments`	Swift Segments Container Suffix: The container suffix to use for segment containers. These are created to store large objects with SLOs/DLOs, and with s3api middleware for multipart uploads.
objectStorage.sync.syncDefaultBuckets¶	boolean	—	Rclone Sync Default Buckets: Sync the buckets or containers set under `.objectStorage.buckets`.
objectStorage.type¶	string	—	See note

Notes for `objectStorage.buckets`

Object Storage Buckets: Buckets or containers for each respective application to use for application data or backup storage.

Keys are used as identifiers for buckets or containers, while the values are used as the bucket or container name.

Additional entries added here will have monitoring enabled.

Notes for `objectStorage.restore`

Rclone Restore Config: Restore object storage from a secondary site to the primary site with Rclone.

Note

When enabled this will disable Rclone sync to prevent it from modifying the secondary site.

Notes for `objectStorage.sync.destinationType`

Rclone Sync Destination Type: Object storage type to use.

Possible values:

azure

gcs

s3

swift

Notes for `objectStorage.sync.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `objectStorage.sync.sourceType`

Rclone Sync Source Type: Object storage type to use. Defaults to .objectStorage.type

Examples:

azure

gcs

s3

swift

Notes for `objectStorage.type`

Object Storage Type: Object storage type to use.

In addition to this Harbor, Rclone, and Thanos have additional configuration to use Swift.

Possible values:

azure

gcs

s3

none

Welkin contains multiple safeguards to make it easy to follow security best practices.

`opa`¶

Open Policy Agent Config: Configure Open Policy Agent, constraints and mutations enforced by Gatekeeper.

This includes an implementation of constraints and mutations with similar behaviour as Pod Security Policies, and application developer centric safeguards.

Key	Type	Default	Title and Description
opa.audit¶	object	—	OPA Gatekeeper Audit: Configure the Audit deployment of OPA Gatekeeper.
opa.audit.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
opa.audit.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opa.audit.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opa.audit.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opa.audit.nodeSelector¶	object	—	See note
opa.audit.resources¶	object	—	See note
opa.audit.resources.limits¶	object	—	Kubernetes Quantity Map
opa.audit.resources.requests¶	object	—	Kubernetes Quantity Map
opa.audit.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
opa.audit.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
opa.audit.writeToRAMDisk¶	boolean	—	OPA Gatekeeper Audit Write To RAM Disk
opa.auditChunkSize¶	number	`500`	Gatekeeper Audit Chunk Size
opa.auditFromCache¶	boolean	—	Gatekeeper Audit From Cache
opa.auditIntervalSeconds¶	number	`600`	Gatekeeper Audit Interval
opa.constraintViolationsLimit¶	number	`20`	Gatekeeper Audit Constraints Violation Limits
opa.controllerManager¶	object	—	Common Resource: This is meant to describe the base class if you will, for Welkin resources.
opa.controllerManager.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
opa.controllerManager.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opa.controllerManager.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opa.controllerManager.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opa.controllerManager.enabled¶	boolean	—	—
opa.controllerManager.extraArgs[]¶	array of string	—	Extra Arguments: Extra arguments passed to a container
opa.controllerManager.nodeSelector¶	object	—	See note
opa.controllerManager.resources¶	object	—	See note
opa.controllerManager.resources.limits¶	object	—	Kubernetes Quantity Map
opa.controllerManager.resources.requests¶	object	—	Kubernetes Quantity Map
opa.controllerManager.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
opa.controllerManager.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
opa.disallowedTags¶	object	—	See note
opa.disallowedTags.enabled¶	boolean	`True`	Safeguard Disallowed Tags Enabled
opa.disallowedTags.enforcement¶	string	`deny`	See note
opa.disallowedTags.tags[]¶	array of string	—	Safeguard Disallowed Tags: Configure the tags that should be disallowed by the constraint.
opa.imageRegistry¶	object	—	See note
opa.imageRegistry.URL[]¶	array of string	—	See note
opa.imageRegistry.enabled¶	boolean	`True`	Safeguard Trusted Registries Enabled
opa.imageRegistry.enforcement¶	string	`warn`	See note
opa.minimumDeploymentReplicas¶	object	—	See note
opa.minimumDeploymentReplicas.enabled¶	boolean	`True`	Safeguard Minimum Replicas Enabled
opa.minimumDeploymentReplicas.enforcement¶	string	`warn`	See note
opa.mutatingWebhookTimeoutSeconds¶	number	`5`	—
opa.mutations¶	object	—	Mutations: Configure mutations to set defaults in deployed resources.
opa.mutations.enabled¶	boolean	`True`	Mutations Enabled
opa.mutations.jobTTL¶	object	—	See note
opa.mutations.jobTTL.enabled¶	boolean	`True`	Mutation Job TTL Enabled
opa.mutations.jobTTL.ttlSeconds¶	number	`604800`	Mutation Job TTL Seconds
opa.mutations.ndots¶	object	—	Mutation Ndots: Configure mutations to set ndots on deployed Pods.
opa.mutations.ndots.enabled¶	boolean	—	Mutation Ndots Enabled
opa.mutations.ndots.labelSelector¶	object	—	Mutation Ndots Label Selector: Configure the label selector for pods to be targeted by this mutation.
opa.mutations.ndots.labelSelector.matchLabels¶	object	—	Mutation Ndots Match Labels: Configure the label selector for pods to be targeted by this mutation. Default `{}` targets all Pods.
opa.mutations.ndots.ndotAmount¶	integer	`3`	Mutation Ndots Amount
opa.networkPolicies¶	object	—	See note
opa.networkPolicies.enabled¶	boolean	`True`	Safeguard Network Policies Enabled
opa.networkPolicies.enforcement¶	string	`warn`	See note
opa.preventAccidentalDeletion¶	object	—	Safeguard Prevent Accidental Deletion: Configure constraint to reject deletion of sensitive resources.
opa.preventAccidentalDeletion.enabled¶	boolean	—	Safeguard Prevent Accidental Deletion
opa.preventAccidentalDeletion.enforcement¶	string	`deny`	See note
opa.rejectLoadBalancerService¶	object	—	See note
opa.rejectLoadBalancerService.enabled¶	boolean	—	Safeguard Reject Load Balancer Service Enabled
opa.rejectLoadBalancerService.enforcement¶	string	`deny`	See note
opa.rejectLocalStorageEmptyDir¶	object	—	See note
opa.rejectLocalStorageEmptyDir.enabled¶	boolean	—	Safeguard Rejecting Local Storage EmptyDir Enabled
opa.rejectLocalStorageEmptyDir.enforcement¶	string	`warn`	See note
opa.rejectPodWithoutController¶	object	—	See note
opa.rejectPodWithoutController.enabled¶	boolean	—	Safeguard Reject Pod Without Controller Enabled
opa.rejectPodWithoutController.enforcement¶	string	`warn`	See note
opa.resourceRequests¶	object	—	See note
opa.resourceRequests.enabled¶	boolean	`True`	Safeguard Resource Requests Enabled
opa.resourceRequests.enforcement¶	string	`deny`	See note
opa.restrictPodDisruptionBudgets¶	object	—	See note
opa.restrictPodDisruptionBudgets.enabled¶	boolean	`True`	Safeguard Restrict PodDisruptionBudget Enabled
opa.restrictPodDisruptionBudgets.enforcement¶	string	`deny`	See note
opa.validatingWebhookTimeoutSeconds¶	number	`5`	—

Notes for `opa.audit.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opa.audit.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opa.controllerManager.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opa.controllerManager.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opa.disallowedTags`

Safeguard Disallowed Tags: Configure constraint to disallow configured tags on container images.

Note

See the dev docs for context.

Notes for `opa.disallowedTags.enforcement`

Safeguard Disallowed Tags Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.imageRegistry`

Safeguard Trusted Registries: Configure constraint to only allow configured registries for container images.

Note

See the dev docs for context.

Notes for `opa.imageRegistry.URL[]`

Safeguard Trusted Registries URLs: Configure the registries that should be trusted by the constraint.

Note

To support issuing certificates with HTTP-01 challenges the registry quay.io/jetstack/cert-manager-acmesolver must be added.

Notes for `opa.imageRegistry.enforcement`

Safeguard Trusted Registries Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.minimumDeploymentReplicas`

Safeguard Minimum Replicas: Configure constraint to only allow Deployments and StatefulSets with more than one replica.

Note

See the dev docs for context.

Notes for `opa.minimumDeploymentReplicas.enforcement`

Safeguard Minimum Replicas Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.mutations.jobTTL`

Mutation Job TTL: Configure mutations to set time to live on deployed Jobs.

Note

See the dev docs for context.

Notes for `opa.networkPolicies`

Safeguard Network Policies: Configure constraint to only allow Pods targeted by NetworkPolicies.

Note

See the dev docs for context.

Notes for `opa.networkPolicies.enforcement`

Safeguard Network Policies Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.preventAccidentalDeletion.enforcement`

Safeguard Prevent Accidental Deletion Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.rejectLoadBalancerService`

Safeguard Reject Load Balancer Service: Configure constraint to reject creation of Services with the type LoadBalancer.

Advantageous if the cluster cannot automatically provision LoadBalancers, e.g. because the infrastructure provider do not offer such Kubernetes integration.

Note

See the dev docs for context.

Notes for `opa.rejectLoadBalancerService.enforcement`

Safeguard Reject Load Balancer Service Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.rejectLocalStorageEmptyDir`

Safeguard Reject Local Storage EmptyDir: Configure constraint to reject usage of local storage emptydir.

Note

See the dev docs for context.

Notes for `opa.rejectLocalStorageEmptyDir.enforcement`

Safeguard Reject Local Storage EmptyDir Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.rejectPodWithoutController`

Safeguard Reject Pod Without Controller: Configure constraint to reject pods without a controller.

Note

See the dev docs for context.

Notes for `opa.rejectPodWithoutController.enforcement`

Safeguard Reject Pod Without Controller Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.resourceRequests`

Safeguard Resource Requests: Configure constraint to only allow Pods configured with resource requests.

Note

See the dev docs for context.

Notes for `opa.resourceRequests.enforcement`

Safeguard Resource Requests Enforcement

Possible values:

deny

warn

dryrun

Notes for `opa.restrictPodDisruptionBudgets`

Safeguard Restrict PodDisruptionBudget: Configure constraint to reject PodDisruptionBudgets and connected Pod controllers if the PDB does not allow for at least 1 pod disruption.

Note

See the dev docs for context.

Notes for `opa.restrictPodDisruptionBudgets.enforcement`

Safeguard Restrict PodDisruptionBudget Enforcement

Possible values:

deny

warn

dryrun

`opensearch`¶

OpenSearch Config: Configuration for OpenSearch.

OpenSearch ingests logs sent from Fluentd in the workload cluster, and presents them in OpenSearch Dashboards.

Note

OpenSearch and its components are installed in the service cluster, so this configuration mainly applies there.

Key	Type	Default	Title and Description
opensearch.additionalTemplates¶	object	—	See note
opensearch.clientNode¶	object	—	OpenSearch Client Node: Configures the client stateful set of OpenSearch that takes on the roll to ingest and query logs.
opensearch.clientNode.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
opensearch.clientNode.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.clientNode.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.clientNode.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.clientNode.count¶	number	`1`	OpenSearch Client Node Replicas
opensearch.clientNode.dedicatedPods¶	boolean	`True`	OpenSearch Client Node Enabled: When disabled the master nodes will take on these rolls.
opensearch.clientNode.javaOpts¶	string	`-Xms512m -Xmx512m`	See note
opensearch.clientNode.nodeSelector¶	object	—	See note
opensearch.clientNode.resources¶	object	—	See note
opensearch.clientNode.resources.limits¶	object	—	Kubernetes Quantity Map
opensearch.clientNode.resources.requests¶	object	—	Kubernetes Quantity Map
opensearch.clientNode.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
opensearch.clusterName¶	string	`opensearch`	OpenSearch Cluster Name
opensearch.createIndices¶	boolean	`True`	See note
opensearch.curator¶	object	—	OpenSearch Curator: Configures the CronJob that removes indices.
opensearch.curator.activeDeadlineSeconds¶	number	`2700`	OpenSearch Curator Active Deadline Seconds
opensearch.curator.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
opensearch.curator.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.curator.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.curator.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.curator.enabled¶	boolean	`True`	OpenSearch Curator Enabled
opensearch.curator.nodeSelector¶	object	—	See note
opensearch.curator.resources¶	object	—	See note
opensearch.curator.resources.limits¶	object	—	Kubernetes Quantity Map
opensearch.curator.resources.requests¶	object	—	Kubernetes Quantity Map
opensearch.curator.retention[]¶	array of object	`[{'pattern': 'authlog-', 'ageDays': 30, 'sizeGB': 1}, {'pattern': 'kubeaudit-', 'ageDays': 30, 'sizeGB': 50}, {'pattern': 'kubernetes-', 'ageDays': 30, 'sizeGB': 50}, {'pattern': 'other-', 'ageDays': 7, 'sizeGB': 1}, {'pattern': 'security-auditlog-*', 'ageDays': 7, 'sizeGB': 1}]`	OpenSearch Curator Retention: Configures the retention of indices in OpenSearch. Configures the retention of indices in OpenSearch.
opensearch.curator.startingDeadlineSeconds¶	number	`600`	OpenSearch Curator Starting Deadline Seconds
opensearch.curator.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
opensearch.dashboards¶	object	—	OpenSearch Dashboards: Configures the Dashboards deployment of OpenSearch providing the UI to view and query logs.
opensearch.dashboards.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
opensearch.dashboards.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.dashboards.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.dashboards.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.dashboards.autocompleteTerminateAfter¶	number	—	Autocomplete setting for number of documents to query in Dashboards
opensearch.dashboards.contentSecurityPolicy¶	object	—	Content-Security-Policy rules: Configure Content-Security-Policy header rules Reference: https://content-security-policy.com/
opensearch.dashboards.cookieTtl¶	integer	—	OpenSearch Dashboards Cookie TTL: Time-to-live for the session cookie in milliseconds. Overrides OpenSearch Dashboards internal default if set.
opensearch.dashboards.nodeSelector¶	object	—	See note
opensearch.dashboards.resources¶	object	—	See note
opensearch.dashboards.resources.limits¶	object	—	Kubernetes Quantity Map
opensearch.dashboards.resources.requests¶	object	—	Kubernetes Quantity Map
opensearch.dashboards.sessionKeepalive¶	boolean	—	OpenSearch Dashboards Session Keepalive: Whether the session TTL should be extended upon user activity. Overrides OpenSearch Dashboards internal default if set.
opensearch.dashboards.sessionTtl¶	integer	—	OpenSearch Dashboards Session TTL: Time-to-live for the session itself in milliseconds. Overrides OpenSearch Dashboards internal default if set.
opensearch.dashboards.subdomain¶	string	`opensearch`	See note
opensearch.dashboards.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
opensearch.dashboards.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
opensearch.dataNode¶	object	—	OpenSearch Data Node: Configures the data stateful set of OpenSearch that takes on the roll to index and store logs.
opensearch.dataNode.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
opensearch.dataNode.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.dataNode.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.dataNode.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.dataNode.count¶	number	`2`	OpenSearch Data Node Replicas
opensearch.dataNode.dedicatedPods¶	boolean	`True`	OpenSearch Data Node Enabled: When disabled the master nodes will take on these rolls.
opensearch.dataNode.javaOpts¶	string	`-Xms512m -Xmx512m`	See note
opensearch.dataNode.nodeSelector¶	object	—	See note
opensearch.dataNode.resources¶	object	—	See note
opensearch.dataNode.resources.limits¶	object	—	Kubernetes Quantity Map
opensearch.dataNode.resources.requests¶	object	—	Kubernetes Quantity Map
opensearch.dataNode.storageClass¶	-string- -null-	—	See note
opensearch.dataNode.storageSize¶	string	—	OpenSearch Node Storage Size: Configure the requested size of the persistent volume for this OpenSerch node.
opensearch.dataNode.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
opensearch.defaultTemplates¶	boolean	`True`	See note
opensearch.enabled¶	boolean	`True`	OpenSearch Enabled: > [!note] > Must be set for both service and workload cluster.
opensearch.exporter¶	object	—	OpenSearch Exporter: Configures the exporter exposing metrics from OpenSearch.
opensearch.exporter.resources¶	object	—	See note
opensearch.exporter.resources.limits¶	object	—	Kubernetes Quantity Map
opensearch.exporter.resources.requests¶	object	—	Kubernetes Quantity Map
opensearch.exporter.serviceMonitor¶	object	—	OpenSearch Exporter Service Monitor: Configures the service monitor of the exporter.
opensearch.exporter.serviceMonitor.interval¶	string	`30s`	Scrape interval for the service monitor.
opensearch.exporter.serviceMonitor.scrapeTimeout¶	string	—	—
opensearch.exporter.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
opensearch.extraRoleMappings[]¶	array of object	—	See note
opensearch.extraRoles[]¶	array of object	—	See note
opensearch.indexPerNamespace¶	boolean	—	See note
opensearch.ingress¶	object	—	OpenSearch Ingress: Configures the ingress for OpenSearch master or client nodes.
opensearch.ingress.maxbodysize¶	string	`32m`	OpenSearch Ingress Max Body
opensearch.ism¶	object	—	OpenSearch Index State Management: Configures index state management in OpenSearch.
opensearch.ism.additionalPolicies¶	object	—	See note
opensearch.ism.authlog¶	object	—	OpenSearch Rollover Configuration for `authlog` index: Configures rollover for `authlog` index
opensearch.ism.authlog.rolloverAgeDays¶	number	`1`	OpenSearch Rollover Age Days: Configures the age a write index must reach before it is rolled over to a new one.
opensearch.ism.authlog.rolloverSizeMB¶	number	`1000`	OpenSearch Rollover Size MB: Configures the size a write index must reach before it is rolled over to a new one.
opensearch.ism.defaultPolicies¶	boolean	`True`	See note
opensearch.ism.kubeaudit¶	object	—	OpenSearch Rollover Configuration for `kubeaudit` index: Configures rollover for `kubeaudit` index
opensearch.ism.kubeaudit.rolloverAgeDays¶	number	`1`	OpenSearch Rollover Age Days: Configures the age a write index must reach before it is rolled over to a new one.
opensearch.ism.kubeaudit.rolloverSizeMB¶	number	`1000`	OpenSearch Rollover Size MB: Configures the size a write index must reach before it is rolled over to a new one.
opensearch.ism.kubernetes¶	object	—	OpenSearch Rollover Configuration for `kubernetes` index: Configures rollover for `kubernetes` index
opensearch.ism.kubernetes.rolloverAgeDays¶	number	`1`	OpenSearch Rollover Age Days: Configures the age a write index must reach before it is rolled over to a new one.
opensearch.ism.kubernetes.rolloverSizeMB¶	number	`1000`	OpenSearch Rollover Size MB: Configures the size a write index must reach before it is rolled over to a new one.
opensearch.ism.other¶	object	—	OpenSearch Rollover Configuration for `other` index: Configures rollover for `other` index
opensearch.ism.other.rolloverAgeDays¶	number	`1`	OpenSearch Rollover Age Days: Configures the age a write index must reach before it is rolled over to a new one.
opensearch.ism.other.rolloverSizeMB¶	number	`1000`	OpenSearch Rollover Size MB: Configures the size a write index must reach before it is rolled over to a new one.
opensearch.ism.overwritePolicies¶	boolean	`True`	OpenSearch Overwrite Policies: When set OpenSearch can be configured with index state management policies via `additionalPolicies` that overwrite the ones configured via `defaultPolicies`.
opensearch.masterNode¶	object	—	OpenSearch Master Node: Configures the main stateful set of OpenSearch that takes on all roles not provided by other nodes (`dataNode`, `clientNode`).
opensearch.masterNode.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
opensearch.masterNode.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.masterNode.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.masterNode.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.masterNode.count¶	number	`1`	OpenSearch Master Node Replicas
opensearch.masterNode.javaOpts¶	string	`-Xms512m -Xmx512m`	See note
opensearch.masterNode.nodeSelector¶	object	—	See note
opensearch.masterNode.resources¶	object	—	See note
opensearch.masterNode.resources.limits¶	object	—	Kubernetes Quantity Map
opensearch.masterNode.resources.requests¶	object	—	Kubernetes Quantity Map
opensearch.masterNode.storageClass¶	-string- -null-	—	See note
opensearch.masterNode.storageSize¶	string	—	OpenSearch Node Storage Size: Configure the requested size of the persistent volume for this OpenSerch node.
opensearch.masterNode.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
opensearch.maxClauseCount¶	number	`1024`	OpenSearch Maximum Clause Count: Configures the maximum number of clauses permitted in a query.
opensearch.maxShardsPerNode¶	number	`1000`	OpenSearch Maximum Shards Per Node: Configures the maximum number of shards permitted on one node.
opensearch.objectStorage¶	object	—	Object Storage Configuration.: Configuration options for using object storage specific to OpenSearch.
opensearch.objectStorage.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
opensearch.objectStorage.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
opensearch.objectStorage.s3.region¶	string	—	S3 Region: Region to store data.
opensearch.objectStorage.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
opensearch.objectStorage.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
opensearch.overwriteTemplates¶	boolean	`True`	OpenSearch Overwrite Templates: When set OpenSearch can be configured with index templates via `additionalTemplates` that overwrite the ones configured via `defaultTemplates`.
opensearch.plugins¶	object	—	OpenSearch Plugins: Configures plugins used in OpenSearch.
opensearch.plugins.additionalPlugins[]¶	array	—	OpenSearch Install Additional Plugins: Configures OpenSearch to install plugins when it starts. In an air-gapped environment this can be used to install plugins from known sources.
opensearch.plugins.installExternalObjectStoragePlugin¶	boolean	—	See note
opensearch.promIndexAlerts[]¶	array of object	`[{'prefix': 'authlog-default', 'alertSizeMB': 3}, {'prefix': 'kubeaudit-default', 'alertSizeMB': 5500}, {'prefix': 'kubernetes-default', 'alertSizeMB': 5500}, {'prefix': 'other-default', 'alertSizeMB': 400}]`	OpenSearch Prometheus Index Alerts: Configures the index alerts monitoring the function of index state management. Configures the index alert monitoring the function of index state management.
opensearch.securityadmin¶	object	—	OpenSearch Security Admin: Configures the Job that initialises OpenSearch Security.
opensearch.securityadmin.activeDeadlineSeconds¶	number	`1200`	OpenSearch Security Admin Active Deadline Seconds
opensearch.securityadmin.enabled¶	boolean	`True`	OpenSearch Security Admin Enabled
opensearch.securityadmin.resources¶	object	—	See note
opensearch.securityadmin.resources.limits¶	object	—	Kubernetes Quantity Map
opensearch.securityadmin.resources.requests¶	object	—	Kubernetes Quantity Map
opensearch.snapshot¶	object	—	See note
opensearch.snapshot.backupSchedule¶	string	—	—
opensearch.snapshot.enabled¶	boolean	`True`	OpenSearch Snapshot Enabled
opensearch.snapshot.max¶	number	`14`	OpenSearch Maximum Retained Snapshots
opensearch.snapshot.min¶	number	`7`	OpenSearch Minimum Retained Snapshots
opensearch.snapshot.repository¶	string	`opensearch-snapshots`	OpenSearch Snapshot Repository
opensearch.snapshot.retentionAge¶	string	`10d`	OpenSearch Maximum Snapshot Age
opensearch.snapshot.retentionSchedule¶	string	—	—
opensearch.sso¶	object	—	OpenSearch Single Sign On: Configures Single Sign On to OpenSearch via Dex.
opensearch.sso.enabled¶	boolean	—	OpenSearch Single Sign On
opensearch.sso.rolesKey¶	string	`groups`	OpenSearch Single Sign On Roles Key
opensearch.sso.scope¶	string	`openid profile email groups`	OpenSearch Single Sign On Scopes
opensearch.sso.subjectKey¶	string	`email`	OpenSearch Single Sign On Subject Key
opensearch.subdomain¶	string	`opensearch`	See note

Notes for `opensearch.additionalTemplates`

OpenSearch Additional Templates: When set OpenSearch will be configured with additional index templates.

The keys will be used as the name of the index templates.

Note

See the upstream documentation for reference.

Notes for `opensearch.clientNode.javaOpts`

OpenSearch Node Java Options: Set Java Virtual Machine Options to control the memory allocation of OpenSearch.

As a rule of thumb the minimum allocation -Xms and maximum allocation -Xmx arguments should be the same to be more predictable. Additionally until memory allocation is at 2 GiB and more it is recommended that the memory limit set in Kubernetes is twice the allocation as OpenSearch uses this for cache.

Notes for `opensearch.clientNode.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.clientNode.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.createIndices`

OpenSearch Create Indices: When enabled OpenSearch will be configured with initial indices for:

authlog
kubeaudit
kubernetes
other

Notes for `opensearch.curator.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.curator.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.dashboards.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.dashboards.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.dashboards.subdomain`

OpenSearch Dashboards Subdomain: Subdomain of baseDomain that the Ingress to OpenSearch Dashboards will be created with.

Note

Must be set for both service and workload cluster.

Notes for `opensearch.dataNode.javaOpts`

OpenSearch Node Java Options: Set Java Virtual Machine Options to control the memory allocation of OpenSearch.

As a rule of thumb the minimum allocation -Xms and maximum allocation -Xmx arguments should be the same to be more predictable. Additionally until memory allocation is at 2 GiB and more it is recommended that the memory limit set in Kubernetes is twice the allocation as OpenSearch uses this for cache.

Notes for `opensearch.dataNode.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.dataNode.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.dataNode.storageClass`

OpenSearch Node Storage Class: Set storage class for OpenSearch.

If set to null, the default storage class will be used to provision the volumes.
If set to -, no storage class will be used to provision the volumes.

Notes for `opensearch.defaultTemplates`

OpenSearch Default Templates: When enabled OpenSearch will be configured with the default index templates for:

authlog
kubeaudit
kubernetes
other

Notes for `opensearch.exporter.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.extraRoleMappings[]`

OpenSearch Extra Role Mappings: Configures extra role mappings for OpenSearch Security.

Extra users can be configured in secrets.yaml under extraUsers and extra roles under extraRoles.

Configures a role mapping for OpenSearch Security.

Note

See the upstream documentation for reference.

Notes for `opensearch.extraRoles[]`

OpenSearch Extra Roles: Configures extra roles for OpenSearch Security.

Configures a role for OpenSearch Security.

Note

See the upstream documentation for reference.

Notes for `opensearch.indexPerNamespace`

OpenSearch Index Per Namespace: When enabled logs are ingested into multiple indices per namespace. When disabled logs are ingested into a single kubernetes index.

Important

When enabling this feature, you must also add an entry to opensearch.curator.retention in sc-config.yaml with pattern: ^[^.].* which matches all non-system indices.

Note

Must be set for both service and workload cluster.

Notes for `opensearch.ism.additionalPolicies`

OpenSearch Additional Policies: When set OpenSearch will be configured with additional index state management policies.

The keys will be used as the name of the index state management policy.

Note

See the upstream documentation for reference.

Notes for `opensearch.ism.defaultPolicies`

OpenSearch Default Policies: When enabled OpenSearch will be configured with the default index state management policies for:

authlog
kubeaudit
kubernetes
other

Notes for `opensearch.masterNode.javaOpts`

OpenSearch Node Java Options: Set Java Virtual Machine Options to control the memory allocation of OpenSearch.

As a rule of thumb the minimum allocation -Xms and maximum allocation -Xmx arguments should be the same to be more predictable. Additionally until memory allocation is at 2 GiB and more it is recommended that the memory limit set in Kubernetes is twice the allocation as OpenSearch uses this for cache.

Notes for `opensearch.masterNode.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.masterNode.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.masterNode.storageClass`

OpenSearch Node Storage Class: Set storage class for OpenSearch.

If set to null, the default storage class will be used to provision the volumes.
If set to -, no storage class will be used to provision the volumes.

Notes for `opensearch.plugins.installExternalObjectStoragePlugin`

OpenSearch Install External Object Storage Plugin: When enabled OpenSearch will install the required object storage plugin when it starts.

In an air-gapped environment where the nodes are not connected to the Internet, set this to false to prevent downloading any external object storage plugins.

Notes for `opensearch.securityadmin.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.snapshot`

OpenSearch Snapshot: Configure OpenSearch snapshot creation and retention.

This requires that objectStorage is configured, and will use the bucket or container set in objectStorage.buckets.opensearch.

Notes for `opensearch.subdomain`

OpenSearch Subdomain: Subdomain of opsDomain that the Ingress to OpenSearch will be created with.

Note

Must be set for both service and workload cluster.

`openstackMonitoring`¶

Openstack Monitoring: Configure the collection of metrics for OpenStack components.

Key	Type	Default	Title and Description
openstackMonitoring.enabled¶	boolean	—	Openstack Monitoring Enabled

`prometheus`¶

Prometheus Config: Configure Prometheus.

Prometheus automatically collects metrics via ServiceMonitors, PodMonitors, and Probes, and pushes metrics to Thanos for long term storage. Additionally Prometheus evaluates recording rules for both service and workload cluster, and all alerting rules for the workload cluster.

Note

Prometheus is installed in both service cluster and workload cluster, so this configuration applies there with some exceptions.

Key	Type	Default	Title and Description
prometheus.additionalScrapeConfigs[]¶	array	—	See note
prometheus.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
prometheus.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
prometheus.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
prometheus.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
prometheus.alertmanagerSpec¶	object	—	See note
prometheus.alertmanagerSpec.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
prometheus.alertmanagerSpec.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
prometheus.alertmanagerSpec.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
prometheus.alertmanagerSpec.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
prometheus.alertmanagerSpec.groupBy[]¶	array of string	—	See note
prometheus.alertmanagerSpec.replicas¶	number	`2`	Alertmanager Replicas
prometheus.alertmanagerSpec.resources¶	object	—	See note
prometheus.alertmanagerSpec.resources.limits¶	object	—	Kubernetes Quantity Map
prometheus.alertmanagerSpec.resources.requests¶	object	—	Kubernetes Quantity Map
prometheus.alertmanagerSpec.storage¶	object	—	Alertmanager Storage: Configure persistent storage for Alertmanager.
prometheus.alertmanagerSpec.storage.volumeClaimTemplate¶	object	—	Alertmanager Volume Claim Template: Configure persistent storage for Alertmanager.
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec¶	object	—	Alertmanager Volume Claim Spec: Configure persistent storage for Alertmanager.
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.accessModes[]¶	array of string	—	Alertmanager Volume Access Mode: Configure the access mode of the persistent storage for Alertmanager.
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.resources¶	object	—	See note
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.resources.limits¶	object	—	Kubernetes Quantity Map
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.resources.requests¶	object	—	Kubernetes Quantity Map
prometheus.alertmanagerSpec.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
prometheus.alertmanagerSpec.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
prometheus.autoscaledNodeGroupAlerts¶	object	—	Autoscaled NodeGroup Alerts: Configure whether to split KubeletDownForXm alerts into autoscaled and non-autoscaled nodes groups.
prometheus.autoscaledNodeGroupAlerts.enabled¶	boolean	`True`	Enabled aleter splitting for autoscaled nodes.
prometheus.autoscaledNodeGroupAlerts.groupLabel¶	string	`node-restriction.kubernetes.io/autoscaled-node-type`	Autoscaled node group label: The label to identity whether a node belongs to an autoscaled node group.
prometheus.autoscaledNodeGroupAlerts.groupLabelValues[]¶	array of string	—	Autoscaled node group label values: The label values to a autoscaled node group if their are multiple autoscaled node groups.
prometheus.capacityManagementAlerts¶	object	—	Capacity Management Alerts: Configure capacity management alerts.
prometheus.capacityManagementAlerts.disklimit¶	number	`75`	Capacity Management Alerts Disk Limit: Alert when a disk's usage reaches the limit in percent.
prometheus.capacityManagementAlerts.enabled¶	boolean	`True`	Capacity Management Alerts Enabled
prometheus.capacityManagementAlerts.nodeGroupRequestsExcludePattern¶	string	—	See note
prometheus.capacityManagementAlerts.persistentVolume¶	object	—	Capacity Management Alerts Persistent Volumes: Configure capacity management alerts on persistent volumes.
prometheus.capacityManagementAlerts.persistentVolume.enabled¶	boolean	`True`	Capacity Management Alerts Persistent Volumes Enabled
prometheus.capacityManagementAlerts.persistentVolume.limit¶	number	`75`	Capacity Management Alerts Persistent Volumes Enabled: Alert when a persistent volume's usage reaches the limit in percent.
prometheus.capacityManagementAlerts.predictUsage¶	boolean	—	Capacity Management Alerts Predict Usage
prometheus.capacityManagementAlerts.requestLimit¶	object	—	Capacity Management Alerts Request Limit: Alert when a node's resource requests reaches the limits in percent.
prometheus.capacityManagementAlerts.requestLimit.cpu¶	number	`80`	Capacity Management Alerts CPU Request Limit: Configure a CPU request percentage limit to alert for.
prometheus.capacityManagementAlerts.requestLimit.memory¶	number	`80`	Capacity Management Alerts Memory Request Limit: Configure a memory request percentage limit to alert for.
prometheus.capacityManagementAlerts.usagelimit¶	number	`95`	—
prometheus.devAlertmanager¶	object	—	See note
prometheus.devAlertmanager.enabled¶	boolean	—	Enable user Alertmanager: Allows to enable alertmanager for application developer.
prometheus.devAlertmanager.ingressEnabled¶	boolean	—	Enable User Alertmanager ingress: Allows to have ingress for application developer alertmanager with basic auth
prometheus.devAlertmanager.namespace¶	string	`alertmanager`	Enable alertmanager in separate Namespace: Allows to have alertmanager running in custom namespace
prometheus.devAlertmanager.username¶	string	—	Username for Alertmanager login
prometheus.diskAlerts¶	object	—	Disk Alerts: Configure disk alerts.
prometheus.diskAlerts.inode¶	object	—	Disk Alerts Inode: Configure disk alerts based on inode usage.
prometheus.diskAlerts.inode.predictLinear[]¶	array of object	—	See note
prometheus.diskAlerts.inode.space[]¶	array of object	—	See note
prometheus.diskAlerts.perf¶	object	—	Disk Alerts Perf: Configure performance disk alerts.
prometheus.diskAlerts.perf.enabled¶	boolean	—	Disk Alerts Perf Enabled
prometheus.diskAlerts.perf.queueSizeThreshold¶	number	`5`	Disk Alerts Perf Queue Size
prometheus.diskAlerts.perf.readWaitTimeThreshold¶	number	`1`	Disk Alerts Perf Read Wait
prometheus.diskAlerts.perf.writeWaitTimeThreshold¶	number	`1`	Disk Alerts Perf Write Wait
prometheus.diskAlerts.storage¶	object	—	Disk Alerts Storage: Configure disk alerts based on storage usage.
prometheus.diskAlerts.storage.predictLinear[]¶	array of object	—	See note
prometheus.diskAlerts.storage.space[]¶	array of object	—	See note
prometheus.nodeSelector¶	object	—	See note
prometheus.replicas¶	number	`1`	Prometheus Relicas
prometheus.resources¶	object	—	See note
prometheus.resources.limits¶	object	—	Kubernetes Quantity Map
prometheus.resources.requests¶	object	—	Kubernetes Quantity Map
prometheus.retention¶	object	—	Prometheus Retention: Configure retention for Prometheus.
prometheus.retention.age¶	string	`3d`	Prometheus Retention Age: Configure the time range Prometheus will retain metrics for.
prometheus.retention.alertmanager¶	string	—	See note
prometheus.retention.size¶	string	`4GiB`	Prometheus Retention Size: Configure the total size Prometheus will retain metrics for.
prometheus.s3BucketAlerts¶	object	—	S3 Bucket Alerts: Configure S3 bucket alerts.
prometheus.s3BucketAlerts.buckets[]¶	array of object	—	S3 Bucket Specific Alerts: Definitions for specific S3 bucket alerts. S3 Bucket Alert configuration for specific bucket
prometheus.s3BucketAlerts.exclude[]¶	array of string	—	S3 Bucket Alerts Exclude: Exclude buckets from S3 alerts.
prometheus.s3BucketAlerts.objects¶	object	—	S3 Bucket Alerts Objects: Alert when an S3 buckets reaches the set percentage of the set number of objects.
prometheus.s3BucketAlerts.objects.count¶	number	`1638400`	S3 Bucket Alerts Objects Quota
prometheus.s3BucketAlerts.objects.enabled¶	boolean	—	S3 Bucket Alerts Objects Enabled
prometheus.s3BucketAlerts.objects.percent¶	number	—	Percentage: Percentage, 0% - 100%
prometheus.s3BucketAlerts.size¶	object	—	S3 Bucket Alerts Size: Alert when an S3 bucket reaches the set percentage of the set size.
prometheus.s3BucketAlerts.size.enabled¶	boolean	—	S3 Bucket Alerts Size Enabled
prometheus.s3BucketAlerts.size.percent¶	number	—	Percentage: Percentage, 0% - 100%
prometheus.s3BucketAlerts.size.sizeQuotaGB¶	number	`1000`	S3 Bucket Alerts Size Quota
prometheus.s3BucketAlerts.totalSize¶	object	—	S3 Bucket Alerts Total Size: Alert when all S3 buckets reaches the set percentage of the set size.
prometheus.s3BucketAlerts.totalSize.enabled¶	boolean	—	S3 Bucket Alerts Total Size Enabled
prometheus.s3BucketAlerts.totalSize.percent¶	number	—	Percentage: Percentage, 0% - 100%
prometheus.s3BucketAlerts.totalSize.sizeQuotaGB¶	number	`1000`	S3 Bucket Alerts Total Size Quota
prometheus.storage¶	object	—	Prometheus Storage: Configure the persistent volume claim used for Promtheus storage.
prometheus.storage.enabled¶	boolean	—	See note
prometheus.storage.size¶	string	`5Gi`	Proemtheus Storage Size
prometheus.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
prometheus.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
prometheus.webhookAlerts¶	object	—	Webhook Alerts: Configure webhook alerts.
prometheus.webhookAlerts.enabled¶	boolean	`True`	Webhook Alerts Enabled

Notes for `prometheus.additionalScrapeConfigs[]`

Prometheus Additional Scrape Configs: Configure additional scrape configs for Prometheus.

Note

See the upstream documentation for reference.

Notes for `prometheus.alertmanagerSpec`

Alertmanager Config: Configure service cluster & workload cluster Alertmanager.

Alertmanager receives alerts from Prometheus and Thanos and forwards them to the configured notification channel.

Note

Alertmanager is installed in both service cluster and workload cluster, however this configuration key only applies to the service cluster, use user.alertmanager to configure it in the workload cluster.

Notes for `prometheus.alertmanagerSpec.groupBy[]`

Alertmanager Group By: Configure Alertmanager to group certain alerts based on labels.

Note

See the upstream documentation for reference.

Notes for `prometheus.alertmanagerSpec.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `prometheus.capacityManagementAlerts.nodeGroupRequestsExcludePattern`

Capacity Management Alerts Request Exclude Pattern: Configure a pattern of node groups to exclude from the resource request alerts. This can be used to exclude certain node groups from request alerts, while still getting usage alerts for those node groups.

Examples:

.*redis.*|.*postgres.*

Notes for `prometheus.devAlertmanager`

Application Developer Alertmanager: Configuration options for deploying an application developer-specific Alertmanager. Configuration shared with the service cluster alertmanager can be configured via .alertmanagerSpec.

Notes for `prometheus.diskAlerts.inode.predictLinear[]`

Disk Alert Pattern Rules: Configure disk alerts when disk usage is predicted to reach the limit.

Configure disk alerts when disk usage is predicted to reach the limit.

The hours key is only supported when configured under predictLinear.

Notes for `prometheus.diskAlerts.inode.space[]`

Disk Alert Pattern Rules: Configure disk alerts when disk usage is predicted to reach the limit.

Configure disk alerts when disk usage is predicted to reach the limit.

The hours key is only supported when configured under predictLinear.

Notes for `prometheus.diskAlerts.storage.predictLinear[]`

Disk Alert Pattern Rules: Configure disk alerts when disk usage is predicted to reach the limit.

Configure disk alerts when disk usage is predicted to reach the limit.

The hours key is only supported when configured under predictLinear.

Notes for `prometheus.diskAlerts.storage.space[]`

Disk Alert Pattern Rules: Configure disk alerts when disk usage is predicted to reach the limit.

Configure disk alerts when disk usage is predicted to reach the limit.

The hours key is only supported when configured under predictLinear.

Notes for `prometheus.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `prometheus.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `prometheus.retention.alertmanager`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `prometheus.storage.enabled`

Proemtheus Storage Enabled: By default Prometheus instances run without storage and are treated as ephemeral. See ADR-0007 for context.

`prometheusBlackboxExporter`¶

Prometheus Blackbox Exporter: Configure Prometheus Blackbox Exporter, the exporter used for probing endpoints.

Key	Type	Default	Title and Description
prometheusBlackboxExporter.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
prometheusBlackboxExporter.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
prometheusBlackboxExporter.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
prometheusBlackboxExporter.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
prometheusBlackboxExporter.customKubeapiTargets[]¶	array of object	—	Prometheus Blackbox Exporter Custom Kube API Targets: Configure custom Kube API targets Prometheus Blackbox Exporter should probe. Custom Kube API target Prometheus Blackbox Exporter should probe.
prometheusBlackboxExporter.hostAliases[]¶	array of object	—	Host Aliases: Configure host aliases to resolve internally within the Pod. Configure a host alias to resolve internally within the Pod.
prometheusBlackboxExporter.resources¶	object	—	See note
prometheusBlackboxExporter.resources.limits¶	object	—	Kubernetes Quantity Map
prometheusBlackboxExporter.resources.requests¶	object	—	Kubernetes Quantity Map
prometheusBlackboxExporter.targets¶	object	—	Prometheus Blackbox Exporter Targets: Configure the targets Prometheus Blackbox Exporter should probe.
prometheusBlackboxExporter.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration

Notes for `prometheusBlackboxExporter.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`prometheusNodeExporter`¶

Prometheus Node Exporter: Configure Prometheus Node Exporter, the exporter used for collecting node metrics.

Key	Type	Default	Title and Description
prometheusNodeExporter.resources¶	object	—	See note
prometheusNodeExporter.resources.limits¶	object	—	Kubernetes Quantity Map
prometheusNodeExporter.resources.requests¶	object	—	Kubernetes Quantity Map
prometheusNodeExporter.scrapeTimeout¶	string	—	—

Notes for `prometheusNodeExporter.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`prometheusOperator`¶

Prometheus Operator: Configure Prometheus Operator.

Key	Type	Default	Title and Description
prometheusOperator.prometheusConfigReloader¶	object	—	Prometheus Operator Config Reloader: Configure Prometheus Operator config reloader.
prometheusOperator.prometheusConfigReloader.resources¶	object	—	See note
prometheusOperator.prometheusConfigReloader.resources.limits¶	object	—	Kubernetes Quantity Map
prometheusOperator.prometheusConfigReloader.resources.requests¶	object	—	Kubernetes Quantity Map
prometheusOperator.resources¶	object	—	See note
prometheusOperator.resources.limits¶	object	—	Kubernetes Quantity Map
prometheusOperator.resources.requests¶	object	—	Kubernetes Quantity Map

Notes for `prometheusOperator.prometheusConfigReloader.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `prometheusOperator.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`rookCeph`¶

Rook Ceph Config: Configure support for Rook Ceph.

This is deprecated and should be configured via compliantkubernetes-kubespray if used.

Key	Type	Default	Title and Description
rookCeph.gatekeeperPsp¶	object	—	Rook Ceph Pod Security Policies: Configure Pod Security Policies for Rook Ceph.
rookCeph.gatekeeperPsp.enabled¶	boolean	—	Rook Ceph Pod Security Policies Enabled
rookCeph.monitoring¶	object	—	Rook Ceph Monitoring: Configure Monitoring for Rook Ceph.
rookCeph.monitoring.enabled¶	boolean	—	Rook Ceph Monitoring Enabled

`s3Exporter`¶

S3 Exporter: Configure S3 exporter, used to collect metrics about S3 usage.

Key	Type	Default	Title and Description
s3Exporter.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
s3Exporter.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
s3Exporter.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
s3Exporter.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
s3Exporter.enabled¶	boolean	`True`	S3 Exporter Enabled
s3Exporter.interval¶	string	`60m`	S3 Exporter Interval
s3Exporter.nodeSelector¶	object	—	See note
s3Exporter.resources¶	object	—	See note
s3Exporter.resources.limits¶	object	—	Kubernetes Quantity Map
s3Exporter.resources.requests¶	object	—	Kubernetes Quantity Map
s3Exporter.scrapeTimeout¶	string	—	—
s3Exporter.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration

Notes for `s3Exporter.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `s3Exporter.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`storageClasses`¶

Storage Classes Config: Configuration options for using block storage in Welkin

Key	Type	Default	Title and Description
storageClasses.default¶	string	`default`	The StorageClass to use for all persistent volumes in Welkin.

`tektonPipelines`¶

Tekton Pipelines Config: Configure Tekton Pipelines

Key	Type	Default	Title and Description
tektonPipelines.controller¶	object	—	Tekton Controller Config: Configure the Tekton Controller
tektonPipelines.controller.resources¶	object	—	See note
tektonPipelines.controller.resources.limits¶	object	—	Kubernetes Quantity Map
tektonPipelines.controller.resources.requests¶	object	—	Kubernetes Quantity Map
tektonPipelines.customConfigDefaults¶	object	—	See note
tektonPipelines.enabled¶	boolean	—	Enable Tekton Flag
tektonPipelines.remoteResolvers¶	object	—	Tekton Remote Resolvers Config: Configure the Tekton Remote Resolver
tektonPipelines.remoteResolvers.resources¶	object	—	See note
tektonPipelines.remoteResolvers.resources.limits¶	object	—	Kubernetes Quantity Map
tektonPipelines.remoteResolvers.resources.requests¶	object	—	Kubernetes Quantity Map
tektonPipelines.webhook¶	object	—	Tekton Webhook Config: Configure the Tekton Webhook
tektonPipelines.webhook.resources¶	object	—	See note
tektonPipelines.webhook.resources.limits¶	object	—	Kubernetes Quantity Map
tektonPipelines.webhook.resources.requests¶	object	—	Kubernetes Quantity Map

Notes for `tektonPipelines.controller.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `tektonPipelines.customConfigDefaults`

Custom default config: Configure custom default options for Tekton

Note

See the upstream documentation for available default config options.

Examples:

{'default-timeout-minutes': '30'}

Notes for `tektonPipelines.remoteResolvers.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `tektonPipelines.webhook.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`thanos`¶

Thanos Config: Configuration for Thanos.

Thanos ingests metrics sent from Prometheus in both the service and workload clusters, and stores them in object storage.

This requires that objectStorage is configured, and will use the bucket or container set in objectStorage.buckets.thanos.

Note

Thanos and its components are installed in the service cluster, so this configuration mainly applies there.

Key	Type	Default	Title and Description
thanos.bucketweb¶	object	—	Thanos Bucket Web: Configure Thanos Bucket Web, the UI to view the state of the bucket or container in use by Thanos.
thanos.bucketweb.resources¶	object	—	See note
thanos.bucketweb.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.bucketweb.resources.requests¶	object	—	Kubernetes Quantity Map
thanos.compactor¶	object	—	See note
thanos.compactor.deduplication¶	string	`none`	See note
thanos.compactor.persistence¶	object	—	Thanos Compactor Persistence: Configure persistence for Thanos Compactor.
thanos.compactor.persistence.enabled¶	boolean	`True`	Thanos Compactor Persistence Enabled
thanos.compactor.persistence.size¶	string	`8Gi`	Thanos Compactor Persistence Size
thanos.compactor.resources¶	object	—	See note
thanos.compactor.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.compactor.resources.requests¶	object	—	Kubernetes Quantity Map
thanos.compactor.retentionResolution1h¶	string	—	See note
thanos.compactor.retentionResolution5m¶	string	—	See note
thanos.compactor.retentionResolutionRaw¶	string	—	See note
thanos.compactor.verticalCompaction¶	boolean	—	Thanos Vertical Compactor: When enabled series of metrics from multiple replicas will be merged into one.
thanos.enabled¶	boolean	`True`	Thanos Enabled: > [!note] > Must be set for both service and workload cluster.
thanos.metrics¶	object	—	Thanos Metrics: Configure metrics collected from Thanos.
thanos.metrics.enabled¶	boolean	`True`	Thanos Metrics Enabled
thanos.metrics.serviceMonitor¶	object	—	Thanos Metrics Service Monitor: Configure the service monitor used to collect metrics from Thanos.
thanos.metrics.serviceMonitor.enabled¶	boolean	`True`	Thanos Metrics Service Monitor Enabled
thanos.objectStorage¶	object	—	Thanos Object Storage: Configure Object Storage for Thanos. Allows for using OpenStack Swift as the object storage backend type. Also allows use separate configuration of s3 specific to Thanos.
thanos.objectStorage.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
thanos.objectStorage.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
thanos.objectStorage.s3.region¶	string	—	S3 Region: Region to store data.
thanos.objectStorage.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
thanos.objectStorage.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
thanos.objectStorage.type¶	string	—	See note
thanos.query¶	object	—	Thanos Query: Configure Thanos Query, the component executing metric queries.
thanos.query.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
thanos.query.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
thanos.query.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
thanos.query.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
thanos.query.enabled¶	boolean	`True`	Thanos Query Enabled
thanos.query.replicaCount¶	number	`1`	Thanos Query Replicas
thanos.query.resources¶	object	—	See note
thanos.query.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.query.resources.requests¶	object	—	Kubernetes Quantity Map
thanos.query.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
thanos.queryFrontend¶	object	—	Thanos Query Frontend: Configure Thanos Query Frontend, the component serving query requests from Grafana.
thanos.queryFrontend.resources¶	object	—	See note
thanos.queryFrontend.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.queryFrontend.resources.requests¶	object	—	Kubernetes Quantity Map
thanos.receiveDistributor¶	object	—	Thanos Receive Distributor: Configure Thanos Receive Distributor, the component serving remote write requests from Prometheus. Also called routing receiver upstream.
thanos.receiveDistributor.extraFlags[]¶	array	—	See note
thanos.receiveDistributor.receiveHashringsAlgorithm¶	string	`ketama`	See note
thanos.receiveDistributor.receiveMaxConcurrency¶	integer	`5`	Thanos receiveDistributor maximum Concurrency: Maximum number of concurrent write requests allowed by Thanos receiveDistributor.
thanos.receiveDistributor.replicaCount¶	integer	`3`	Thanos receiveDistributor Replicas
thanos.receiveDistributor.replicationFactor¶	number	`1`	Thanos Replication Factor: Requires that incoming remote write requests are replicated `(replicationFactor + 1) / 2`.
thanos.receiveDistributor.resources¶	object	—	See note
thanos.receiveDistributor.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.receiveDistributor.resources.requests¶	object	—	Kubernetes Quantity Map
thanos.receiver¶	object	—	Thanos Receiver: Configure Thanos Receiver, the component ingesting metrics collected by Prometheus and storing them in object storage. Also called ingesting receiver upstream.
thanos.receiver.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
thanos.receiver.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
thanos.receiver.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
thanos.receiver.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
thanos.receiver.basic_auth¶	object	—	Thanos Receiver Basic Auth: Configure authentication to Thanos Receiver,
thanos.receiver.basic_auth.username¶	string	`thanos`	See note
thanos.receiver.enabled¶	boolean	`True`	Thanos Receiver Enabled
thanos.receiver.mode¶	string	`dual-mode`	See note
thanos.receiver.outOfOrderTimeWindow¶	string	`600s`	Thanos Out Of Order Time Window
thanos.receiver.persistence¶	object	—	Thanos Receiver Persistence: Configure persistence for Thanos Receiver.
thanos.receiver.persistence.enabled¶	boolean	`True`	Thanos Receiver Persistence Enabled
thanos.receiver.persistence.size¶	string	`50Gi`	Thanos Receiver Persistence Size
thanos.receiver.replicaCount¶	number	`2`	Thanos Receiver Replcias
thanos.receiver.resources¶	object	—	See note
thanos.receiver.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.receiver.resources.requests¶	object	—	Kubernetes Quantity Map
thanos.receiver.subdomain¶	string	`thanos-receiver`	See note
thanos.receiver.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
thanos.receiver.tsdbRetention¶	string	`15d`	Thanos TSDB Retention
thanos.ruler¶	object	—	Thanos Ruler: Configure Thanos Ruler, the component evaluating alerting and recording rules.
thanos.ruler.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
thanos.ruler.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
thanos.ruler.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
thanos.ruler.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
thanos.ruler.configReloader¶	object	—	Thanos Ruler Config Reloader: Configure the config reloader sidecar for Thanos Ruler.
thanos.ruler.configReloader.resources¶	object	—	See note
thanos.ruler.configReloader.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.ruler.configReloader.resources.requests¶	object	—	Kubernetes Quantity Map
thanos.ruler.enabled¶	boolean	`True`	Thanos Ruler Enabled
thanos.ruler.persistence¶	object	—	Thanos Ruler Persistence: Configure persistence for Thanos Ruler.
thanos.ruler.persistence.enabled¶	boolean	—	Thanos Ruler Persistence Enabled
thanos.ruler.persistence.size¶	string	`8Gi`	Thanos Ruler Persistence Size
thanos.ruler.replicaCount¶	number	`2`	Thanos Ruler Replcias
thanos.ruler.resources¶	object	—	See note
thanos.ruler.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.ruler.resources.requests¶	object	—	Kubernetes Quantity Map
thanos.ruler.topologySpreadConstraints[]¶	array	—	Kubernetes Topology Spread Constraints: TopologySpreadConstraints describes how pods should spread across topology domains.
thanos.storegateway¶	object	—	Thanos Store Gateway: Configure Thanos Store Gateway, the component fetching metrics from object storage.
thanos.storegateway.persistence¶	object	—	Thanos Store Gateway Persistence: Configure persistence for Thanos Store Gateway.
thanos.storegateway.persistence.size¶	string	`8Gi`	Thanos Store Gateway Persistence Size
thanos.storegateway.resources¶	object	—	See note
thanos.storegateway.resources.limits¶	object	—	Kubernetes Quantity Map
thanos.storegateway.resources.requests¶	object	—	Kubernetes Quantity Map

Notes for `thanos.bucketweb.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.compactor`

Thanos Compactor: Configure Thanos Compactor, the component compacting and deduplicating metrics stored by Thanos.

Note

See the upstream documentation for reference.

Notes for `thanos.compactor.deduplication`

Thanos Deduplication: Configure deduplication of metrics.

Possible values:

none

receiverReplicas

prometheusReplicas

Notes for `thanos.compactor.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.compactor.retentionResolution1h`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `thanos.compactor.retentionResolution5m`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `thanos.compactor.retentionResolutionRaw`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `thanos.objectStorage.type`

Thanos Object Storage Type

Possible values:

swift

Notes for `thanos.query.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.queryFrontend.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.receiveDistributor.extraFlags[]`

Thanos receiveDistributor extraFlags: When set, the arguments will be passed onto the component as command-line flags. Refer to the upstream doc for more details.

Notes for `thanos.receiveDistributor.receiveHashringsAlgorithm`

Thanos receiveDistributor algolrithm: Algorithm used for distributing writes across Thanos receive replicas.

Possible values:

hashmod

ketama

Notes for `thanos.receiveDistributor.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.receiver.basic_auth.username`

Thanos Receiver Basic Auth Username: Configure the username for authenticating to Thanos Receiver.

Note

Must be set for both service and workload clusters.

Notes for `thanos.receiver.mode`

Thanos Receiver Mode

Possible values:

standalone

dual-mode

Notes for `thanos.receiver.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.receiver.subdomain`

Thanos Receive Subdomain: Subdomain of opsDomain that the Ingress to Thanos Receive will be created with.

Note

Must be set for both service and workload clusters.

Notes for `thanos.ruler.configReloader.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.ruler.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.storegateway.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`trivy`¶

Trivy Config: Configure Trivy Operator.

Trivy automatically scans the cluster for vulnerabilities, misconfigurations, and exposed secrets.

Key	Type	Default	Title and Description
trivy.affinity¶	object	—	Affinity: Affinity is a group of affinity scheduling rules.
trivy.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
trivy.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
trivy.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
trivy.enabled¶	boolean	`True`	Trivy Config Enabled
trivy.excludeNamespaces¶	string	—	Trivy Config Excluded Namespaces: Configure a comma separated list of namespaces (or glob patterns) to be excluded from Trivy scanners.
trivy.nodeCollector¶	object	—	Trivy Node Collector: Configure the node collector created by Trivy.
trivy.nodeCollector.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
trivy.resources¶	object	—	See note
trivy.resources.limits¶	object	—	Kubernetes Quantity Map
trivy.resources.requests¶	object	—	Kubernetes Quantity Map
trivy.scanJobs¶	object	—	Trivy Scan Jobs: Configure the scan jobs created by Trivy.
trivy.scanJobs.concurrentLimit¶	number	`1`	Trivy Scan Job Concurrent Limit
trivy.scanJobs.retryDelay¶	string	`1m`	Trivy Scan Job Retry Delay
trivy.scanJobs.timeout¶	string	`5m`	Trivy Scan Job Timeout
trivy.scanner¶	object	—	See note
trivy.scanner.dbRegistry¶	string	—	Trivy DB Registry
trivy.scanner.dbRepository¶	string	—	Trivy DB Repository
trivy.scanner.dbRepositoryInsecure¶	boolean	—	Trivy DB Repository Insecure
trivy.scanner.imagePullSecret¶	object	—	Trivy Image Pull Secret: Configure an image pull secret for Trivy to use. Create the secret in the `monitoring` namespace then configure the name here.
trivy.scanner.imagePullSecret.name¶	string	—	Secret Name
trivy.scanner.javaDbRegistry¶	string	—	Trivy Java DB Registry
trivy.scanner.javaDbRepository¶	string	—	Trivy Java DB Repository
trivy.scanner.offlineScanEnabled¶	boolean	—	Trivy Offline Scan Enabled
trivy.scanner.registry¶	object	—	Trivy Registry: Configure registries for Trivy.
trivy.scanner.registry.mirror¶	object	—	See note
trivy.scanner.resources¶	object	—	See note
trivy.scanner.resources.limits¶	object	—	Kubernetes Quantity Map
trivy.scanner.resources.requests¶	object	—	Kubernetes Quantity Map
trivy.scanner.timeout¶	string	—	See note
trivy.serviceMonitor¶	object	—	Trivy Service Monitor: Configure the service monitor collecting metrics from Trivy.
trivy.serviceMonitor.enabled¶	boolean	`True`	Trivy Service Monitor Enabled
trivy.serviceMonitor.interval¶	string	—	See note
trivy.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
trivy.vulnerabilityScanner¶	object	—	Trivy Vulnerability Scanner: Configure the vulnerability scanner for Trivy.
trivy.vulnerabilityScanner.scanOnlyCurrentRevisions¶	boolean	`True`	Trivy Scan Current Revisions
trivy.vulnerabilityScanner.scannerReportTTL¶	string	—	See note

Notes for `trivy.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `trivy.scanner`

Trivy Scanner: Configure the scanner used by Trivy.

Note

Many of these must be configured to support an air-gapped environment. See the admin documentation for reference.

Notes for `trivy.scanner.registry.mirror`

Trivy Registry Mirror: Configure registry mirrors for Trivy.

The key represents the original registry and the value the mirror registry.

Examples:

{'docker.io': 'registry.example.com:5000', 'gcr.io': 'registry.example.com:5000', 'ghcr.io': 'registry.example.com:5000', 'index.docker.io': 'registry.example.com:5000', 'quay.io': 'registry.example.com:5000', 'registry.k8s.io': 'registry.example.com:5000'}

Notes for `trivy.scanner.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `trivy.scanner.timeout`

Duration String: A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `trivy.serviceMonitor.interval`

Time Range: An amount of time

Examples:

300s

72h

3d

Notes for `trivy.vulnerabilityScanner.scannerReportTTL`

Time Range: An amount of time

Examples:

300s

72h

3d

`user`¶

User Config: Configuration for Application Developers (users), that use the workload cluster

Key	Type	Default	Title and Description
user.adminGroups[]¶	array of string	—	Admin Groups: List of groups that Application Developers are apart of that should have access to the cluster.
user.adminUsers[]¶	array of string	—	Admin Users: List of Application Developers that should have access to the cluster.
user.constraints¶	object	—	See note
user.createNamespaces¶	boolean	—	Enable Create Namespaces: This only controls if the namespaces should be created, user RBAC is always created.
user.extraClusterRoleBindings¶	object	—	Extra Application Developer ClusterRoleBindings: Configure extra ClusterRoleBindings for Application Developers
user.extraClusterRoles¶	object	—	Extra Application Developer ClusterRoles: Configure extra ClusterRoles that are not originally part of Welkin These are intended to be used for Application Developers
user.extraRoleBindings¶	object	—	Extra Application Developer RoleBindings: Configure extra RoleBindings for Application Developers The RoleBindings are added to all Application Developer namespaces configured in user.namespaces
user.extraRoles¶	object	—	Extra Application Developer Roles: Configure extra Roles for Application Developers The Roles are added to all Application Developer namespaces configured in user.namespaces
user.fluxv2¶	object	—	Fluxv2: Installs required cluster resources needed to install fluxv2. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.fluxv2.enabled¶	boolean	—	Enable Fluxv2
user.jaeger¶	object	—	Jaeger: Installs required cluster resources needed to install jaeger. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.jaeger.enabled¶	boolean	—	Enable Jaeger
user.kafka¶	object	—	Kafka: Installs required cluster resources needed to install kafka-operator. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.kafka.enabled¶	boolean	—	Enable Kafka
user.mongodb¶	object	—	MongoDB: Installs required cluster resources needed to install MongoDB. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.mongodb.enabled¶	boolean	—	Enable MongoDB
user.namespaces[]¶	array of string	—	See note
user.sealedSecrets¶	object	—	SealedSecrets: Installs required cluster resources needed to install sealedSecrets. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.sealedSecrets.enabled¶	boolean	—	Enable SealedSecrets
user.serviceAccounts[]¶	array of string	—	See note

Notes for `user.constraints`

Constraints: Any namespace listed in constraints are exempted from HNC managed namespaces.

This to override the Pod Security Admission level.

Example of constraint can be found here: Example Constraint

The only extra label `psaLevel: `` is shown in the following example:

<namespace>:
  psaLevel: <baseline/privileged>
  <service-name>:
    ...

Notes for `user.namespaces[]`

Namespaces: List of namespaces that should be created for Application Developer.

It is common to create one namespace for the Application Developer and then create namespaces via HNC.

Requires that user.createNamespaces is enabled.

Application developer kube-config for contributors

Notes for `user.serviceAccounts[]`

ServiceAccounts: List of serviceAccounts to create RBAC rules for, used for dev situations.

`velero`¶

Velero Config: Configure Velero, the backup and snapshot tool for Kubernetes resources and volumes.

This requires that objectStorage is configured, and will use the bucket or container set in objectStorage.buckets.velero.

Key	Type	Default	Title and Description
velero.enabled¶	boolean	`True`	Velero Enabled
velero.excludedExtraNamespaces[]¶	array of string	—	Velero Excluded namespaces: Configure dynamic namespaces to exclude from backups, prefer this for overrides over `excludedNamespaces`.
velero.excludedNamespaces[]¶	array of string	—	Velero Excluded namespaces: Configure system namespaces to exclude from backups.
velero.nodeAgent¶	object	—	Velero Node Agent: Configure the node agent of Velero, used to take snapshots of volumes.
velero.nodeAgent.resources¶	object	—	See note
velero.nodeAgent.resources.limits¶	object	—	Kubernetes Quantity Map
velero.nodeAgent.resources.requests¶	object	—	Kubernetes Quantity Map
velero.nodeAgent.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
velero.nodeSelector¶	object	—	See note
velero.objectStorage¶	object	—	Object Storage Configuration.: Configuration options for using object storage specific to Velero.
velero.objectStorage.s3¶	object	—	S3 Storage Configurations: Configurations for using S3 storage.
velero.objectStorage.s3.forcePathStyle¶	boolean	—	S3 Force Path Style: Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
velero.objectStorage.s3.region¶	string	—	S3 Region: Region to store data.
velero.objectStorage.s3.regionEndpoint¶	string	—	S3 Region Endpoint: Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
velero.objectStorage.s3.v2Auth¶	boolean	—	S3 v2 authentication: Force the use of v2 authentication, will default to using v4 authentication otherwise.
velero.resources¶	object	—	See note
velero.resources.limits¶	object	—	Kubernetes Quantity Map
velero.resources.requests¶	object	—	Kubernetes Quantity Map
velero.restoreResourcePriorities[]¶	array of string	—	See note
velero.retentionPeriod¶	string	—	See note
velero.schedule¶	string	—	—
velero.storagePrefix¶	string	—	See note
velero.tolerations[]¶	array	—	Kubernetes Tolerations: Kubernetes Tolerations Kubernetes taint and toleration
velero.uploaderType¶	string	—	See note
velero.useVolumeSnapshots¶	boolean	—	Velero Use Volume Snapshots

Notes for `velero.nodeAgent.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `velero.nodeSelector`

Kubernetes Node Selector: Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `velero.resources`

Kubernetes Resource Requirements: Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

See upstream documentation for reference

Notes for `velero.restoreResourcePriorities[]`

Velero Restore Resource Priority: Configure restore order for resources

Note

Notes for `velero.retentionPeriod`

Duration String: A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `velero.storagePrefix`

Velero Storage Prefix: Configure unique storage prefix for this cluster when storing backups and snapshots in object storage.

When multiple workload clusters share the same bucket or container ensure that they use separate storage prefixes.

Examples:

service-cluster

workload-cluster

Notes for `velero.uploaderType`

Velero Uploader Type

Possible values:

kopia

restic

`wcProbeIngress`¶

Workcload Cluster Ingress Probe: Configure a probe for the workload cluster Ingress Controller.

Key	Type	Default	Title and Description
wcProbeIngress.enabled¶	boolean	—	Workcload Cluster Ingress Probe Enabled

`welcomingDashboard`¶

Welcoming Dashboard: If you want to add extra text to the grafana/opensearch "welcoming dashboards" then write the text in these values as a one-line string. Note, first line of the string is a header, not all characters are supported. For newline in Grafana dashboard use format \\n

Key	Type	Default	Title and Description
welcomingDashboard.extraTextGrafana¶	string	—	See note
welcomingDashboard.extraTextOpensearch¶	string	—	Extra Text OpenSearch: Extra text added to the Opensearch welcoming dashboard.
welcomingDashboard.extraVersions[]¶	array of object	—	Extra Versions: List of additional components to list on the welcoming dashboard. Additional component to list on the welcoming dashboard.

Notes for `welcomingDashboard.extraTextGrafana`

Extra Text Grafana: Extra text added to the Grafana welcoming dashboard.

Examples:

Hello\n\n[This is an example link](https:/elastisys.io)