Config

Notes for `alerts.customRoutes[]`

Additional route receivers that will be added to the configuration of alertmanager

Note

See the upstream documentation for reference.

Notes for `alerts.runbookUrls.alertmanager`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.backupStatus`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.blackbox`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.certManager`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.clusterApi`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.clusterAutoscaler`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.clusterCapacityManagement`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.configReloaders`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.coreDns`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.dailyChecks`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.diskPerf`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.falco`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.fluentd`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.general`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.harbor`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.hnc`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.kubeStateMetrics`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kubernetesApps`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kubernetesResources`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kubernetesStorage`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kubernetesSystem`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.kured`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.missingMetrics`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.nodeExporter`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.nodeNetwork`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.opensearch`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.openstack`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.packetsDropped`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

Notes for `alerts.runbookUrls.prometheus`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.prometheusOperator`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://runbooks.prometheus-operator.dev/runbooks/

Notes for `alerts.runbookUrls.thanos`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses upstream runbooks by default

https://github.com/thanos-io/thanos/tree/main/mixin/runbook.md

Notes for `alerts.runbookUrls.webhook`

Example:

group: link-to-alert-group-runbook AlertName: link-to-specific-alert-runbook

Uses no upstream runbook by default

`certmanager`¶

Configure cert-manager, used to provision certificates either self-signed or via Let's Encrypt.

Key	Type	Default	Description
certmanager.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
certmanager.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
certmanager.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
certmanager.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
certmanager.cainjector¶	object	—	This is meant to describe the base class if you will, for Welkin resources.
certmanager.cainjector.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
certmanager.cainjector.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
certmanager.cainjector.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
certmanager.cainjector.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
certmanager.cainjector.enabled¶	boolean	—	—
certmanager.cainjector.extraArgs[]¶	array of string	—	Extra arguments passed to a container
certmanager.cainjector.nodeSelector¶	object	—	See note
certmanager.cainjector.resources¶	object	—	See note
certmanager.cainjector.resources.limits¶	object	—	—
certmanager.cainjector.resources.requests¶	object	—	—
certmanager.cainjector.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
certmanager.cainjector.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
certmanager.extraArgs[]¶	array of string	—	Extra arguments passed to a container
certmanager.nodeSelector¶	object	—	See note
certmanager.resources¶	object	—	See note
certmanager.resources.limits¶	object	—	—
certmanager.resources.requests¶	object	—	—
certmanager.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
certmanager.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
certmanager.webhook¶	object	—	This is meant to describe the base class if you will, for Welkin resources.
certmanager.webhook.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
certmanager.webhook.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
certmanager.webhook.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
certmanager.webhook.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
certmanager.webhook.enabled¶	boolean	—	—
certmanager.webhook.extraArgs[]¶	array of string	—	Extra arguments passed to a container
certmanager.webhook.nodeSelector¶	object	—	See note
certmanager.webhook.resources¶	object	—	See note
certmanager.webhook.resources.limits¶	object	—	—
certmanager.webhook.resources.requests¶	object	—	—
certmanager.webhook.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
certmanager.webhook.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.

Notes for `certmanager.cainjector.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `certmanager.cainjector.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `certmanager.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `certmanager.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `certmanager.webhook.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `certmanager.webhook.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`clusterAdmin`¶

Configure the cluster admins.

Key	Type	Default	Description
clusterAdmin.groups[]¶	array of string	—	Configure the cluster admin groups.
clusterAdmin.users[]¶	array of string	—	Configure the cluster admin users.

`clusterApi`¶

Set to true if kubernetes is installed with cluster-api.

Key	Type	Default	Description
clusterApi.clusters[]¶	array of string	—	List of clusters to monitor. Used when monitoring clusters for autoscaling.
clusterApi.enabled¶	boolean	—	—
clusterApi.monitoring¶	object	—	Enable autoscaling monitoring of cluster API clusters.
clusterApi.monitoring.enabled¶	boolean	—	—

`dex`¶

Configure Dex, the federated OIDC Identity Provider.

Note

Dex is installed in the service cluster, so this configuration mainly applies there.

Key	Type	Default	Description
dex.additionalKubeloginRedirects[]¶	array of string	—	Configure Dex with additional Kubelogin redirects.
dex.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
dex.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
dex.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
dex.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
dex.enableStaticLogin¶	boolean	`True`	Configure Dex with a static password login `admin@example.com`.
dex.expiry¶	object	—	Configure expiry when authenticating with Dex.
dex.expiry.deviceRequests¶	string	—	See note
dex.expiry.idToken¶	string	—	See note
dex.expiry.refreshTokens¶	object	—	Configure expiry of refresh tokens when authenticating with Dex.
dex.expiry.refreshTokens.absoluteLifetime¶	string	—	See note
dex.expiry.refreshTokens.reuseInterval¶	string	—	See note
dex.expiry.refreshTokens.validIfNotUsedFor¶	string	—	See note
dex.expiry.signingKeys¶	string	—	See note
dex.google¶	object	—	Configure Dex with specific options when using the Google connector.
dex.google.SASecretName¶	string	—	—
dex.google.groupSupport¶	boolean	—	—
dex.nodeSelector¶	object	—	See note
dex.replicaCount¶	number	`2`	—
dex.resources¶	object	—	See note
dex.resources.limits¶	object	—	—
dex.resources.requests¶	object	—	—
dex.serviceMonitor¶	object	—	Configure the Service Monitor collecting metrics from Dex.
dex.serviceMonitor.enabled¶	boolean	`True`	—
dex.subdomain¶	string	`dex`	See note
dex.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
dex.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.

Notes for `dex.expiry.deviceRequests`

An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.idToken`

An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.refreshTokens.absoluteLifetime`

An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.refreshTokens.reuseInterval`

An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.refreshTokens.validIfNotUsedFor`

An amount of time

Examples:

300s

72h

3d

Notes for `dex.expiry.signingKeys`

An amount of time

Examples:

300s

72h

3d

Notes for `dex.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `dex.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `dex.subdomain`

Subdomain of baseDomain that the Ingress to Dex will be created with.

Note

Must be set for both service and workload clusters.

`externalDns`¶

Configure External DNS.

External DNS manages DNS records based on Kubernetes resources, and can automatically configure DNS records from:

CRD resources
Ingress resources
Service resources

Currently only AWS Route 53 is supported as the DNS provider.

Note

See the upstream documentation for reference.

Key	Type	Default	Description
externalDns.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
externalDns.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
externalDns.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
externalDns.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
externalDns.domains[]¶	array of string	—	Configure the domains External DNS should manage.
externalDns.enabled¶	boolean	—	—
externalDns.endpoints[]¶	array of object	—	See note
externalDns.extraArgs[]¶	array of string	—	Extra arguments passed to a container
externalDns.logLevel¶	string	—	See note
externalDns.namespaced¶	boolean	—	—
externalDns.provider¶	string	—	See note
externalDns.resources¶	object	—	See note
externalDns.resources.limits¶	object	—	—
externalDns.resources.requests¶	object	—	—
externalDns.sources¶	object	—	Configure the sources External DNS should manage DNS records for.
externalDns.sources.crd¶	boolean	—	—
externalDns.sources.ingress¶	boolean	—	—
externalDns.sources.service¶	boolean	—	—
externalDns.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
externalDns.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
externalDns.txtPrefix¶	string	—	Configure a prefix to TXT records. This is required with AWS Route 53 if CNAME records are preferred over A/AAAA records as it cannot handle both at the same time.

Notes for `externalDns.endpoints[]`

Configure the endpoints to create DNS records for.

Requires externalDns.sources.crd to be enabled.

Configure an endpoint to create a DNS record for.

Notes for `externalDns.logLevel`

Examples:

info

Notes for `externalDns.provider`

Examples:

aws

Notes for `externalDns.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`externalTrafficPolicy`¶

Configure global ingress external traffic policy.

Key	Type	Default	Description
externalTrafficPolicy.local¶	boolean	`True`	—
externalTrafficPolicy.whitelistRange¶	object	—	See note

Notes for `externalTrafficPolicy.whitelistRange`

Configure allowlist CIDR ranges for ingresses.

This is done via the ingress annotation nginx.ingress.kubernetes.io/whitelist-source-range.

Set to false to explicitly opt-out of this annotation.

`falco`¶

Configuration for Falco, runtime security tool and threat detection.

Key	Type	Default	Description
falco.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
falco.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
falco.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
falco.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
falco.alerts¶	object	—	Configure Falco alerts sent from Falco sidekick.
falco.alerts.enabled¶	boolean	—	—
falco.alerts.hostPort¶	string	`http://alertmanager-operated.monitoring:9093`	Configure the notification channel for Falco alerts.
falco.alerts.priority¶	string	`notice`	Configure the notification priority for Falco alerts.
falco.alerts.type¶	string	`alertmanager`	See note
falco.artifact¶	object	—	Configure Falcoctl artefact management. See the upstream repository for reference.
falco.artifact.install¶	object	—	Configure Falcoctl artefact install.
falco.artifact.install.enabled¶	boolean	—	Configure Falcoctl to install additional artifacts before Falco starts. Set this to false in an air-gapped environment, unless artifacts are self-hosted and `customIndexes` are configured.
falco.customIndexes[]¶	array of object	—	Configure custom artefact indices for Falcoctl. Configure custom artefact index for Falcoctl.
falco.customRules¶	object	—	See note
falco.driver¶	object	—	Configuration for the Falco syscall driver used to collect events. See the upstream documentation for more information.
falco.driver.kind¶	string	`kmod`	See note
falco.enabled¶	boolean	`True`	—
falco.falcoSidekick¶	object	—	Basic configuration for Falco Sidekick, the deployment that forwards Falco alerts to Alertmanager.
falco.falcoSidekick.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
falco.falcoSidekick.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
falco.falcoSidekick.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
falco.falcoSidekick.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
falco.falcoSidekick.nodeSelector¶	object	—	See note
falco.falcoSidekick.resources¶	object	—	See note
falco.falcoSidekick.resources.limits¶	object	—	—
falco.falcoSidekick.resources.requests¶	object	—	—
falco.falcoSidekick.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
falco.nodeSelector¶	object	—	See note
falco.resources¶	object	—	See note
falco.resources.limits¶	object	—	—
falco.resources.requests¶	object	—	—
falco.rulesFiles¶	object	—	Configure standard rules to use in Falco. See the upstream documentation for reference.
falco.rulesFiles.default¶	object	—	Configure Falco default rules
falco.rulesFiles.default.enabled¶	boolean	`True`	—
falco.rulesFiles.default.version¶	string	`3.0.1`	—
falco.rulesFiles.incubating¶	object	—	Configure Falco incubating rules
falco.rulesFiles.incubating.enabled¶	boolean	—	—
falco.rulesFiles.incubating.version¶	string	`3.0.1`	—
falco.rulesFiles.sandbox¶	object	—	Configure Falco sandbox rules
falco.rulesFiles.sandbox.enabled¶	boolean	—	—
falco.rulesFiles.sandbox.version¶	string	`3.0.1`	—
falco.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
falco.tty¶	boolean	`True`	Attach the Falco process to a TTY inside the container. Needed to flush Falco logs as soon as they are emitted.
falco.useContainerEngine¶	boolean	`True`	Use the new container engine collector that replaces the old docker, containerd, crio and podman collectors.

Notes for `falco.alerts.type`

Configure the notification channel for Falco alerts.

Possible values:

alertmanager

slack

none

Notes for `falco.customRules`

Configure custom rules to use in Falco.

Note

See the upstream documentation for reference.

The keys will become the file name of the generated rule file, and all files are parsed in alphabetical order.

Notes for `falco.driver.kind`

Possible values:

kmod

modern-bpf

ebpf

Notes for `falco.falcoSidekick.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `falco.falcoSidekick.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `falco.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `falco.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`fluentd`¶

Configuration for Fluentd.

Fluentd automatically collects logs from all containers running in the environment.

In the service cluster audit, application, and platform logs can be shipped to object storage. In the workload cluster audit logs can be shipped to object storage and application and platform logs to OpenSearch running in the service cluster.

Logs are collected using a daemon set, and in the workload cluster two sets are deployed, one for the system nodes and one for the worker nodes. Application developer can modify two ConfigMaps to add additional configuration and plugins to the set running on the worker nodes.

When logs are shipped to object storage a stateful aggregator is deployed that buffers logs with persistence before they are shipped. When logs are shipped to OpenSearch it is done directly from the forwarder daemons.

Shipping audit and service cluster logs requires that objectStorage is configured, and will use the bucket or container set in objectStorage.buckets.audit and objectStorage.buckets.scLogs respectively.

Note

Fluentd is installed in both service cluster and workload cluster, so this configuration applies there with some exceptions.

Key	Type	Default	Description
fluentd.aggregator¶	object	—	Configure Fluentd aggregator, used to buffer logs with persistence before they are shipped to object storage.
fluentd.aggregator.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
fluentd.aggregator.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
fluentd.aggregator.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
fluentd.aggregator.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
fluentd.aggregator.buffer¶	object	—	See note
fluentd.aggregator.buffer.chunkLimitSize¶	string	—	See note
fluentd.aggregator.buffer.flushInterval¶	string	—	See note
fluentd.aggregator.buffer.flushMode¶	string	—	See note
fluentd.aggregator.buffer.flushThreadBurstInterval¶	number	—	See note
fluentd.aggregator.buffer.flushThreadCount¶	integer	—	The number of threads to flush/write chunks in parallel. Flushing parameters
fluentd.aggregator.buffer.retryForever¶	boolean	—	If true, plugin will ignore `retryTimeout` and `retryMaxTimes` options and retry flushing forever. Retries parameters
fluentd.aggregator.buffer.retryMaxInterval¶	integer	—	The maximum interval (seconds) for exponential backoff between retries while failing. Retries parameters
fluentd.aggregator.buffer.retryType¶	string	—	See note
fluentd.aggregator.buffer.timekey¶	string	—	See note
fluentd.aggregator.buffer.timekeyUseUtc¶	boolean	—	Output plugin decides to use UTC or not to format placeholders using timekey. Common/Time parameters
fluentd.aggregator.buffer.timekeyWait¶	string	—	See note
fluentd.aggregator.buffer.totalLimitSize¶	string	—	See note
fluentd.aggregator.nodeSelector¶	object	—	See note
fluentd.aggregator.persistence¶	object	—	Configure Fluentd aggregator persistence.
fluentd.aggregator.persistence.storage¶	string	`10Gi`	—
fluentd.aggregator.resources¶	object	—	See note
fluentd.aggregator.resources.limits¶	object	—	—
fluentd.aggregator.resources.requests¶	object	—	—
fluentd.aggregator.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
fluentd.audit¶	object	—	Configure Fluentd audit log collection.
fluentd.audit.compaction¶	object	—	Configure the compaction of logs stored in object storage.
fluentd.audit.compaction.days¶	number	—	Configure the days to consider for compaction or the days to retain.
fluentd.audit.compaction.enabled¶	boolean	`True`	—
fluentd.audit.compaction.ephemeralVolumes¶	object	—	Configure the job to run with an ephemeral volume if the nodes risk running out of storage.
fluentd.audit.compaction.ephemeralVolumes.enabled¶	boolean	—	—
fluentd.audit.compaction.schedule¶	string	—	—
fluentd.audit.enabled¶	boolean	—	—
fluentd.audit.filters¶	string	—	Configure Fluentd audit log filter stages. To capture audit logs label the logs with the `@AUDIT` label.
fluentd.audit.retention¶	object	—	Configure the retention of logs stored in object storage.
fluentd.audit.retention.days¶	number	—	Configure the days to consider for compaction or the days to retain.
fluentd.audit.retention.enabled¶	boolean	`True`	—
fluentd.audit.retention.schedule¶	string	—	—
fluentd.enabled¶	boolean	`True`	—
fluentd.extraConfigMaps¶	object	—	See note
fluentd.forwarder¶	object	—	Configure Fluentd forwarder, used to collect and forward logs on system nodes.
fluentd.forwarder.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
fluentd.forwarder.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
fluentd.forwarder.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
fluentd.forwarder.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
fluentd.forwarder.buffer¶	object	—	See note
fluentd.forwarder.buffer.chunkLimitSize¶	string	—	See note
fluentd.forwarder.buffer.flushInterval¶	string	—	See note
fluentd.forwarder.buffer.flushMode¶	string	—	See note
fluentd.forwarder.buffer.flushThreadBurstInterval¶	number	—	See note
fluentd.forwarder.buffer.flushThreadCount¶	integer	—	The number of threads to flush/write chunks in parallel. Flushing parameters
fluentd.forwarder.buffer.retryForever¶	boolean	—	If true, plugin will ignore `retryTimeout` and `retryMaxTimes` options and retry flushing forever. Retries parameters
fluentd.forwarder.buffer.retryMaxInterval¶	integer	—	The maximum interval (seconds) for exponential backoff between retries while failing. Retries parameters
fluentd.forwarder.buffer.retryType¶	string	—	See note
fluentd.forwarder.buffer.timekey¶	string	—	See note
fluentd.forwarder.buffer.timekeyUseUtc¶	boolean	—	Output plugin decides to use UTC or not to format placeholders using timekey. Common/Time parameters
fluentd.forwarder.buffer.timekeyWait¶	string	—	See note
fluentd.forwarder.buffer.totalLimitSize¶	string	—	See note
fluentd.forwarder.image¶	object	—	Configure Fluentd forwarder image repository and tag
fluentd.forwarder.image.repository¶	string	`ghcr.io/elastisys/fluentd-forwarder`	—
fluentd.forwarder.image.tag¶	string	`v4.7.5-ck8s1`	—
fluentd.forwarder.livenessThresholdSeconds¶	number	`900`	—
fluentd.forwarder.nodeSelector¶	object	—	See note
fluentd.forwarder.requestTimeout¶	string	`60s`	—
fluentd.forwarder.resources¶	object	—	See note
fluentd.forwarder.resources.limits¶	object	—	—
fluentd.forwarder.resources.requests¶	object	—	—
fluentd.forwarder.stuckThresholdSeconds¶	number	`1200`	—
fluentd.forwarder.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
fluentd.logManager¶	object	—	Configure log-manager, used to manage compaction and retention of logs store in object storage.
fluentd.logManager.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
fluentd.logManager.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
fluentd.logManager.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
fluentd.logManager.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
fluentd.logManager.compaction¶	object	—	Configure log-manager compaction.
fluentd.logManager.compaction.azureCopyBufferGB¶	number	—	Configure the memory buffer size in GB (accepts decimals) for Azure copy operations.
fluentd.logManager.compaction.azureCopyConcurrency¶	number	—	Configure the maximum number of concurrent download requests for Azure copy operations.
fluentd.logManager.compaction.resources¶	object	—	See note
fluentd.logManager.compaction.resources.limits¶	object	—	—
fluentd.logManager.compaction.resources.requests¶	object	—	—
fluentd.logManager.compaction.volume¶	object	—	Configure log-manager compaction volume.
fluentd.logManager.compaction.volume.storage¶	string	`5Gi`	Configure log-manager compaction volume size.
fluentd.logManager.nodeSelector¶	object	—	See note
fluentd.logManager.retention¶	object	—	Configure log-manager retention.
fluentd.logManager.retention.resources¶	object	—	See note
fluentd.logManager.retention.resources.limits¶	object	—	—
fluentd.logManager.retention.resources.requests¶	object	—	—
fluentd.logManager.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
fluentd.objectStorage¶	object	—	Configuration options for using object storage specific to Fluentd.
fluentd.objectStorage.s3¶	object	—	Configurations for using S3 storage.
fluentd.objectStorage.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
fluentd.objectStorage.s3.region¶	string	—	Region to store data.
fluentd.objectStorage.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
fluentd.objectStorage.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
fluentd.scLogs¶	object	—	Configure Fluentd service cluster log collection.
fluentd.scLogs.compaction¶	object	—	Configure the compaction of logs stored in object storage.
fluentd.scLogs.compaction.days¶	number	—	Configure the days to consider for compaction or the days to retain.
fluentd.scLogs.compaction.enabled¶	boolean	`True`	—
fluentd.scLogs.compaction.ephemeralVolumes¶	object	—	Configure the job to run with an ephemeral volume if the nodes risk running out of storage.
fluentd.scLogs.compaction.ephemeralVolumes.enabled¶	boolean	—	—
fluentd.scLogs.compaction.schedule¶	string	—	—
fluentd.scLogs.enabled¶	boolean	`True`	—
fluentd.scLogs.retention¶	object	—	Configure the retention of logs stored in object storage.
fluentd.scLogs.retention.days¶	number	—	Configure the days to consider for compaction or the days to retain.
fluentd.scLogs.retention.enabled¶	boolean	`True`	—
fluentd.scLogs.retention.schedule¶	string	—	—
fluentd.user¶	object	—	Configure Fluentd forwarder, used to collect and forward logs on worker nodes that applications developers run their workload on.
fluentd.user.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
fluentd.user.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
fluentd.user.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
fluentd.user.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
fluentd.user.nodeSelector¶	object	—	See note
fluentd.user.resources¶	object	—	See note
fluentd.user.resources.limits¶	object	—	—
fluentd.user.resources.requests¶	object	—	—
fluentd.user.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration

Notes for `fluentd.aggregator.buffer`

Fluentd buffer configuration parameters.

Note

See upstream documentation for reference, set keys will be converted from camelCase to snake_case.

Notes for `fluentd.aggregator.buffer.chunkLimitSize`

Events will be written into chunks until the size of chunks become chunkLimitSize.

Examples:

50MB

Notes for `fluentd.aggregator.buffer.flushInterval`

Flushes the buffer each flushInterval, if flushMode is equal to interval.

Examples:

15m

Notes for `fluentd.aggregator.buffer.flushMode`

The flush mode to use.

Possible values:

lazy

interval

immediate

Notes for `fluentd.aggregator.buffer.flushThreadBurstInterval`

The sleep interval (seconds) for threads between flushes when the output plugin flushes the waiting chunks to the next ones.

Notes for `fluentd.aggregator.buffer.retryType`

The retry algorithm type to use.

Retries parameters

Possible values:

exponential_backoff

periodic

Notes for `fluentd.aggregator.buffer.timekey`

Output plugin will flush chunks per specified time (enabled when time is specified in chunk keys).

Examples:

10m

Notes for `fluentd.aggregator.buffer.timekeyWait`

Output plugin will write chunks after timekey_wait seconds later after timekey expiration.

If a user configures timekey 60m, output plugin will wait delayed events for flushed timekey and write the chunk at 10 minutes of each hour.

Examples:

1m

Notes for `fluentd.aggregator.buffer.totalLimitSize`

The size limitation of this buffer plugin instance.

Once the total size of stored buffer reached this threshold, all append operations will fail with error (and data will be lost).

Examples:

9GB

Notes for `fluentd.aggregator.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `fluentd.aggregator.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `fluentd.extraConfigMaps`

Configure extra ConfigMaps for Fluentd.

Note

This is only applicable for Fluentd forwarder running on system nodes in the workload cluster.

Notes for `fluentd.forwarder.buffer`

Fluentd buffer configuration parameters.

Note

See upstream documentation for reference, set keys will be converted from camelCase to snake_case.

Notes for `fluentd.forwarder.buffer.chunkLimitSize`

Events will be written into chunks until the size of chunks become chunkLimitSize.

Examples:

50MB

Notes for `fluentd.forwarder.buffer.flushInterval`

Flushes the buffer each flushInterval, if flushMode is equal to interval.

Examples:

15m

Notes for `fluentd.forwarder.buffer.flushMode`

The flush mode to use.

Possible values:

lazy

interval

immediate

Notes for `fluentd.forwarder.buffer.flushThreadBurstInterval`

The sleep interval (seconds) for threads between flushes when the output plugin flushes the waiting chunks to the next ones.

Notes for `fluentd.forwarder.buffer.retryType`

The retry algorithm type to use.

Retries parameters

Possible values:

exponential_backoff

periodic

Notes for `fluentd.forwarder.buffer.timekey`

Output plugin will flush chunks per specified time (enabled when time is specified in chunk keys).

Examples:

10m

Notes for `fluentd.forwarder.buffer.timekeyWait`

Output plugin will write chunks after timekey_wait seconds later after timekey expiration.

If a user configures timekey 60m, output plugin will wait delayed events for flushed timekey and write the chunk at 10 minutes of each hour.

Examples:

1m

Notes for `fluentd.forwarder.buffer.totalLimitSize`

The size limitation of this buffer plugin instance.

Once the total size of stored buffer reached this threshold, all append operations will fail with error (and data will be lost).

Examples:

9GB

Notes for `fluentd.forwarder.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `fluentd.forwarder.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `fluentd.logManager.compaction.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `fluentd.logManager.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `fluentd.logManager.retention.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `fluentd.user.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `fluentd.user.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`gatekeeper`¶

Configure OPA Gatekeeper to give application developer access to Custom Resource Definitions.

Some preconfigured services can be found under the key user.

Note

See the admin docs for context.

Key	Type	Default	Description
gatekeeper.allowUserCRDs¶	object	—	Configure access to Custom Resource Definitions for application developers.
gatekeeper.allowUserCRDs.adminConfUser¶	string	`kubernetes-admin`	Configure the admin config user of the `/etc/kubernetes/admin.conf` found on the control plane nodes. This is necessary if Kubespray is used for managing the cluster.
gatekeeper.allowUserCRDs.enabled¶	boolean	—	—
gatekeeper.allowUserCRDs.enforcement¶	string	`deny`	See note
gatekeeper.allowUserCRDs.extraCRDs[]¶	array of object	—	Configure extra CRDs to allow for application developers. Configure extra CRDs to allow for application developers.
gatekeeper.allowUserCRDs.extraServiceAccounts[]¶	array of object	—	See note
gatekeeper.enabled¶	boolean	`True`	—

Notes for `gatekeeper.allowUserCRDs.enforcement`

Possible values:

deny

warn

dryrun

Notes for `gatekeeper.allowUserCRDs.extraServiceAccounts[]`

Configure extra service accounts to allow access to configured CRDs.

Configure an extra service account to allow access to configured CRDs.

Examples:

[{'namespace': 'example-namespace', 'name': 'example-controller'}]

`global`¶

Some common options used in various helm charts.

Key	Type	Default	Description
global.baseDomain¶	string	—	See note
global.ck8sCloudProvider¶	string	—	See note
global.ck8sConfigSerial¶	string	—	See note
global.ck8sEnvironmentName¶	string	—	See note
global.ck8sFlavor¶	string	—	See note
global.ck8sK8sInstaller¶	string	—	See note
global.ck8sVersion¶	string	—	See note
global.clusterDns¶	string	`10.233.0.3`	IP of the cluster DNS in kubernetes
global.clusterName¶	string	—	—
global.clustersMonitoring[]¶	array of string	—	Configure the names of the workload clusters that sends metrics to the service cluster. Mainly used to filter metrics.
global.containerRuntime¶	string	`containerd`	See note
global.enforceIPFamilies¶	boolean	—	Enforce ipFamilyPolicy to all services that doesn't explicitly set it. This is done using a mutating webhook to all services that doesn't set this. The value it sets is taken from `.global.ipFamilies`
global.enforceIPFamilyPolicy¶	boolean	—	See note
global.ipFamilies[]¶	array of string	`['IPv4']`	Used to set the ipFamilyPolicy for all configurable services.
global.ipFamilyPolicy¶	string	`SingleStack`	See note
global.issuer¶	string	`letsencrypt-staging`	See note
global.opsDomain¶	string	—	See note
global.scDomain¶	string	—	If baseDomain for wc and sc are not the same, set the domain of the sc cluster.
global.scOpsDomain¶	string	—	If opsDomain for wc and sc are not the same, set the ops domain of the sc cluster.
global.verifyTls¶	boolean	`True`	Verify ingress certificates

Notes for `global.baseDomain`

Domain intended for ingress usage in the workload cluster and to reach application developer facing services such as Grafana, Harbor and OpenSearch Dashboards. E.g. with 'prod.domain.com', OpenSearch Dashboards is reached via 'opensearch.prod.domain.com'.

Notes for `global.ck8sCloudProvider`

Possible values:

aws

azure

baremetal

citycloud

elastx

exoscale

none

safespring

upcloud

openstack

Notes for `global.ck8sConfigSerial`

This property is used during migrations to track state and ensure that the same version is used during ck8s upgrade prepare as during ck8s upgrade apply.

Examples:

2025-04-29T08:34:21+00:00

Notes for `global.ck8sEnvironmentName`

Examples:

my-welkin-cluster

Notes for `global.ck8sFlavor`

Possible values:

prod

dev

air-gapped

Notes for `global.ck8sK8sInstaller`

Possible values:

capi

kubespray

none

Notes for `global.ck8sVersion`

Use version number if you are exactly at a release tag. Otherwise use full commit hash of current commit. any, can be used to disable this validation.

Examples:

v0.42.1

any

424442541a567646c232d949bad1af2b5b7cb885

Notes for `global.containerRuntime`

Possible values:

containerd

docker

Notes for `global.enforceIPFamilyPolicy`

Enforce ipFamilyPolicy to all services that doesn't explicitly set it. This is done using a mutating webhook to all services that doesn't set this. The value it sets is taken from .global.ipFamilyPolicy

Notes for `global.ipFamilyPolicy`

Used to set the ipFamilyPolicy for all configurable services.

Examples:

SingleStack

PreferDualStack

RequireDualStack

Possible values:

SingleStack

PreferDualStack

RequireDualStack

Notes for `global.issuer`

Default cert-manager issuer to use for issuing certificates for ingresses. Normally one of letsencrypt-staging or letsencrypt-prod.

Examples:

letsencrypt-staging

letsencrypt-prod

selfsigned

Notes for `global.opsDomain`

Domain intended for ingress usage in the service cluster and to reach non-user facing services such as Thanos and OpenSearch. E.g. with 'ops.prod.domain.com', OpenSearch is reached via 'opensearch.ops.prod.domain.com'.

`gpu`¶

Configure the GPU Operator and its dependencies

Key	Type	Default	Description
gpu.daemonsets¶	object	—	Configure GPU Daemonsets
gpu.daemonsets.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
gpu.devicePlugin¶	object	—	Configuration for the device plugin, e.g. timeslicing
gpu.enabled¶	boolean	—	—
gpu.extraMetrics¶	boolean	—	Adds some profiling metrics in DCGM if it's available in your GPU setup
gpu.mig¶	object	—	Configure MIG options like strategy
gpu.mig.strategy¶	string	—	See note
gpu.nodeFeatureDiscovery¶	object	—	Configure Node Feature Discovery
gpu.nodeFeatureDiscovery.controlPlane¶	object	—	Configure Node Feature Discovery Control Plane
gpu.nodeFeatureDiscovery.controlPlane.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
gpu.nodeFeatureDiscovery.controlPlane.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
gpu.nodeFeatureDiscovery.controlPlane.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
gpu.nodeFeatureDiscovery.controlPlane.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
gpu.nodeFeatureDiscovery.controlPlane.resources¶	object	—	See note
gpu.nodeFeatureDiscovery.controlPlane.resources.limits¶	object	—	—
gpu.nodeFeatureDiscovery.controlPlane.resources.requests¶	object	—	—
gpu.nodeFeatureDiscovery.controlPlane.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
gpu.nodeFeatureDiscovery.worker¶	object	—	Configure Node Feature Discovery workers
gpu.nodeFeatureDiscovery.worker.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
gpu.nodeFeatureDiscovery.worker.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
gpu.nodeFeatureDiscovery.worker.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
gpu.nodeFeatureDiscovery.worker.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
gpu.nodeFeatureDiscovery.worker.resources¶	object	—	See note
gpu.nodeFeatureDiscovery.worker.resources.limits¶	object	—	—
gpu.nodeFeatureDiscovery.worker.resources.requests¶	object	—	—
gpu.nodeFeatureDiscovery.worker.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
gpu.operator¶	object	—	Configure GPU Operator
gpu.operator.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
gpu.operator.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
gpu.operator.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
gpu.operator.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
gpu.operator.resources¶	object	—	See note
gpu.operator.resources.limits¶	object	—	—
gpu.operator.resources.requests¶	object	—	—
gpu.operator.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration

Notes for `gpu.mig.strategy`

None ignores MIG entirely, single makes MIG devices a standard GPU resource, and shared creates one resource type for each MIG configuration

Possible values:

mixed

single

none

Notes for `gpu.nodeFeatureDiscovery.controlPlane.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `gpu.nodeFeatureDiscovery.worker.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `gpu.operator.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`grafana`¶

Configure Grafana, the metrics visualisation dashboard.

Welkin hosts two instances of Grafana one for the Platform Administrator and one for the Application Developer.

Note

Grafana is installed in the service cluster, so this configuration mainly applies there.

Key	Type	Default	Description
grafana.ops¶	object	—	Configure Grafana.
grafana.ops.additionalConfigValues¶	string	—	—
grafana.ops.additionalDatasources¶	object	—	—
grafana.ops.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
grafana.ops.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
grafana.ops.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
grafana.ops.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
grafana.ops.dataproxy¶	object	—	Configure Grafana dataproxy values
grafana.ops.dataproxy.timeout¶	number	`600`	—
grafana.ops.enabled¶	boolean	`True`	—
grafana.ops.nodeSelector¶	object	—	See note
grafana.ops.oidc¶	object	—	Configure authentication to Grafana via Dex.
grafana.ops.oidc.allowedDomains[]¶	array of string	—	Configure the domains of the users allowed to authenticate to Grafana.
grafana.ops.oidc.enabled¶	boolean	`True`	—
grafana.ops.oidc.scopes¶	string	`openid profile email groups`	—
grafana.ops.oidc.skipRoleSync¶	boolean	—	When enabled the roles for user can be managed within Grafana.
grafana.ops.oidc.userGroups¶	object	—	Configure the roles for groups.
grafana.ops.oidc.userGroups.grafanaAdmin¶	string	`grafana_admin`	—
grafana.ops.oidc.userGroups.grafanaEditor¶	string	`grafana_editor`	—
grafana.ops.oidc.userGroups.grafanaViewer¶	string	`grafana_viewer`	—
grafana.ops.plugins[]¶	array	—	—
grafana.ops.resources¶	object	—	See note
grafana.ops.resources.limits¶	object	—	—
grafana.ops.resources.requests¶	object	—	—
grafana.ops.sidecar¶	object	—	Configure the sidecar provisioning dashboards from ConfigMaps in Grafana.
grafana.ops.sidecar.resources¶	object	—	See note
grafana.ops.sidecar.resources.limits¶	object	—	—
grafana.ops.sidecar.resources.requests¶	object	—	—
grafana.ops.subdomain¶	string	`grafana`	See note
grafana.ops.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
grafana.ops.trailingDots¶	boolean	`True`	See note
grafana.ops.viewersCanEdit¶	boolean	`True`	—
grafana.user¶	object	—	Configure Grafana.
grafana.user.additionalConfigValues¶	string	—	—
grafana.user.additionalDatasources¶	object	—	—
grafana.user.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
grafana.user.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
grafana.user.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
grafana.user.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
grafana.user.dataproxy¶	object	—	Configure Grafana dataproxy values
grafana.user.dataproxy.timeout¶	number	`600`	—
grafana.user.enabled¶	boolean	`True`	—
grafana.user.nodeSelector¶	object	—	See note
grafana.user.oidc¶	object	—	Configure authentication to Grafana via Dex.
grafana.user.oidc.allowedDomains[]¶	array of string	—	Configure the domains of the users allowed to authenticate to Grafana.
grafana.user.oidc.enabled¶	boolean	`True`	—
grafana.user.oidc.scopes¶	string	`openid profile email groups`	—
grafana.user.oidc.skipRoleSync¶	boolean	—	When enabled the roles for user can be managed within Grafana.
grafana.user.oidc.userGroups¶	object	—	Configure the roles for groups.
grafana.user.oidc.userGroups.grafanaAdmin¶	string	`grafana_admin`	—
grafana.user.oidc.userGroups.grafanaEditor¶	string	`grafana_editor`	—
grafana.user.oidc.userGroups.grafanaViewer¶	string	`grafana_viewer`	—
grafana.user.plugins[]¶	array	—	—
grafana.user.resources¶	object	—	See note
grafana.user.resources.limits¶	object	—	—
grafana.user.resources.requests¶	object	—	—
grafana.user.sidecar¶	object	—	Configure the sidecar provisioning dashboards from ConfigMaps in Grafana.
grafana.user.sidecar.resources¶	object	—	See note
grafana.user.sidecar.resources.limits¶	object	—	—
grafana.user.sidecar.resources.requests¶	object	—	—
grafana.user.subdomain¶	string	`grafana`	See note
grafana.user.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
grafana.user.trailingDots¶	boolean	`True`	See note
grafana.user.viewersCanEdit¶	boolean	`True`	—

Notes for `grafana.ops.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `grafana.ops.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `grafana.ops.sidecar.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `grafana.ops.subdomain`

For Admin Grafana the subdomain of opsDomain that the Ingress to Admin Grafana will be created with.

For Dev Grafana the subdomain of baseDomain that the Ingress to Dev Grafana will be created with.

Note

Must be set for both service and workload clusters.

Notes for `grafana.ops.trailingDots`

Configure Grafana to use absolute domain names.

Warning

Some operating systems and web browsers may have problems accessing Grafana when with this enabled.

Notes for `grafana.user.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `grafana.user.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `grafana.user.sidecar.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `grafana.user.subdomain`

For Admin Grafana the subdomain of opsDomain that the Ingress to Admin Grafana will be created with.

For Dev Grafana the subdomain of baseDomain that the Ingress to Dev Grafana will be created with.

Note

Must be set for both service and workload clusters.

Notes for `grafana.user.trailingDots`

Configure Grafana to use absolute domain names.

Warning

Some operating systems and web browsers may have problems accessing Grafana when with this enabled.

`grafanaLabelEnforcer`¶

Configure Grafana Label Enforcer, responsible to filter metrics from different clusters for Grafana datasources.

Key	Type	Default	Description
grafanaLabelEnforcer.resources¶	object	—	See note
grafanaLabelEnforcer.resources.limits¶	object	—	—
grafanaLabelEnforcer.resources.requests¶	object	—	—

Notes for `grafanaLabelEnforcer.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`harbor`¶

Configuration options for Harbor.

Harbor is a container registry that deployed for the application developers to use when deploying their applications.

Note

See upstream documentation for reference. All config variables that exists in harbor are not exposed via our config.

Key	Type	Default	Description
harbor.alerts¶	object	—	Configuration options for Harbor Alerts.
harbor.alerts.maxTotalArtifacts¶	number	`3000`	Alert when the total number of artifacts is above the set number.
harbor.alerts.maxTotalStorageUsedGB¶	number	`1500`	Alert when the total storage usage is above the set number.
harbor.backup¶	object	—	Configuration options for Backup Job.
harbor.backup.enabled¶	boolean	`True`	—
harbor.backup.ephemeralBackupStore¶	object	—	EphemeralBackupStore configuration for Harbor `StorageSize` defines how large the ephemeral volumes will be.
harbor.backup.ephemeralBackupStore.enabled¶	boolean	—	—
harbor.backup.ephemeralBackupStore.storageSize¶	string	`10Gi`	—
harbor.backup.retentionDays¶	number	`7`	`RetentionDays` defines how old a backup should be before deleting it.
harbor.backup.schedule¶	string	—	—
harbor.core¶	object	—	Configuration options for Core.
harbor.core.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.core.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.core.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.core.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.core.replicas¶	number	`1`	Number of Core pods
harbor.core.resources¶	object	—	See note
harbor.core.resources.limits¶	object	—	—
harbor.core.resources.requests¶	object	—	—
harbor.database¶	object	—	See note
harbor.database.external¶	object	—	Configuration options for External Database.
harbor.database.external.coreDatabase¶	string	`registry`	Name of the database for Core
harbor.database.external.notaryServerDatabase¶	string	`notaryserver`	Name of the database for Notary Server
harbor.database.external.notarySignerDatabase¶	string	`notarysigner`	Name of the database for Notary Signer
harbor.database.external.port¶	string	`5432`	Database listening port
harbor.database.external.sslmode¶	string	`disable`	See note
harbor.database.internal¶	object	—	Configuration options for Internal Database.
harbor.database.internal.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.database.internal.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.database.internal.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.database.internal.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.database.internal.persistentVolumeClaim¶	object	—	PersistentVolumeClaim
harbor.database.internal.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.database.internal.resources¶	object	—	See note
harbor.database.internal.resources.limits¶	object	—	—
harbor.database.internal.resources.requests¶	object	—	—
harbor.database.type¶	string	`internal`	—
harbor.enabled¶	boolean	`True`	—
harbor.exporter¶	object	—	Configuration options for Exporter.
harbor.exporter.external¶	object	—	External configuration
harbor.exporter.external.coreDatabase¶	string	—	See note
harbor.exporter.external.port¶	string	—	See note
harbor.exporter.resources¶	object	—	See note
harbor.exporter.resources.limits¶	object	—	—
harbor.exporter.resources.requests¶	object	—	—
harbor.gc¶	object	—	Configuration options for GC (Garbage Collection).
harbor.gc.enabled¶	boolean	`True`	—
harbor.gc.forceConfigure¶	boolean	—	—
harbor.gc.schedule¶	string	`0 0 0 * * SUN`	See note
harbor.ingress¶	object	—	Configuration options for Ingress.
harbor.ingress.additionalAnnotations¶	object	—	—
harbor.ingress.defaultAnnotations¶	object	—	Default annotations for ingress
harbor.ingress.defaultAnnotations.nginx.ingress.kubernetes.io/proxy-buffering¶	string	—	—
harbor.ingress.defaultAnnotations.nginx.ingress.kubernetes.io/proxy-request-buffering¶	string	—	—
harbor.jobservice¶	object	—	Configuration options for Jobservice.
harbor.jobservice.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.jobservice.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.jobservice.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.jobservice.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.jobservice.jobLog¶	object	—	Job log configuration
harbor.jobservice.jobLog.persistentVolumeClaim¶	object	—	PersistentVolumeClaim
harbor.jobservice.jobLog.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.jobservice.jobLoggers[]¶	array of string	—	Configuration options for JobLoggers
harbor.jobservice.replicas¶	number	`1`	Number of Jobservice pods
harbor.jobservice.resources¶	object	—	See note
harbor.jobservice.resources.limits¶	object	—	—
harbor.jobservice.resources.requests¶	object	—	—
harbor.jobservice.scanDataExports¶	object	—	Scan data exports configuration
harbor.jobservice.scanDataExports.persistentVolumeClaim¶	object	—	PersistentVolumeClaim
harbor.jobservice.scanDataExports.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.mpuCleaner¶	object	—	Configuration options for MultipartUpload cleaner job
harbor.mpuCleaner.enabled¶	boolean	`True`	—
harbor.mpuCleaner.maxAgeDays¶	number	`7`	`maxAgeDays` defines how old an unfinished multipartupload is allowed to be before deleting it.
harbor.mpuCleaner.schedule¶	string	—	—
harbor.nodeSelector¶	object	—	See note
harbor.notary¶	object	—	Configuration options for Notary.
harbor.notary.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.notary.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.notary.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.notary.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.notary.replicas¶	number	`1`	—
harbor.notary.resources¶	object	—	See note
harbor.notary.resources.limits¶	object	—	—
harbor.notary.resources.requests¶	object	—	—
harbor.notary.subdomain¶	string	`notary.harbor`	—
harbor.notarySigner¶	object	—	Configuration options for Notary signer.
harbor.notarySigner.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.notarySigner.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.notarySigner.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.notarySigner.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.notarySigner.resources¶	object	—	See note
harbor.notarySigner.resources.limits¶	object	—	—
harbor.notarySigner.resources.requests¶	object	—	—
harbor.objectStorage¶	object	—	Configuration options for using object storage specific to harbor.
harbor.objectStorage.s3¶	object	—	Configurations for using S3 storage.
harbor.objectStorage.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
harbor.objectStorage.s3.region¶	string	—	Region to store data.
harbor.objectStorage.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
harbor.objectStorage.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
harbor.oidc¶	object	—	Configuration options for OIDC.
harbor.oidc.adminGroupName¶	string	—	—
harbor.oidc.groupClaimName¶	string	`groups`	—
harbor.oidc.scope¶	string	`openid,email,profile,offline_access,groups`	—
harbor.persistence¶	object	—	Configuration options for Persistence.
harbor.persistence.disableRedirect¶	boolean	—	See note
harbor.persistence.type¶	string	—	See note
harbor.portal¶	object	—	Configuration options for Portal.
harbor.portal.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.portal.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.portal.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.portal.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.portal.replicas¶	number	`1`	—
harbor.portal.resources¶	object	—	See note
harbor.portal.resources.limits¶	object	—	—
harbor.portal.resources.requests¶	object	—	—
harbor.redis¶	object	—	See note
harbor.redis.external¶	object	—	Configuration options when external Redis is set
harbor.redis.external.addr¶	string	—	See note
harbor.redis.external.sentinelMasterSet¶	string	—	—
harbor.redis.internal¶	object	—	Configuration options when internal Redis is set
harbor.redis.internal.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.redis.internal.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.redis.internal.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.redis.internal.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.redis.internal.persistentVolumeClaim¶	object	—	PersistentVolumeClaim
harbor.redis.internal.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.redis.internal.resources¶	object	—	See note
harbor.redis.internal.resources.limits¶	object	—	—
harbor.redis.internal.resources.requests¶	object	—	—
harbor.redis.type¶	string	`internal`	—
harbor.registry¶	object	—	Registry configuration
harbor.registry.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.registry.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.registry.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.registry.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.registry.controller¶	object	—	Controller configuration
harbor.registry.controller.resources¶	object	—	See note
harbor.registry.controller.resources.limits¶	object	—	—
harbor.registry.controller.resources.requests¶	object	—	—
harbor.registry.persistentVolumeClaim¶	object	—	PersistentVolumeClaim
harbor.registry.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.registry.replicas¶	number	`1`	—
harbor.registry.resources¶	object	—	See note
harbor.registry.resources.limits¶	object	—	—
harbor.registry.resources.requests¶	object	—	—
harbor.s3¶	object	—	Configuration options for S3. Storage Driver S3
harbor.s3.multipartcopychunksize¶	-integer- -string-	—	Default chunk size for all but the last S3 Multipart Upload part when copying stored objects.
harbor.s3.multipartcopymaxconcurrency¶	-integer- -string-	—	Max number of concurrent S3 Multipart Upload operations when copying stored objects.
harbor.s3.multipartcopythresholdsize¶	string	`536870912`	Default object size above which S3 Multipart Upload will be used when copying stored objects.
harbor.subdomain¶	string	`harbor`	—
harbor.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
harbor.trivy¶	object	—	Configuration options for Trivy.
harbor.trivy.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
harbor.trivy.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
harbor.trivy.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
harbor.trivy.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
harbor.trivy.extraEnvVars[]¶	array of object	—	Array of additional environment variables to pass to Trivy name/value combination
harbor.trivy.persistentVolumeClaim¶	object	—	PersistentVolumeClaim
harbor.trivy.persistentVolumeClaim.size¶	string	`1Gi`	—
harbor.trivy.replicas¶	number	`1`	—
harbor.trivy.resources¶	object	—	See note
harbor.trivy.resources.limits¶	object	—	—
harbor.trivy.resources.requests¶	object	—	—

Notes for `harbor.core.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.database`

Configuration options for Database used by Harbor

Set type to define which type of redis Harbor should use.

Only external or internal database can be enabled at the same time.

External: Defines an external postgres that harbor will use. For more details how to configure harbor to use an external database check the README

Internal: Use the internal database that is packaged with harbor.

Notes for `harbor.database.external.sslmode`

Possible values:

disable

require

verify-ca

verify-full

Notes for `harbor.database.internal.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.exporter.external.coreDatabase`

Examples:

registry

Notes for `harbor.exporter.external.port`

Examples:

Notes for `harbor.exporter.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.gc.schedule`

Defines a CRON schedule when the garbage collection job should run. Uses a special Cron format that adds "seconds" as the first entry. Order: "seconds, minutes, hours, day of month, month, day of week".

Notes for `harbor.jobservice.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `harbor.notary.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.notarySigner.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.persistence.disableRedirect`

Controls whether or not Harbor registry redirects users to the object storage endpoint. Set this to true if the object storage is not reachable by users when pushing images to Harbor, e.g. if you run into this timeout error:

dial tcp <IP>:<PORT>: i/o timeout

Notes for `harbor.persistence.type`

This should match what is set in global config

Possible values:

filesystem

swift

objectStorage

Notes for `harbor.portal.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.redis`

Configuration options for Redis used by Harbor

Set type to define which type of redis Harbor should use.

Only external or internal redis can be enabled at the same time.

External: Defines an external redis that harbor will use. For more details how to configure harbor to use an external redis check the README

Internal: Use the internal redis that is packaged with harbor.

Notes for `harbor.redis.external.addr`

Examples:

rfs-redis-harbor.redis-system.svc.cluster.local:26379

Notes for `harbor.redis.internal.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.registry.controller.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.registry.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `harbor.trivy.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`hnc`¶

Configuration for Hierarchical Namespace Controller.

Note

See upstream documentation for reference.

Key	Type	Default	Description
hnc.additionalAllowPropagateResources[]¶	array of object	—	See note
hnc.enabled¶	boolean	`True`	Enable HNC
hnc.excludedNamespaces[]¶	array of string	—	See note
hnc.ha¶	boolean	`True`	Enable HA mode for hnc webhooks.
hnc.includedNamespacesRegex¶	string	—	See note
hnc.managedNamespaceAnnotations[]¶	array of string	—	Annotations that will be propagated to subnamespaces (allows regex).
hnc.managedNamespaceLabels[]¶	array of string	—	Labels that will be propagated to subnamespaces (allows regex). Labels in particular must also be configured in the HierarchyConfiguration object to be propagated.
hnc.manager¶	object	—	This is meant to describe the base class if you will, for Welkin resources.
hnc.manager.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
hnc.manager.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
hnc.manager.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
hnc.manager.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
hnc.manager.enabled¶	boolean	—	—
hnc.manager.extraArgs[]¶	array of string	—	Extra arguments passed to a container
hnc.manager.nodeSelector¶	object	—	See note
hnc.manager.resources¶	object	—	See note
hnc.manager.resources.limits¶	object	—	—
hnc.manager.resources.requests¶	object	—	—
hnc.manager.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
hnc.manager.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
hnc.serviceMonitor¶	object	—	Service monitor for Hierarchical Namespace Controller.
hnc.serviceMonitor.relabelings[]¶	array	—	Relabeling
hnc.unpropagatedAnnotations[]¶	array	—	Annotations that will be stripped from propagated objects
hnc.webhook¶	object	—	Webhook for Hierarchical Namespace Controller.
hnc.webhook.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
hnc.webhook.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
hnc.webhook.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
hnc.webhook.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
hnc.webhook.nodeSelector¶	object	—	See note
hnc.webhook.replicaCount¶	integer	—	—
hnc.webhook.resources¶	object	—	See note
hnc.webhook.resources.limits¶	object	—	—
hnc.webhook.resources.requests¶	object	—	—
hnc.webhook.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
hnc.webhook.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
hnc.webhookMatchConditions¶	boolean	—	Fine grained mach conditions for webhook. This feature is only available in Kubernetes v1.28+.

Notes for `hnc.additionalAllowPropagateResources[]`

Additional resources to enable opt-in propagation for. Objects that should be propagated must have one of the annotations listed here https://github.com/kubernetes-sigs/hierarchical-namespaces/blob/master/docs/user-guide/how-to.md#limit-the-propagation-of-an-object-to-descendant-namespaces

Additional allow propagate resources for hnc.

Examples:

{'resource': 'secrets'}

{'resource': 'networkpolicies', 'group': 'networking.k8s.io'}

Including and excluding namespaces

Notes for `hnc.excludedNamespaces[]`

Namespaces excluded by HNC, here you can configure a list of namespaces to exclude from HNC in addition to the default excluded namespaces.

Including and excluding namespaces

Notes for `hnc.includedNamespacesRegex`

Included namespaces, empty string will include all.

Notes for `hnc.manager.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `hnc.manager.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `hnc.webhook.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `hnc.webhook.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`images`¶

Configure individual container URI for images of all Welkin components, and (optionally) enable support for global registry and/or repository.

Key	Type	Default	Description
images.calico¶	object	—	calico stack image configuration
images.calico.accountant¶	string	—	See note
images.certManager¶	object	—	cert-manager stack image configuration
images.certManager.cainjector¶	string	—	See note
images.certManager.controller¶	string	—	See note
images.certManager.startupapicheck¶	string	—	See note
images.certManager.webhook¶	string	—	See note
images.dex¶	object	—	dex stack image configuration
images.dex.image¶	string	—	See note
images.externalDns¶	object	—	external-dns stack image configuration
images.externalDns.image¶	string	—	See note
images.falco¶	object	—	falco stack image configuration
images.falco.driverLoaderInit¶	string	—	See note
images.falco.falcoctl¶	string	—	See note
images.falco.image¶	string	—	See note
images.falco.sidekick¶	string	—	See note
images.fluentd¶	object	—	fluentd stack image configuration
images.fluentd.aggregator¶	string	—	See note
images.fluentd.forwarder¶	string	—	See note
images.fluentd.logManager¶	string	—	See note
images.gatekeeper¶	object	—	gatekeeper stack image configuration
images.gatekeeper.image¶	string	—	See note
images.gatekeeper.kubectl¶	string	—	See note
images.gatekeeper.postInstallLabelNamespace¶	string	—	See note
images.gatekeeper.preInstallCRDs¶	string	—	See note
images.global¶	object	—	See note
images.global.registry¶	object	—	If enabled it will be used as the registry of images that don't supply their own.
images.global.registry.enabled¶	boolean	—	—
images.global.registry.uri¶	string	—	See note
images.global.repository¶	object	—	If enabled it will be used as the repository of images that don't supply their own.
images.global.repository.enabled¶	boolean	—	—
images.global.repository.uri¶	string	—	See note
images.gpuOperator¶	object	—	gpu-operator stack image configuration
images.gpuOperator.nodeFeatureDiscovery¶	string	—	See note
images.gpuOperator.operator¶	string	—	See note
images.harbor¶	object	—	harbor stack image configuration
images.harbor.backupJob¶	string	—	See note
images.harbor.core¶	string	—	See note
images.harbor.database¶	string	—	See note
images.harbor.exporter¶	string	—	See note
images.harbor.initJob¶	string	—	See note
images.harbor.jobservice¶	string	—	See note
images.harbor.mpuCleaner¶	string	—	See note
images.harbor.portal¶	string	—	See note
images.harbor.redis¶	string	—	See note
images.harbor.registry¶	string	—	See note
images.harbor.registryController¶	string	—	See note
images.harbor.trivyAdapter¶	string	—	See note
images.hnc¶	object	—	hnc stack image configuration
images.hnc.image¶	string	—	See note
images.ingressNginx¶	object	—	ingress-nginx stack image configuration
images.ingressNginx.admissionWebhooksPatch¶	string	—	See note
images.ingressNginx.controller¶	string	—	See note
images.ingressNginx.controllerChroot¶	string	—	See note
images.ingressNginx.defaultBackend¶	string	—	See note
images.ingressNginx.fileCopier¶	string	—	See note
images.kured¶	object	—	kured stack image configuration
images.kured.image¶	string	—	See note
images.kyverno¶	object	—	kyverno stack image configuration
images.kyverno.crdsMigration¶	string	—	See note
images.kyverno.init¶	string	—	See note
images.kyverno.main¶	string	—	See note
images.kyverno.webhooksCleanup¶	string	—	See note
images.monitoring¶	object	—	monitoring stack image configuration
images.monitoring.admissionWebhooksPatch¶	string	—	See note
images.monitoring.alertmanager¶	string	—	See note
images.monitoring.blackboxExporter¶	string	—	See note
images.monitoring.configReloader¶	string	—	See note
images.monitoring.grafana¶	string	—	See note
images.monitoring.grafanaLabelEnforcer¶	string	—	See note
images.monitoring.grafanaSidecar¶	string	—	See note
images.monitoring.kubeStateMetrics¶	string	—	See note
images.monitoring.metricsServer¶	string	—	See note
images.monitoring.nodeExporter¶	string	—	See note
images.monitoring.prometheus¶	string	—	See note
images.monitoring.prometheusOperator¶	string	—	See note
images.monitoring.s3Exporter¶	string	—	See note
images.monitoring.trivyOperator¶	string	—	See note
images.nodeLocalDns¶	object	—	node-local-dns stack image configuration
images.nodeLocalDns.image¶	string	—	See note
images.opensearch¶	object	—	opensearch stack image configuration
images.opensearch.configurerJob¶	string	—	See note
images.opensearch.curatorCronjob¶	string	—	See note
images.opensearch.dashboards¶	string	—	See note
images.opensearch.exporter¶	string	—	See note
images.opensearch.image¶	string	—	See note
images.opensearch.initSysctl¶	string	—	See note
images.rclone¶	object	—	rclone stack image configuration
images.rclone.image¶	string	—	See note
images.tekton¶	object	—	tekton stack image configuration
images.tekton.controller¶	string	—	See note
images.tekton.remoteResolvers¶	string	—	See note
images.tekton.webhook¶	string	—	See note
images.thanos¶	object	—	thanos stack image configuration
images.thanos.image¶	string	—	See note
images.velero¶	object	—	velero stack image configuration
images.velero.image¶	string	—	See note
images.velero.kubectl¶	string	—	See note
images.velero.pluginAws¶	string	—	See note
images.velero.pluginAzure¶	string	—	See note
images.velero.pluginCsi¶	string	—	See note
images.velero.pluginGcp¶	string	—	See note

Notes for `images.calico.accountant`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.certManager.cainjector`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.certManager.controller`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.certManager.startupapicheck`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.certManager.webhook`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.dex.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.externalDns.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.falco.driverLoaderInit`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.falco.falcoctl`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.falco.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.falco.sidekick`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.fluentd.aggregator`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.fluentd.forwarder`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.fluentd.logManager`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gatekeeper.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gatekeeper.kubectl`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gatekeeper.postInstallLabelNamespace`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gatekeeper.preInstallCRDs`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.global`

Global image registry and repository settings.

If a global registry is supplied and enabled, and an image is specified that doesn't have a registry, the global registry will be used instead.

If a global repository is supplied and enabled, and an image is specified that doesn't have a repository, the global repository will be used instead.

Notes for `images.global.registry.uri`

Examples:

registry.k8s.io

Notes for `images.global.repository.uri`

Examples:

ingress-nginx

Notes for `images.gpuOperator.nodeFeatureDiscovery`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.gpuOperator.operator`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.backupJob`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.core`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.database`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.exporter`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.initJob`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.jobservice`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.mpuCleaner`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.portal`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.redis`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.registry`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.registryController`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.harbor.trivyAdapter`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.hnc.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.admissionWebhooksPatch`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.controller`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.controllerChroot`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.defaultBackend`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.ingressNginx.fileCopier`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kured.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kyverno.crdsMigration`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kyverno.init`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kyverno.main`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.kyverno.webhooksCleanup`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.admissionWebhooksPatch`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.alertmanager`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.blackboxExporter`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.configReloader`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.grafana`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.grafanaLabelEnforcer`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.grafanaSidecar`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.kubeStateMetrics`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.metricsServer`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.nodeExporter`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.prometheus`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.prometheusOperator`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.s3Exporter`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.monitoring.trivyOperator`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.nodeLocalDns.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.configurerJob`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.curatorCronjob`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.dashboards`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.exporter`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.opensearch.initSysctl`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.rclone.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.tekton.controller`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.tekton.remoteResolvers`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.tekton.webhook`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.thanos.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.image`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.kubectl`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.pluginAws`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.pluginAzure`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.pluginCsi`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

Notes for `images.velero.pluginGcp`

Examples:

registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

`ingressNginx`¶

Configure Ingress-NGINX, the ingress controller.

Key	Type	Default	Description
ingressNginx.controller¶	object	—	Configure the controller daemonset of Ingress-NGINX.
ingressNginx.controller.additionalConfig¶	object	—	See note
ingressNginx.controller.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
ingressNginx.controller.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
ingressNginx.controller.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
ingressNginx.controller.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
ingressNginx.controller.allowSnippetAnnotations¶	boolean	—	See note
ingressNginx.controller.chroot¶	boolean	`True`	See note
ingressNginx.controller.config¶	object	—	Configure the Ingress-NGINX controller.
ingressNginx.controller.config.annotationsRiskLevel¶	string	`Critical`	See note
ingressNginx.controller.config.useProxyProtocol¶	boolean	—	—
ingressNginx.controller.enableAnnotationValidations¶	boolean	`True`	When enabled annotations on Ingress resources are validated. This is disabled by default due to the maturity of the feature and lack of documentation.
ingressNginx.controller.enablepublishService¶	boolean	—	See note
ingressNginx.controller.extraArgs¶	object	—	Configure extra args to pass to Ingress NGINX Controller.
ingressNginx.controller.extraEnvs[]¶	array	—	Configure extra environment variables to Ingress NGINX Controller.
ingressNginx.controller.nodeSelector¶	object	—	See note
ingressNginx.controller.resources¶	object	—	See note
ingressNginx.controller.resources.limits¶	object	—	—
ingressNginx.controller.resources.requests¶	object	—	—
ingressNginx.controller.service¶	object	—	Configure the Service for traffic to Ingress-NGINX.
ingressNginx.controller.service.allocateLoadBalancerNodePorts¶	boolean	—	See note
ingressNginx.controller.service.annotations¶	object	—	—
ingressNginx.controller.service.clusterIP¶	string	—	—
ingressNginx.controller.service.enabled¶	boolean	—	—
ingressNginx.controller.service.internal¶	object	—	Configure the Internal Service for traffic to Ingress-NGINX.
ingressNginx.controller.service.internal.allocateLoadBalancerNodePorts¶	boolean	—	See note
ingressNginx.controller.service.internal.annotations¶	object	—	—
ingressNginx.controller.service.internal.clusterIP¶	string	—	—
ingressNginx.controller.service.internal.enabled¶	boolean	—	—
ingressNginx.controller.service.internal.ipFamilyPolicy¶	string	`SingleStack`	See note
ingressNginx.controller.service.internal.loadBalancerIP¶	string	—	See note
ingressNginx.controller.service.internal.loadBalancerSourceRanges[]¶	array of string	—	Configure the source ranges to allow via the Load Balancer Service.
ingressNginx.controller.service.internal.nodePorts¶	object	—	Configure the node ports to allocate for the Service.
ingressNginx.controller.service.internal.nodePorts.http¶	integer	—	—
ingressNginx.controller.service.internal.nodePorts.https¶	integer	—	—
ingressNginx.controller.service.internal.type¶	string	—	See note
ingressNginx.controller.service.ipFamilies[]¶	array of string	`['IPv4']`	See note
ingressNginx.controller.service.ipFamilyPolicy¶	string	`SingleStack`	See note
ingressNginx.controller.service.loadBalancerIP¶	string	—	See note
ingressNginx.controller.service.loadBalancerSourceRanges[]¶	array of string	—	Configure the source ranges to allow via the Load Balancer Service.
ingressNginx.controller.service.nodePorts¶	object	—	Configure the node ports to allocate for the Service.
ingressNginx.controller.service.nodePorts.http¶	integer	—	—
ingressNginx.controller.service.nodePorts.https¶	integer	—	—
ingressNginx.controller.service.type¶	string	—	See note
ingressNginx.controller.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
ingressNginx.controller.useHostPort¶	boolean	—	When enabled ingress traffic is directly forwarded from target ports on the nodes to reach Ingress-NGINX. This requires the namespace to use Pod Security Standard `privileged`.
ingressNginx.defaultBackend¶	object	—	Configure the default backend deployment of Ingress-NGINX.
ingressNginx.defaultBackend.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
ingressNginx.defaultBackend.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
ingressNginx.defaultBackend.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
ingressNginx.defaultBackend.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
ingressNginx.defaultBackend.nodeSelector¶	object	—	See note
ingressNginx.defaultBackend.resources¶	object	—	See note
ingressNginx.defaultBackend.resources.limits¶	object	—	—
ingressNginx.defaultBackend.resources.requests¶	object	—	—
ingressNginx.defaultBackend.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
ingressNginx.defaultBackend.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
ingressNginx.subDomain¶	string	—	—

Notes for `ingressNginx.controller.additionalConfig`

Configure additional configuration for Ingress-NGINX controller.

Note

See the upstream documentation for reference.

Notes for `ingressNginx.controller.allowSnippetAnnotations`

When enabled annotations on Ingress resources can add snippets to the config of NGINX.

[!danger] Only enable this after evaluating the risks it poses.

Note

See the upstream documentation for reference.

Notes for `ingressNginx.controller.chroot`

When enabled NGINX itself will run in a chroot under the controller namespace for increased separation between the controller and the proxy.

This requires a special seccomp profile to be available to give the controller the SYS_ADMIN capability, which will be provided by a separate daemon set.

Notes for `ingressNginx.controller.config.annotationsRiskLevel`

Configure the accepted risk level of annotations on Ingress resources.

Note

See the upstream documentation for reference.

Possible values:

Critical

High

Medium

Low

Notes for `ingressNginx.controller.enablepublishService`

When enabled it allows customisation of the IP or FQDN to report the external address of the Service in the Ingress status field.

When disabled it reports the IPs of the nodes where the controller pods are running.

Notes for `ingressNginx.controller.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `ingressNginx.controller.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `ingressNginx.controller.service.allocateLoadBalancerNodePorts`

When enabled node ports will be allocated for the Load Balancer Service.

This should be enabled when the cluster is fronted by a proxy load balancer regardless if it is external or internal, and disabled if the cluster uses direct routing of ingress traffic.

See reference

Notes for `ingressNginx.controller.service.internal.allocateLoadBalancerNodePorts`

When enabled node ports will be allocated for the Load Balancer Service.

This should be enabled when the cluster is fronted by a proxy load balancer regardless if it is external or internal, and disabled if the cluster uses direct routing of ingress traffic.

See reference

Notes for `ingressNginx.controller.service.internal.ipFamilyPolicy`

Represents the dual-stack-ness requested or required by this Service. When utilizing an internal loadbalancer service (ie MetalLB), set this field to "RequireDualStack" if you want both IPv4 and IPv6 connectivity. The ipFamilies and clusterIPs fields depend on the value of this field.

See reference

Possible values:

SingleStack

PreferDualStack

RequireDualStack

Notes for `ingressNginx.controller.service.internal.loadBalancerIP`

Configure the Load Balancer IP to use an existing IP if supported by the infrastructure provider.

Important

With OpenStack Octavia the floating IP can be created via the CLI beforehand, and one should set the annotation loadbalancer.openstack.org/keep-floatingip: "true" to prevent the floating IP to be deleted.

Notes for `ingressNginx.controller.service.internal.type`

Configure the type of the Service.

Possible values:

ClusterIP

LoadBalancer

NodePort

Notes for `ingressNginx.controller.service.ipFamilies[]`

List of IP families (e.g. IPv4, IPv6) assigned to the service. Default is IPv4 only. When utilizing an internal loadbalancer service (ie MetalLB), IPv6 would also need to be included in order for the ingress service to allocate an address in that family.

Notes for `ingressNginx.controller.service.ipFamilyPolicy`

Represents the dual-stack-ness requested or required by this Service. When utilizing an internal loadbalancer service (ie MetalLB), set this field to "RequireDualStack" if you want both IPv4 and IPv6 connectivity. The ipFamilies and clusterIPs fields depend on the value of this field.

See reference

Possible values:

SingleStack

PreferDualStack

RequireDualStack

Notes for `ingressNginx.controller.service.loadBalancerIP`

Configure the Load Balancer IP to use an existing IP if supported by the infrastructure provider.

Important

With OpenStack Octavia the floating IP can be created via the CLI beforehand, and one should set the annotation loadbalancer.openstack.org/keep-floatingip: "true" to prevent the floating IP to be deleted.

Notes for `ingressNginx.controller.service.type`

Configure the type of the Service.

Possible values:

ClusterIP

LoadBalancer

NodePort

Notes for `ingressNginx.defaultBackend.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `ingressNginx.defaultBackend.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`issuers`¶

Configure issuers for cert-manager.

Key	Type	Default	Description
issuers.extraIssuers[]¶	array	—	—
issuers.letsencrypt¶	object	—	Configure issuers for cert-manager using Let's Encrypt.
issuers.letsencrypt.enabled¶	boolean	`True`	—
issuers.letsencrypt.prod¶	object	—	Configure Let's Encrypt production issuer.
issuers.letsencrypt.prod.solvers[]¶	array	—	—
issuers.letsencrypt.staging¶	object	—	Configure Let's Encrypt staging issuer.
issuers.letsencrypt.staging.solvers[]¶	array	—	—

`kubeStateMetrics`¶

Configure the kube-state-metrics exporter.

Key	Type	Default	Description
kubeStateMetrics.resources¶	object	—	See note
kubeStateMetrics.resources.limits¶	object	—	—
kubeStateMetrics.resources.requests¶	object	—	—

Notes for `kubeStateMetrics.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`kured`¶

Configuration for Kured (Kubernetes Reboot Daemon).

Kured orchestrates node reboots to allow nodes to automatically perform system updates and patches.

Key	Type	Default	Description
kured.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
kured.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
kured.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
kured.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
kured.configuration¶	object	—	See note
kured.configuration.drainTimeout¶	string	—	See note
kured.configuration.endTime¶	string	`86399`	Schedule reboots only before this time of day.
kured.configuration.lockReleaseDelay¶	string	—	See note
kured.configuration.period¶	string	—	See note
kured.configuration.rebootDays[]¶	array of string	`['mo', 'tu', 'we', 'th', 'fr', 'sa', 'su']`	Only reboot on these days.
kured.configuration.startTime¶	string	`0:00`	Schedule reboots only after this time of day.
kured.configuration.timeZone¶	string	`UTC`	—
kured.dsAnnotations¶	object	—	—
kured.enabled¶	boolean	—	—
kured.extraArgs[]¶	array of string	—	Extra arguments passed to a container
kured.extraEnvVars¶	object	—	—
kured.metrics¶	object	—	Configuration for Kured metrics
kured.metrics.enabled¶	boolean	`True`	—
kured.metrics.interval¶	string	—	See note
kured.metrics.labels¶	object	—	—
kured.nodeSelector¶	object	—	See note
kured.notification¶	object	—	Send notification from Kured when nodes are rebooted.
kured.notification.slack¶	object	—	Send notification from Kured to Slack when nodes are rebooted.
kured.notification.slack.channel¶	string	—	—
kured.notification.slack.enabled¶	boolean	—	—
kured.resources¶	object	—	See note
kured.resources.limits¶	object	—	—
kured.resources.requests¶	object	—	—
kured.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration

Notes for `kured.configuration`

Kured configuration parameters.

See the upstream documentation for reference. Most parameters are mapped from camelCase to --kebab-case, others can be set via extraArgs.

Notes for `kured.configuration.drainTimeout`

A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `kured.configuration.lockReleaseDelay`

A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `kured.configuration.period`

A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `kured.metrics.interval`

A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `kured.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `kured.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`kyverno`¶

Configure Kyverno and Kyverno Policies

Key	Type	Default	Description
kyverno.enabled¶	boolean	—	—
kyverno.nodeAffinity¶	object	—	Affinity is a group of affinity scheduling rules.
kyverno.nodeAffinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
kyverno.nodeAffinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
kyverno.nodeAffinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
kyverno.nodeSelector¶	object	—	See note
kyverno.podAffinity¶	object	—	Affinity is a group of affinity scheduling rules.
kyverno.podAffinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
kyverno.podAffinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
kyverno.podAffinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
kyverno.policies¶	object	—	Kyverno policies configuration
kyverno.policies.verifyImageSignature¶	object	—	A policy that requires that all images in HNC controlled namespaces are signed
kyverno.policies.verifyImageSignature.attestor¶	string	—	See note
kyverno.policies.verifyImageSignature.enabled¶	boolean	—	—
kyverno.policies.verifyImageSignature.ignoreRekorTlog¶	boolean	—	—
kyverno.policies.verifyImageSignature.type¶	string	—	See note
kyverno.resources¶	object	—	See note
kyverno.resources.limits¶	object	—	—
kyverno.resources.requests¶	object	—	—
kyverno.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
kyverno.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.

Notes for `kyverno.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `kyverno.policies.verifyImageSignature.attestor`

A public key (Cosign) or certificate (Notary) used to verify image signatures

Examples:

-----BEGIN PUBLIC KEY-----
MFkwEwY...
-----END PUBLIC KEY-----

-----BEGIN CERTIFICATE-----
MIIDTTCCA...
-----END CERTIFICATE-----

Notes for `kyverno.policies.verifyImageSignature.type`

Possible values:

Cosign

Notary

Notes for `kyverno.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`metricsServer`¶

Configure the metrics-server exporter, used to provide for the metrics API in Kubernetes.

Key	Type	Default	Description
metricsServer.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
metricsServer.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
metricsServer.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
metricsServer.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
metricsServer.enabled¶	boolean	`True`	—
metricsServer.resources¶	object	—	See note
metricsServer.resources.limits¶	object	—	—
metricsServer.resources.requests¶	object	—	—
metricsServer.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration

Notes for `metricsServer.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`networkPlugin`¶

Configure the network plugin used in the cluster.

Key	Type	Default	Description
networkPlugin.calico¶	object	—	Configuration when network plugin is set to calico
networkPlugin.calico.calicoAccountant¶	object	—	Configure Calico accountant, used to collect metrics about packets affected by Network Policies when using Calico.
networkPlugin.calico.calicoAccountant.backend¶	string	`nftables`	See note
networkPlugin.calico.calicoAccountant.enabled¶	boolean	`True`	—
networkPlugin.calico.calicoAccountant.resources¶	object	—	See note
networkPlugin.calico.calicoAccountant.resources.limits¶	object	—	—
networkPlugin.calico.calicoAccountant.resources.requests¶	object	—	—
networkPlugin.calico.calicoAccountant.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
networkPlugin.calico.calicoFelixMetrics¶	object	—	Configure Calico Felix metrics, used to collect metrics about Calico.
networkPlugin.calico.calicoFelixMetrics.enabled¶	boolean	`True`	—
networkPlugin.type¶	string	—	See note

Notes for `networkPlugin.calico.calicoAccountant.backend`

Possible values:

iptables

nftables

Notes for `networkPlugin.calico.calicoAccountant.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `networkPlugin.type`

Configure the type of network plugin

Possible values:

calico

cilium

`networkPolicies`¶

Configure Network Policies.

Most common Network Policy rules can be updated by running ./bin/ck8s update-ips <both|sc|wc>.

Key	Type	Default	Description
networkPolicies.additional¶	string	—	Configure additional network policies.
networkPolicies.additionalEgressPolicies[]¶	array	—	—
networkPolicies.additionalIngressPolicies[]¶	array	—	—
networkPolicies.alertmanager¶	object	—	Configure Alertmanager network policy rules.
networkPolicies.alertmanager.alertReceivers¶	object	—	Network policy rule Kubernetes network policies
networkPolicies.alertmanager.alertReceivers.enabled¶	boolean	—	—
networkPolicies.alertmanager.alertReceivers.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.alertmanager.alertReceivers.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.alertmanager.enabled¶	boolean	—	—
networkPolicies.allowedNameSpaces[]¶	array	—	—
networkPolicies.certManager¶	object	—	Configure cert-manager network policy rules.
networkPolicies.certManager.dns01¶	object	—	Configure network policy rule to allow cert-manager perform DNS-01 challenges.
networkPolicies.certManager.dns01.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.certManager.enabled¶	boolean	`True`	—
networkPolicies.certManager.http01¶	object	—	Configure network policy rule to allow cert-manager perform HTTP-01 challenges on other endpoints than the ingress-controller.
networkPolicies.certManager.http01.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.certManager.letsencrypt¶	object	—	See note
networkPolicies.certManager.namespaces[]¶	array of string	—	See note
networkPolicies.coredns¶	object	—	Configure CoreDNS network policy rules.
networkPolicies.coredns.enabled¶	boolean	`True`	—
networkPolicies.coredns.externalDns¶	object	—	Configure network policy rule to allow CoreDNS to query the upstream DNS servers.
networkPolicies.coredns.serviceIp¶	object	—	Configure network policy rule to allow CoreDNS to query the internal service IP.
networkPolicies.defaultDeny¶	boolean	—	—
networkPolicies.dex¶	object	—	Configure Dex network policy rules.
networkPolicies.dex.connectors¶	object	—	Configure network policy rule to allow Dex to reach configured connectors.
networkPolicies.dex.connectors.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.dex.enabled¶	boolean	`True`	—
networkPolicies.dnsAutoscaler¶	object	—	Configure DNS Autoscaler network policy rules.
networkPolicies.dnsAutoscaler.enabled¶	boolean	`True`	—
networkPolicies.enableAlerting¶	boolean	`True`	—
networkPolicies.enabled¶	boolean	`True`	—
networkPolicies.externalDns¶	object	—	Configure ExternalDNS network policy rules.
networkPolicies.externalDns.enabled¶	boolean	—	—
networkPolicies.externalDns.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.falco¶	object	—	Configure Falco network policy rules.
networkPolicies.falco.enabled¶	boolean	`True`	—
networkPolicies.falco.plugins¶	object	—	Configure network policy rules to allow Falco to install plugins during startup.
networkPolicies.falco.plugins.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.fluentd¶	object	—	Configure Fluentd network policy rules.
networkPolicies.fluentd.enabled¶	boolean	`True`	—
networkPolicies.fluentd.extraOutput¶	object	—	Configure extra output egress rules. This may be used to allow application developers to send logs externally from user Fluentd with extra config and plugins.
networkPolicies.fluentd.extraOutput.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.fluentd.extraOutput.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.gatekeeper¶	object	—	Configure Gatekeeper network policy rules.
networkPolicies.gatekeeper.enabled¶	boolean	`True`	—
networkPolicies.global¶	object	—	Configure global network policy rules.
networkPolicies.global.externalLoadBalancer¶	boolean	—	When enabled create Network Policy rules for ingress via external load balancer.
networkPolicies.global.ingressUsingHostNetwork¶	boolean	—	When enabled create Network Policy rules for ingress via host network.
networkPolicies.global.objectStorage¶	object	—	See note
networkPolicies.global.objectStorage.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.global.objectStorage.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.global.objectStorageSwift¶	object	—	See note
networkPolicies.global.objectStorageSwift.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.global.scApiserver¶	object	—	See note
networkPolicies.global.scApiserver.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.global.scApiserver.port¶	integer	—	—
networkPolicies.global.scIngress¶	object	—	See note
networkPolicies.global.scIngress.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.global.scNodes¶	object	—	See note
networkPolicies.global.scNodes.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.global.trivy¶	object	—	Configure Trivy network policy rules. Used for Trivy to fetch vulnerability databases both in Harbor and Trivy Operator.
networkPolicies.global.trivy.port¶	integer	—	—
networkPolicies.global.wcApiserver¶	object	—	See note
networkPolicies.global.wcApiserver.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.global.wcApiserver.port¶	integer	—	—
networkPolicies.global.wcIngress¶	object	—	See note
networkPolicies.global.wcIngress.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.global.wcNodes¶	object	—	See note
networkPolicies.global.wcNodes.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.harbor¶	object	—	Configure Harbor network policy rules.
networkPolicies.harbor.database¶	object	—	Configure network policies for the database used by Harbor.
networkPolicies.harbor.database.externalEgress¶	object	—	Configure network policy egress rules to the external database of Harbor.
networkPolicies.harbor.database.externalEgress.peers[]¶	array	—	—
networkPolicies.harbor.database.externalEgress.ports[]¶	array	—	—
networkPolicies.harbor.database.internalIngress¶	object	—	Configure network policy ingress rules to the internal database of Harbor.
networkPolicies.harbor.database.internalIngress.peers[]¶	array	—	—
networkPolicies.harbor.database.internalIngress.ports[]¶	array	—	—
networkPolicies.harbor.enabled¶	boolean	`True`	—
networkPolicies.harbor.jobservice¶	object	—	Configure network policies for the job service in Harbor.
networkPolicies.harbor.jobservice.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.harbor.redis¶	object	—	Configure network policies for the Redis used by Harbor.
networkPolicies.harbor.redis.externalEgress¶	object	—	Configure network policy egress rules to the external Redis of Harbor.
networkPolicies.harbor.redis.externalEgress.peers[]¶	array	—	—
networkPolicies.harbor.redis.externalEgress.ports[]¶	array	—	—
networkPolicies.harbor.registries¶	object	—	Configure network policies for external registries used by Harbor. Applies to harbor-core and harbor-jobservice when replication is enabled.
networkPolicies.harbor.registries.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.harbor.trivy¶	object	—	Configure network policies for the Trivy scanner in Harbor.
networkPolicies.harbor.trivy.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.ingressNginx¶	object	—	Configure Ingress NGINX network policy rules.
networkPolicies.ingressNginx.enabled¶	boolean	`True`	—
networkPolicies.ingressNginx.ingressOverride¶	object	—	Configure override to the ingress rules for Ingress NGINX. Required when cluster ingress uses direct routing.
networkPolicies.ingressNginx.ingressOverride.enabled¶	boolean	—	—
networkPolicies.kubeSystem¶	object	—	Configure kube-system network policy rules.
networkPolicies.kubeSystem.enabled¶	boolean	`True`	—
networkPolicies.kubeSystem.openstack¶	object	—	Configure OpenStack network policy rules.
networkPolicies.kubeSystem.openstack.enabled¶	boolean	—	—
networkPolicies.kubeSystem.openstack.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.kubeSystem.openstack.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.kubeSystem.upcloud¶	object	—	Configure UpCloud network policy rules.
networkPolicies.kubeSystem.upcloud.enabled¶	boolean	—	—
networkPolicies.kubeSystem.upcloud.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.kubeSystem.upcloud.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.kured¶	object	—	Configure Kured network policy rules.
networkPolicies.kured.enabled¶	boolean	`True`	—
networkPolicies.kured.notificationSlack¶	object	—	Configure network policy rules to allow Kured to send Slack notifications.
networkPolicies.kured.notificationSlack.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.kyverno¶	object	—	Configure Kyverno network policy rules.
networkPolicies.kyverno.enabled¶	boolean	`True`	—
networkPolicies.kyverno.imageRegistry¶	object	—	Configure network policy that allows Kyverno to access image registries. This is required for signed image verification.
networkPolicies.monitoring¶	object	—	Configure monitoring network policy rules.
networkPolicies.monitoring.enabled¶	boolean	`True`	—
networkPolicies.monitoring.grafana¶	object	—	Configure Grafana network policy rules.
networkPolicies.monitoring.grafana.externalDashboardProvider¶	object	—	Configure network policy rules to allow Grafana to use external dashboards.
networkPolicies.monitoring.grafana.externalDashboardProvider.ips[]¶	array of string	—	List of IP netmasks A IP address with netmask
networkPolicies.monitoring.grafana.externalDashboardProvider.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.monitoring.grafana.externalDataSources¶	object	—	Configure network policy rules to allow Grafana to use external datasources.
networkPolicies.monitoring.grafana.externalDataSources.enabled¶	boolean	—	—
networkPolicies.opensearch¶	object	—	Configure OpenSearch network policy rules.
networkPolicies.opensearch.enabled¶	boolean	`True`	—
networkPolicies.opensearch.plugins¶	object	—	Configure network policy rules to allow OpenSearch to install plugins during startup.
networkPolicies.opensearch.plugins.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.prometheus¶	object	—	Configure Prometheus network policy rules.
networkPolicies.prometheus.internalAccess¶	object	—	See note
networkPolicies.prometheus.internalAccess.enabled¶	boolean	—	—
networkPolicies.prometheus.internalAccess.namespaces[]¶	array of string	—	Configure the namespaces to allow internal access to Prometheus.
networkPolicies.rclone¶	object	—	Configure Rclone network policy rules.
networkPolicies.rclone.enabled¶	boolean	—	—
networkPolicies.rclone.sync¶	object	—	Configure network policy rules to allow rclone to sync.
networkPolicies.rclone.sync.objectStorage¶	object	—	Configure network policy rules to allow rclone to sync object storage.
networkPolicies.rclone.sync.objectStorage.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.rclone.sync.objectStorageSwift¶	object	—	Configure network policy rules to allow rclone to sync object storage with Swift.
networkPolicies.rclone.sync.objectStorageSwift.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.rclone.sync.secondaryUrl¶	object	—	Configure network policy rules to allow rclone to sync with a secondary URL.
networkPolicies.rclone.sync.secondaryUrl.ports[]¶	array of integer	—	A 16 bit unsigned integer
networkPolicies.rookCeph¶	object	—	Configure Rook Ceph network policy rules.
networkPolicies.rookCeph.enabled¶	boolean	—	—
networkPolicies.s3Exporter¶	object	—	Configure S3 exporter network policy rules.
networkPolicies.s3Exporter.enabled¶	boolean	`True`	—
networkPolicies.tektonPipelines¶	object	—	Enable network policies for tekton and the pipeline.
networkPolicies.tektonPipelines.enabled¶	boolean	`True`	—
networkPolicies.tektonPipelines.pipeline¶	object	—	See note
networkPolicies.thanos¶	object	—	Configure Thanos network policy rules.
networkPolicies.thanos.enabled¶	boolean	`True`	—
networkPolicies.velero¶	object	—	Configure Velero network policy rules.
networkPolicies.velero.enabled¶	boolean	`True`	—

Notes for `networkPolicies.certManager.letsencrypt`

Configure network policy rule to allow cert-manager to reach Let's Encrypt.

Note

Let's Encrypt by choice does not publish a list of their endpoints, so this is required to be ips: [ 0.0.0.0/0 ].

Notes for `networkPolicies.certManager.namespaces[]`

Configure namespaces to allow cert-manager HTTP-01 perform HTTP-01 challenges.

Examples:

['dex', 'harbor', 'monitoring', 'opensearch-system', 'thanos']

Notes for `networkPolicies.global.objectStorage`

Configure object storage network policy rules.

This configuration should match the object storage service configured under objectStorage.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.objectStorageSwift`

Configure OpenStack Swift object storage network policy rules.

This configuration should match the object storage service configured under objectStorage.swift if used by any component.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.scApiserver`

Configure service cluster API server network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.scIngress`

Configure service cluster ingress network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.scNodes`

Configure service cluster nodes network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.wcApiserver`

Configure workload cluster API server network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.wcIngress`

Configure workload cluster ingress network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.global.wcNodes`

Configure workload cluster nodes network policy rules.

Tip

Automatically populated by ./bin/ck8s update-ips <both|sc|wc>.

Notes for `networkPolicies.prometheus.internalAccess`

Configure network policy rules to allow internal access to Prometheus.

This requires the allowed namespaces to be configured under namespaces and the allowed pods to be labeled elastisys.io/prometheus-access: allowed.

Notes for `networkPolicies.tektonPipelines.pipeline`

Add required networkpolicies for the pipeline under the section pipeline.

The networkpolicies should follow the network policies generator. As such, it is possible to use pre-defined network policies rules. The pre-defined rules can be found here.

  pipeline:
    clone-config-pod:
      podSelectorLabels:
        tekton.dev/pipeline: upgrade-pipeline
      ingress: {}
      egress:
        - rule: egress-rule-dns # pre-defined network policies rule.
        - name: egress-rule-config-access
          peers:
            - cidr: 1.2.3.4/32
          ports:
            - tcp: 22

`nodeLocalDns`¶

Configure node-local-dns, node local DNS resolving and caching.

Key	Type	Default	Description
nodeLocalDns.customConfig¶	string	—	See note
nodeLocalDns.hostZone¶	object	—	Configure the host zone for node-local-dns
nodeLocalDns.hostZone.extraConfig¶	string	—	See note
nodeLocalDns.resources¶	object	—	See note
nodeLocalDns.resources.limits¶	object	—	—
nodeLocalDns.resources.requests¶	object	—	—

Notes for `nodeLocalDns.customConfig`

Configure custom options for the CoreDNS instance running as part of node-local-dns.

Note

See the upstream documentation for reference.

Examples:

example.com:53 {
  errors
  cache 30
  reload
  loop
  forward . 127.0.0.1:9005
}

Notes for `nodeLocalDns.hostZone.extraConfig`

Configure extra config for the host zone .53 for node-local-dns.

Note

See the upstream documentation for reference.

Examples:

template ANY ANY {
  rcode NXDOMAIN
}

Notes for `nodeLocalDns.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`objectStorage`¶

Configuration options for using object storage in Welkin

This is used for:

Fluentd audit logs
Fluentd service cluster logs
Harbor database backups and registry storage
OpenSearch workload cluster log snapshots
Rclone object storage sync source and restore destination
Thanos metrics storage
Velero resource backups and volume snapshots

Harbor, Rclone, and Thanos have additional configuration to use Swift.

Key	Type	Default	Description
objectStorage.azure¶	object	—	Only supports Azure Public Cloud.
objectStorage.azure.resourceGroup¶	string	—	Resource group of the storage account.
objectStorage.azure.storageAccountName¶	string	—	Name of the storage account
objectStorage.buckets¶	object	—	See note
objectStorage.restore¶	object	—	See note
objectStorage.restore.addTargetsFromSync¶	boolean	—	Automatically configure the restore from a secondary site to the primary site. Essentially this will configure Rclone restore to do the inverse of Rclone sync.
objectStorage.restore.decrypt¶	object	—	Encrypt data when syncing and decrypt data when restoring.
objectStorage.restore.decrypt.directoryNames¶	boolean	—	Encrypt directory names when syncing, requires file names to be encrypted.
objectStorage.restore.decrypt.enabled¶	boolean	—	—
objectStorage.restore.decrypt.fileNames¶	boolean	—	Encrypt file names when syncing.
objectStorage.restore.destinations¶	object	—	Allows for complete or partial overrides of the destinations of the restore, the main object storage configuration.
objectStorage.restore.destinations.azure¶	object	—	Only supports Azure Public Cloud.
objectStorage.restore.destinations.azure.resourceGroup¶	string	—	Resource group of the storage account.
objectStorage.restore.destinations.azure.storageAccountName¶	string	—	Name of the storage account
objectStorage.restore.destinations.s3¶	object	—	Configurations for using S3 storage.
objectStorage.restore.destinations.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
objectStorage.restore.destinations.s3.region¶	string	—	Region to store data.
objectStorage.restore.destinations.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
objectStorage.restore.destinations.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
objectStorage.restore.destinations.swift¶	object	—	> [!note] > Supported as an option only for Harbor, Rclone, and Thanos.
objectStorage.restore.destinations.swift.authUrl¶	string	—	OpenStack authentication URL. Make sure to prepend the protocol (e.g. `https://`) and append the authentication version (e.g. `/v3`).
objectStorage.restore.destinations.swift.authVersion¶	integer	—	OpenStack authentication version. Set `0` for auto detect from authentication url.
objectStorage.restore.destinations.swift.domainId¶	string	—	The user domain ID to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.restore.destinations.swift.domainName¶	string	—	The user domain name to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.restore.destinations.swift.projectDomainId¶	string	—	The project domain ID to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.restore.destinations.swift.projectDomainName¶	string	—	The project domain name to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.restore.destinations.swift.projectId¶	string	—	The project ID to use. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.restore.destinations.swift.projectName¶	string	—	The project name to use, requires project domain to be set. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.restore.destinations.swift.region¶	string	—	OpenStack region.
objectStorage.restore.destinations.swift.segmentsContainerSuffix¶	string	`+segments`	The container suffix to use for segment containers. These are created to store large objects with SLOs/DLOs, and with s3api middleware for multipart uploads.
objectStorage.restore.dryrun¶	boolean	—	Deploy Rclone with dryrun enabled.
objectStorage.restore.enabled¶	boolean	—	—
objectStorage.restore.sources¶	object	—	Allows for complete or partial overrides of the sources of the restore, the sync object storage configuration.
objectStorage.restore.sources.azure¶	object	—	Only supports Azure Public Cloud.
objectStorage.restore.sources.azure.resourceGroup¶	string	—	Resource group of the storage account.
objectStorage.restore.sources.azure.storageAccountName¶	string	—	Name of the storage account
objectStorage.restore.sources.s3¶	object	—	Configurations for using S3 storage.
objectStorage.restore.sources.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
objectStorage.restore.sources.s3.region¶	string	—	Region to store data.
objectStorage.restore.sources.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
objectStorage.restore.sources.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
objectStorage.restore.sources.swift¶	object	—	> [!note] > Supported as an option only for Harbor, Rclone, and Thanos.
objectStorage.restore.sources.swift.authUrl¶	string	—	OpenStack authentication URL. Make sure to prepend the protocol (e.g. `https://`) and append the authentication version (e.g. `/v3`).
objectStorage.restore.sources.swift.authVersion¶	integer	—	OpenStack authentication version. Set `0` for auto detect from authentication url.
objectStorage.restore.sources.swift.domainId¶	string	—	The user domain ID to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.restore.sources.swift.domainName¶	string	—	The user domain name to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.restore.sources.swift.projectDomainId¶	string	—	The project domain ID to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.restore.sources.swift.projectDomainName¶	string	—	The project domain name to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.restore.sources.swift.projectId¶	string	—	The project ID to use. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.restore.sources.swift.projectName¶	string	—	The project name to use, requires project domain to be set. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.restore.sources.swift.region¶	string	—	OpenStack region.
objectStorage.restore.sources.swift.segmentsContainerSuffix¶	string	`+segments`	The container suffix to use for segment containers. These are created to store large objects with SLOs/DLOs, and with s3api middleware for multipart uploads.
objectStorage.restore.targets[]¶	array of object	—	Targets to restore Details of a bucket to restore.
objectStorage.restore.timestamp¶	string	—	Perform point-in-time restore if possible. This is only supported for S3 sources.
objectStorage.s3¶	object	—	Configurations for using S3 storage.
objectStorage.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
objectStorage.s3.region¶	string	—	Region to store data.
objectStorage.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
objectStorage.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
objectStorage.swift¶	object	—	> [!note] > Supported as an option only for Harbor, Rclone, and Thanos.
objectStorage.swift.authUrl¶	string	—	OpenStack authentication URL. Make sure to prepend the protocol (e.g. `https://`) and append the authentication version (e.g. `/v3`).
objectStorage.swift.authVersion¶	integer	—	OpenStack authentication version. Set `0` for auto detect from authentication url.
objectStorage.swift.domainId¶	string	—	The user domain ID to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.swift.domainName¶	string	—	The user domain name to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.swift.projectDomainId¶	string	—	The project domain ID to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.swift.projectDomainName¶	string	—	The project domain name to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.swift.projectId¶	string	—	The project ID to use. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.swift.projectName¶	string	—	The project name to use, requires project domain to be set. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.swift.region¶	string	—	OpenStack region.
objectStorage.swift.segmentsContainerSuffix¶	string	`+segments`	The container suffix to use for segment containers. These are created to store large objects with SLOs/DLOs, and with s3api middleware for multipart uploads.
objectStorage.sync¶	object	—	Sync object storage from the primary site to a secondary site with Rclone.
objectStorage.sync.activeDeadlineSeconds¶	number	`14400`	The maximum amount of time that the Rclone job is allowed to run (in seconds).
objectStorage.sync.azure¶	object	—	Only supports Azure Public Cloud.
objectStorage.sync.azure.resourceGroup¶	string	—	Resource group of the storage account.
objectStorage.sync.azure.storageAccountName¶	string	—	Name of the storage account
objectStorage.sync.buckets[]¶	array of object	—	Additional buckets to sync. List of buckets to sync when `syncDefaultBuckets` is false
objectStorage.sync.defaultSchedule¶	string	—	—
objectStorage.sync.destinationType¶	string	—	See note
objectStorage.sync.dryrun¶	boolean	—	Deploy Rclone with dryrun enabled.
objectStorage.sync.enabled¶	boolean	—	—
objectStorage.sync.encrypt¶	object	—	Encrypt data when syncing and decrypt data when restoring.
objectStorage.sync.encrypt.directoryNames¶	boolean	—	Encrypt directory names when syncing, requires file names to be encrypted.
objectStorage.sync.encrypt.enabled¶	boolean	—	—
objectStorage.sync.encrypt.fileNames¶	boolean	—	Encrypt file names when syncing.
objectStorage.sync.resources¶	object	—	See note
objectStorage.sync.resources.limits¶	object	—	—
objectStorage.sync.resources.requests¶	object	—	—
objectStorage.sync.s3¶	object	—	Configurations for using S3 storage.
objectStorage.sync.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
objectStorage.sync.s3.region¶	string	—	Region to store data.
objectStorage.sync.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
objectStorage.sync.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
objectStorage.sync.secondaryUrl¶	string	—	—
objectStorage.sync.sourceType¶	string	—	See note
objectStorage.sync.swift¶	object	—	> [!note] > Supported as an option only for Harbor, Rclone, and Thanos.
objectStorage.sync.swift.authUrl¶	string	—	OpenStack authentication URL. Make sure to prepend the protocol (e.g. `https://`) and append the authentication version (e.g. `/v3`).
objectStorage.sync.swift.authVersion¶	integer	—	OpenStack authentication version. Set `0` for auto detect from authentication url.
objectStorage.sync.swift.domainId¶	string	—	The user domain ID to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.sync.swift.domainName¶	string	—	The user domain name to use. User domain is required when authenticating with `username`, set either `domainId` or `domainName`.
objectStorage.sync.swift.projectDomainId¶	string	—	The project domain ID to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.sync.swift.projectDomainName¶	string	—	The project domain name to use. Project domain is required when authenticating with `projectName`, set either `projectDomainId` or `projectDomainName`.
objectStorage.sync.swift.projectId¶	string	—	The project ID to use. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.sync.swift.projectName¶	string	—	The project name to use, requires project domain to be set. Project is required when authenticating with `username`, set either `projectId` or `projectName`.
objectStorage.sync.swift.region¶	string	—	OpenStack region.
objectStorage.sync.swift.segmentsContainerSuffix¶	string	`+segments`	The container suffix to use for segment containers. These are created to store large objects with SLOs/DLOs, and with s3api middleware for multipart uploads.
objectStorage.sync.syncDefaultBuckets¶	boolean	—	Sync the buckets or containers set under `.objectStorage.buckets`.
objectStorage.type¶	string	—	See note

Notes for `objectStorage.buckets`

Buckets or containers for each respective application to use for application data or backup storage.

Keys are used as identifiers for buckets or containers, while the values are used as the bucket or container name.

Additional entries added here will have monitoring enabled.

Notes for `objectStorage.restore`

Restore object storage from a secondary site to the primary site with Rclone.

Note

When enabled this will disable Rclone sync to prevent it from modifying the secondary site.

Notes for `objectStorage.sync.destinationType`

Object storage type to use.

Possible values:

azure

gcs

s3

swift

Notes for `objectStorage.sync.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `objectStorage.sync.sourceType`

Object storage type to use. Defaults to .objectStorage.type

Examples:

azure

gcs

s3

swift

Notes for `objectStorage.type`

Object storage type to use.

In addition to this Harbor, Rclone, and Thanos have additional configuration to use Swift.

Possible values:

azure

gcs

s3

none

Welkin contains multiple safeguards to make it easy to follow security best practices.

`opa`¶

Configure Open Policy Agent, constraints and mutations enforced by Gatekeeper.

This includes an implementation of constraints and mutations with similar behaviour as Pod Security Policies, and application developer centric safeguards.

Key	Type	Default	Description
opa.audit¶	object	—	Configure the Audit deployment of OPA Gatekeeper.
opa.audit.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
opa.audit.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opa.audit.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opa.audit.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opa.audit.nodeSelector¶	object	—	See note
opa.audit.resources¶	object	—	See note
opa.audit.resources.limits¶	object	—	—
opa.audit.resources.requests¶	object	—	—
opa.audit.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
opa.audit.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
opa.audit.writeToRAMDisk¶	boolean	—	—
opa.auditChunkSize¶	number	`500`	—
opa.auditFromCache¶	boolean	—	—
opa.auditIntervalSeconds¶	number	`600`	—
opa.constraintViolationsLimit¶	number	`20`	—
opa.controllerManager¶	object	—	This is meant to describe the base class if you will, for Welkin resources.
opa.controllerManager.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
opa.controllerManager.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opa.controllerManager.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opa.controllerManager.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opa.controllerManager.enabled¶	boolean	—	—
opa.controllerManager.extraArgs[]¶	array of string	—	Extra arguments passed to a container
opa.controllerManager.nodeSelector¶	object	—	See note
opa.controllerManager.resources¶	object	—	See note
opa.controllerManager.resources.limits¶	object	—	—
opa.controllerManager.resources.requests¶	object	—	—
opa.controllerManager.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
opa.controllerManager.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
opa.disallowedTags¶	object	—	See note
opa.disallowedTags.enabled¶	boolean	`True`	—
opa.disallowedTags.enforcement¶	string	`deny`	See note
opa.disallowedTags.tags[]¶	array of string	—	Configure the tags that should be disallowed by the constraint.
opa.imageRegistry¶	object	—	See note
opa.imageRegistry.URL[]¶	array of string	—	See note
opa.imageRegistry.enabled¶	boolean	`True`	—
opa.imageRegistry.enforcement¶	string	`warn`	See note
opa.minimumDeploymentReplicas¶	object	—	See note
opa.minimumDeploymentReplicas.enabled¶	boolean	`True`	—
opa.minimumDeploymentReplicas.enforcement¶	string	`warn`	See note
opa.mutatingWebhookTimeoutSeconds¶	number	`5`	—
opa.mutations¶	object	—	Configure mutations to set defaults in deployed resources.
opa.mutations.enabled¶	boolean	`True`	—
opa.mutations.jobTTL¶	object	—	See note
opa.mutations.jobTTL.enabled¶	boolean	`True`	—
opa.mutations.jobTTL.ttlSeconds¶	number	`604800`	—
opa.mutations.ndots¶	object	—	Configure mutations to set ndots on deployed Pods.
opa.mutations.ndots.enabled¶	boolean	—	—
opa.mutations.ndots.labelSelector¶	object	—	Configure the label selector for pods to be targeted by this mutation.
opa.mutations.ndots.labelSelector.matchLabels¶	object	—	Configure the label selector for pods to be targeted by this mutation. Default `{}` targets all Pods.
opa.mutations.ndots.ndotAmount¶	integer	`3`	—
opa.networkPolicies¶	object	—	See note
opa.networkPolicies.enabled¶	boolean	`True`	—
opa.networkPolicies.enforcement¶	string	`warn`	See note
opa.preventAccidentalDeletion¶	object	—	Configure constraint to reject deletion of sensitive resources.
opa.preventAccidentalDeletion.enabled¶	boolean	—	—
opa.preventAccidentalDeletion.enforcement¶	string	`deny`	See note
opa.rejectLoadBalancerService¶	object	—	See note
opa.rejectLoadBalancerService.enabled¶	boolean	—	—
opa.rejectLoadBalancerService.enforcement¶	string	`deny`	See note
opa.rejectLocalStorageEmptyDir¶	object	—	See note
opa.rejectLocalStorageEmptyDir.enabled¶	boolean	—	—
opa.rejectLocalStorageEmptyDir.enforcement¶	string	`warn`	See note
opa.rejectPodWithoutController¶	object	—	See note
opa.rejectPodWithoutController.enabled¶	boolean	—	—
opa.rejectPodWithoutController.enforcement¶	string	`warn`	See note
opa.resourceRequests¶	object	—	See note
opa.resourceRequests.enabled¶	boolean	`True`	—
opa.resourceRequests.enforcement¶	string	`deny`	See note
opa.restrictPodDisruptionBudgets¶	object	—	See note
opa.restrictPodDisruptionBudgets.enabled¶	boolean	`True`	—
opa.restrictPodDisruptionBudgets.enforcement¶	string	`deny`	See note
opa.validatingWebhookTimeoutSeconds¶	number	`5`	—

Notes for `opa.audit.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opa.audit.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opa.controllerManager.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opa.controllerManager.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opa.disallowedTags`

Configure constraint to disallow configured tags on container images.

Note

See the dev docs for context.

Notes for `opa.disallowedTags.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.imageRegistry`

Configure constraint to only allow configured registries for container images.

Note

See the dev docs for context.

Notes for `opa.imageRegistry.URL[]`

Configure the registries that should be trusted by the constraint.

Note

To support issuing certificates with HTTP-01 challenges the registry quay.io/jetstack/cert-manager-acmesolver must be added.

Notes for `opa.imageRegistry.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.minimumDeploymentReplicas`

Configure constraint to only allow Deployments and StatefulSets with more than one replica.

Note

See the dev docs for context.

Notes for `opa.minimumDeploymentReplicas.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.mutations.jobTTL`

Configure mutations to set time to live on deployed Jobs.

Note

See the dev docs for context.

Notes for `opa.networkPolicies`

Configure constraint to only allow Pods targeted by NetworkPolicies.

Note

See the dev docs for context.

Notes for `opa.networkPolicies.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.preventAccidentalDeletion.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.rejectLoadBalancerService`

Configure constraint to reject creation of Services with the type LoadBalancer.

Advantageous if the cluster cannot automatically provision LoadBalancers, e.g. because the infrastructure provider do not offer such Kubernetes integration.

Note

See the dev docs for context.

Notes for `opa.rejectLoadBalancerService.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.rejectLocalStorageEmptyDir`

Configure constraint to reject usage of local storage emptydir.

Note

See the dev docs for context.

Notes for `opa.rejectLocalStorageEmptyDir.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.rejectPodWithoutController`

Configure constraint to reject pods without a controller.

Note

See the dev docs for context.

Notes for `opa.rejectPodWithoutController.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.resourceRequests`

Configure constraint to only allow Pods configured with resource requests.

Note

See the dev docs for context.

Notes for `opa.resourceRequests.enforcement`

Possible values:

deny

warn

dryrun

Notes for `opa.restrictPodDisruptionBudgets`

Configure constraint to reject PodDisruptionBudgets and connected Pod controllers if the PDB does not allow for at least 1 pod disruption.

Note

See the dev docs for context.

Notes for `opa.restrictPodDisruptionBudgets.enforcement`

Possible values:

deny

warn

dryrun

`opensearch`¶

Configuration for OpenSearch.

OpenSearch ingests logs sent from Fluentd in the workload cluster, and presents them in OpenSearch Dashboards.

Note

OpenSearch and its components are installed in the service cluster, so this configuration mainly applies there.

Key	Type	Default	Description
opensearch.additionalTemplates¶	object	—	See note
opensearch.clientNode¶	object	—	Configures the client stateful set of OpenSearch that takes on the roll to ingest and query logs.
opensearch.clientNode.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
opensearch.clientNode.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.clientNode.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.clientNode.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.clientNode.count¶	number	`1`	—
opensearch.clientNode.dedicatedPods¶	boolean	`True`	When disabled the master nodes will take on these rolls.
opensearch.clientNode.javaOpts¶	string	`-Xms512m -Xmx512m`	See note
opensearch.clientNode.nodeSelector¶	object	—	See note
opensearch.clientNode.resources¶	object	—	See note
opensearch.clientNode.resources.limits¶	object	—	—
opensearch.clientNode.resources.requests¶	object	—	—
opensearch.clientNode.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
opensearch.clusterName¶	string	`opensearch`	—
opensearch.createIndices¶	boolean	`True`	See note
opensearch.curator¶	object	—	Configures the CronJob that removes indices.
opensearch.curator.activeDeadlineSeconds¶	number	`2700`	—
opensearch.curator.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
opensearch.curator.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.curator.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.curator.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.curator.enabled¶	boolean	`True`	—
opensearch.curator.nodeSelector¶	object	—	See note
opensearch.curator.resources¶	object	—	See note
opensearch.curator.resources.limits¶	object	—	—
opensearch.curator.resources.requests¶	object	—	—
opensearch.curator.retention[]¶	array of object	`[{'pattern': 'authlog-', 'ageDays': 30, 'sizeGB': 1}, {'pattern': 'kubeaudit-', 'ageDays': 30, 'sizeGB': 50}, {'pattern': 'kubernetes-', 'ageDays': 30, 'sizeGB': 50}, {'pattern': 'other-', 'ageDays': 7, 'sizeGB': 1}, {'pattern': 'security-auditlog-*', 'ageDays': 7, 'sizeGB': 1}]`	Configures the retention of indices in OpenSearch. Configures the retention of indices in OpenSearch.
opensearch.curator.startingDeadlineSeconds¶	number	`600`	—
opensearch.curator.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
opensearch.dashboards¶	object	—	Configures the Dashboards deployment of OpenSearch providing the UI to view and query logs.
opensearch.dashboards.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
opensearch.dashboards.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.dashboards.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.dashboards.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.dashboards.cookieTtl¶	integer	—	Time-to-live for the session cookie in milliseconds. Overrides OpenSearch Dashboards internal default if set.
opensearch.dashboards.nodeSelector¶	object	—	See note
opensearch.dashboards.resources¶	object	—	See note
opensearch.dashboards.resources.limits¶	object	—	—
opensearch.dashboards.resources.requests¶	object	—	—
opensearch.dashboards.sessionKeepalive¶	boolean	—	Whether the session TTL should be extended upon user activity. Overrides OpenSearch Dashboards internal default if set.
opensearch.dashboards.sessionTtl¶	integer	—	Time-to-live for the session itself in milliseconds. Overrides OpenSearch Dashboards internal default if set.
opensearch.dashboards.subdomain¶	string	`opensearch`	See note
opensearch.dashboards.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
opensearch.dashboards.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
opensearch.dataNode¶	object	—	Configures the data stateful set of OpenSearch that takes on the roll to index and store logs.
opensearch.dataNode.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
opensearch.dataNode.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.dataNode.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.dataNode.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.dataNode.count¶	number	`2`	—
opensearch.dataNode.dedicatedPods¶	boolean	`True`	When disabled the master nodes will take on these rolls.
opensearch.dataNode.javaOpts¶	string	`-Xms512m -Xmx512m`	See note
opensearch.dataNode.nodeSelector¶	object	—	See note
opensearch.dataNode.resources¶	object	—	See note
opensearch.dataNode.resources.limits¶	object	—	—
opensearch.dataNode.resources.requests¶	object	—	—
opensearch.dataNode.storageClass¶	-string- -null-	—	See note
opensearch.dataNode.storageSize¶	string	—	Configure the requested size of the persistent volume for this OpenSerch node.
opensearch.dataNode.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
opensearch.defaultTemplates¶	boolean	`True`	See note
opensearch.enabled¶	boolean	`True`	> [!note] > Must be set for both service and workload cluster.
opensearch.exporter¶	object	—	Configures the exporter exposing metrics from OpenSearch.
opensearch.exporter.resources¶	object	—	See note
opensearch.exporter.resources.limits¶	object	—	—
opensearch.exporter.resources.requests¶	object	—	—
opensearch.exporter.serviceMonitor¶	object	—	Configures the service monitor of the exporter.
opensearch.exporter.serviceMonitor.interval¶	string	`30s`	—
opensearch.exporter.serviceMonitor.scrapeTimeout¶	string	—	—
opensearch.exporter.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
opensearch.extraRoleMappings[]¶	array of object	—	See note
opensearch.extraRoles[]¶	array of object	—	See note
opensearch.indexPerNamespace¶	boolean	—	See note
opensearch.ingress¶	object	—	Configures the ingress for OpenSearch master or client nodes.
opensearch.ingress.maxbodysize¶	string	`32m`	—
opensearch.ism¶	object	—	Configures index state management in OpenSearch.
opensearch.ism.additionalPolicies¶	object	—	See note
opensearch.ism.defaultPolicies¶	boolean	`True`	See note
opensearch.ism.overwritePolicies¶	boolean	`True`	When set OpenSearch can be configured with index state management policies via `additionalPolicies` that overwrite the ones configured via `defaultPolicies`.
opensearch.ism.rolloverAgeDays¶	number	`1`	Configures the age a write index must reach before it is rolled over to a new one.
opensearch.ism.rolloverSizeGB¶	number	`1`	Configures the size a write index must reach before it is rolled over to a new one.
opensearch.masterNode¶	object	—	Configures the main stateful set of OpenSearch that takes on all roles not provided by other nodes (`dataNode`, `clientNode`).
opensearch.masterNode.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
opensearch.masterNode.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
opensearch.masterNode.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
opensearch.masterNode.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
opensearch.masterNode.count¶	number	`1`	—
opensearch.masterNode.javaOpts¶	string	`-Xms512m -Xmx512m`	See note
opensearch.masterNode.nodeSelector¶	object	—	See note
opensearch.masterNode.resources¶	object	—	See note
opensearch.masterNode.resources.limits¶	object	—	—
opensearch.masterNode.resources.requests¶	object	—	—
opensearch.masterNode.storageClass¶	-string- -null-	—	See note
opensearch.masterNode.storageSize¶	string	—	Configure the requested size of the persistent volume for this OpenSerch node.
opensearch.masterNode.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
opensearch.maxClauseCount¶	number	`1024`	Configures the maximum number of clauses permitted in a query.
opensearch.maxShardsPerNode¶	number	`1000`	Configures the maximum number of shards permitted on one node.
opensearch.objectStorage¶	object	—	Configuration options for using object storage specific to OpenSearch.
opensearch.objectStorage.s3¶	object	—	Configurations for using S3 storage.
opensearch.objectStorage.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
opensearch.objectStorage.s3.region¶	string	—	Region to store data.
opensearch.objectStorage.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
opensearch.objectStorage.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
opensearch.overwriteTemplates¶	boolean	`True`	When set OpenSearch can be configured with index templates via `additionalTemplates` that overwrite the ones configured via `defaultTemplates`.
opensearch.plugins¶	object	—	Configures plugins used in OpenSearch.
opensearch.plugins.additionalPlugins[]¶	array	—	Configures OpenSearch to install plugins when it starts. In an air-gapped environment this can be used to install plugins from known sources.
opensearch.plugins.installExternalObjectStoragePlugin¶	boolean	—	See note
opensearch.promIndexAlerts[]¶	array of object	`[{'prefix': 'authlog-default', 'alertSizeMB': 2}, {'prefix': 'kubeaudit-default', 'alertSizeMB': 5500}, {'prefix': 'kubernetes-default', 'alertSizeMB': 5500}, {'prefix': 'other-default', 'alertSizeMB': 400}]`	Configures the index alerts monitoring the function of index state management. Configures the index alert monitoring the function of index state management.
opensearch.securityadmin¶	object	—	Configures the Job that initialises OpenSearch Security.
opensearch.securityadmin.activeDeadlineSeconds¶	number	`1200`	—
opensearch.securityadmin.enabled¶	boolean	`True`	—
opensearch.securityadmin.resources¶	object	—	See note
opensearch.securityadmin.resources.limits¶	object	—	—
opensearch.securityadmin.resources.requests¶	object	—	—
opensearch.snapshot¶	object	—	Configure OpenSearch snapshot creation and retention. This requires that `objectStorage` is configured, and will use the bucket or container set in `objectStorage.buckets.opensearch`.
opensearch.snapshot.backupSchedule¶	string	—	—
opensearch.snapshot.enabled¶	boolean	`True`	—
opensearch.snapshot.max¶	number	`14`	—
opensearch.snapshot.min¶	number	`7`	—
opensearch.snapshot.repository¶	string	`opensearch-snapshots`	—
opensearch.snapshot.retentionAge¶	string	`10d`	—
opensearch.snapshot.retentionSchedule¶	string	—	—
opensearch.sso¶	object	—	Configures Single Sign On to OpenSearch via Dex.
opensearch.sso.enabled¶	boolean	—	—
opensearch.sso.rolesKey¶	string	`groups`	—
opensearch.sso.scope¶	string	`openid profile email groups`	—
opensearch.sso.subjectKey¶	string	`email`	—
opensearch.subdomain¶	string	`opensearch`	See note

Notes for `opensearch.additionalTemplates`

When set OpenSearch will be configured with additional index templates.

The keys will be used as the name of the index templates.

Note

See the upstream documentation for reference.

Notes for `opensearch.clientNode.javaOpts`

Set Java Virtual Machine Options to control the memory allocation of OpenSearch.

As a rule of thumb the minimum allocation -Xms and maximum allocation -Xmx arguments should be the same to be more predictable. Additionally until memory allocation is at 2 GiB and more it is recommended that the memory limit set in Kubernetes is twice the allocation as OpenSearch uses this for cache.

Notes for `opensearch.clientNode.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.clientNode.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.createIndices`

When enabled OpenSearch will be configured with initial indices for:

authlog
kubeaudit
kubernetes
other

Notes for `opensearch.curator.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.curator.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.dashboards.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.dashboards.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.dashboards.subdomain`

Subdomain of baseDomain that the Ingress to OpenSearch Dashboards will be created with.

Note

Must be set for both service and workload cluster.

Notes for `opensearch.dataNode.javaOpts`

Set Java Virtual Machine Options to control the memory allocation of OpenSearch.

As a rule of thumb the minimum allocation -Xms and maximum allocation -Xmx arguments should be the same to be more predictable. Additionally until memory allocation is at 2 GiB and more it is recommended that the memory limit set in Kubernetes is twice the allocation as OpenSearch uses this for cache.

Notes for `opensearch.dataNode.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.dataNode.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.dataNode.storageClass`

Set storage class for OpenSearch.

If set to null, the default storage class will be used to provision the volumes.
If set to -, no storage class will be used to provision the volumes.

Notes for `opensearch.defaultTemplates`

When enabled OpenSearch will be configured with the default index templates for:

authlog
kubeaudit
kubernetes
other

Notes for `opensearch.exporter.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.extraRoleMappings[]`

Configures extra role mappings for OpenSearch Security.

Extra users can be configured in secrets.yaml under extraUsers and extra roles under extraRoles.

Configures a role mapping for OpenSearch Security.

Note

See the upstream documentation for reference.

Notes for `opensearch.extraRoles[]`

Configures extra roles for OpenSearch Security.

Configures a role for OpenSearch Security.

Note

See the upstream documentation for reference.

Notes for `opensearch.indexPerNamespace`

When enabled logs are ingested into multiple indices per namespace. When disabled logs are ingested into a single kubernetes index.

Important

When enabling this feature, you must also add an entry to opensearch.curator.retention in sc-config.yaml with pattern: ^[^.].* which matches all non-system indices.

Note

Must be set for both service and workload cluster.

Notes for `opensearch.ism.additionalPolicies`

When set OpenSearch will be configured with additional index state management policies.

The keys will be used as the name of the index state management policy.

Note

See the upstream documentation for reference.

Notes for `opensearch.ism.defaultPolicies`

When enabled OpenSearch will be configured with the default index state management policies for:

authlog
kubeaudit
kubernetes
other

Notes for `opensearch.masterNode.javaOpts`

Set Java Virtual Machine Options to control the memory allocation of OpenSearch.

As a rule of thumb the minimum allocation -Xms and maximum allocation -Xmx arguments should be the same to be more predictable. Additionally until memory allocation is at 2 GiB and more it is recommended that the memory limit set in Kubernetes is twice the allocation as OpenSearch uses this for cache.

Notes for `opensearch.masterNode.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `opensearch.masterNode.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.masterNode.storageClass`

Set storage class for OpenSearch.

If set to null, the default storage class will be used to provision the volumes.
If set to -, no storage class will be used to provision the volumes.

Notes for `opensearch.plugins.installExternalObjectStoragePlugin`

When enabled OpenSearch will install the required object storage plugin when it starts.

In an air-gapped environment where the nodes are not connected to the Internet, set this to false to prevent downloading any external object storage plugins.

Notes for `opensearch.securityadmin.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `opensearch.subdomain`

Subdomain of opsDomain that the Ingress to OpenSearch will be created with.

Note

Must be set for both service and workload cluster.

`openstackMonitoring`¶

Configure the collection of metrics for OpenStack components.

Key	Type	Default	Description
openstackMonitoring.enabled¶	boolean	—	—

`prometheus`¶

Configure Prometheus.

Prometheus automatically collects metrics via ServiceMonitors, PodMonitors, and Probes, and pushes metrics to Thanos for long term storage. Additionally Prometheus evaluates recording rules for both service and workload cluster, and all alerting rules for the workload cluster.

Note

Prometheus is installed in both service cluster and workload cluster, so this configuration applies there with some exceptions.

Key	Type	Default	Description
prometheus.additionalScrapeConfigs[]¶	array	—	See note
prometheus.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
prometheus.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
prometheus.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
prometheus.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
prometheus.alertmanagerSpec¶	object	—	See note
prometheus.alertmanagerSpec.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
prometheus.alertmanagerSpec.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
prometheus.alertmanagerSpec.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
prometheus.alertmanagerSpec.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
prometheus.alertmanagerSpec.groupBy[]¶	array of string	—	See note
prometheus.alertmanagerSpec.replicas¶	number	`2`	—
prometheus.alertmanagerSpec.resources¶	object	—	See note
prometheus.alertmanagerSpec.resources.limits¶	object	—	—
prometheus.alertmanagerSpec.resources.requests¶	object	—	—
prometheus.alertmanagerSpec.storage¶	object	—	Configure persistent storage for Alertmanager.
prometheus.alertmanagerSpec.storage.volumeClaimTemplate¶	object	—	Configure persistent storage for Alertmanager.
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec¶	object	—	Configure persistent storage for Alertmanager.
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.accessModes[]¶	array of string	—	Configure the access mode of the persistent storage for Alertmanager.
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.resources¶	object	—	See note
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.resources.limits¶	object	—	—
prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.resources.requests¶	object	—	—
prometheus.alertmanagerSpec.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
prometheus.alertmanagerSpec.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
prometheus.autoscaledNodeGroupAlerts¶	object	—	Configure whether to split KubeletDownForXm alerts into autoscaled and non-autoscaled nodes groups.
prometheus.autoscaledNodeGroupAlerts.enabled¶	boolean	`True`	—
prometheus.autoscaledNodeGroupAlerts.groupLabel¶	string	`node-restriction.kubernetes.io/autoscaled-node-type`	The label to identity whether a node belongs to an autoscaled node group.
prometheus.autoscaledNodeGroupAlerts.groupLabelValues[]¶	array of string	—	The label values to a autoscaled node group if their are multiple autoscaled node groups.
prometheus.capacityManagementAlerts¶	object	—	Configure capacity management alerts.
prometheus.capacityManagementAlerts.disklimit¶	number	`75`	Alert when a disk's usage reaches the limit in percent.
prometheus.capacityManagementAlerts.enabled¶	boolean	`True`	—
prometheus.capacityManagementAlerts.nodeGroupRequestsExcludePattern¶	string	—	See note
prometheus.capacityManagementAlerts.persistentVolume¶	object	—	Configure capacity management alerts on persistent volumes.
prometheus.capacityManagementAlerts.persistentVolume.enabled¶	boolean	`True`	—
prometheus.capacityManagementAlerts.persistentVolume.limit¶	number	`75`	Alert when a persistent volume's usage reaches the limit in percent.
prometheus.capacityManagementAlerts.predictUsage¶	boolean	—	—
prometheus.capacityManagementAlerts.requestLimit¶	object	—	Alert when a node's resource requests reaches the limits in percent.
prometheus.capacityManagementAlerts.requestLimit.cpu¶	number	`80`	Configure a CPU request percentage limit to alert for.
prometheus.capacityManagementAlerts.requestLimit.memory¶	number	`80`	Configure a memory request percentage limit to alert for.
prometheus.capacityManagementAlerts.usagelimit¶	number	`95`	—
prometheus.devAlertmanager¶	object	—	Configuration options for deploying an application developer-specific Alertmanager. Configuration shared with the service cluster alertmanager can be configured via `.alertmanagerSpec`.
prometheus.devAlertmanager.enabled¶	boolean	—	Allows to enable alertmanager for application developer.
prometheus.devAlertmanager.ingressEnabled¶	boolean	—	Allows to have ingress for application developer alertmanager with basic auth
prometheus.devAlertmanager.namespace¶	string	`alertmanager`	Allows to have alertmanager running in custom namespace
prometheus.devAlertmanager.username¶	string	—	—
prometheus.diskAlerts¶	object	—	Configure disk alerts.
prometheus.diskAlerts.inode¶	object	—	Configure disk alerts based on inode usage.
prometheus.diskAlerts.inode.predictLinear[]¶	array of object	—	See note
prometheus.diskAlerts.inode.space[]¶	array of object	—	See note
prometheus.diskAlerts.perf¶	object	—	Configure performance disk alerts.
prometheus.diskAlerts.perf.enabled¶	boolean	—	—
prometheus.diskAlerts.perf.queueSizeThreshold¶	number	`5`	—
prometheus.diskAlerts.perf.readWaitTimeThreshold¶	number	`1`	—
prometheus.diskAlerts.perf.writeWaitTimeThreshold¶	number	`1`	—
prometheus.diskAlerts.storage¶	object	—	Configure disk alerts based on storage usage.
prometheus.diskAlerts.storage.predictLinear[]¶	array of object	—	See note
prometheus.diskAlerts.storage.space[]¶	array of object	—	See note
prometheus.nodeSelector¶	object	—	See note
prometheus.replicas¶	number	`1`	—
prometheus.resources¶	object	—	See note
prometheus.resources.limits¶	object	—	—
prometheus.resources.requests¶	object	—	—
prometheus.retention¶	object	—	Configure retention for Prometheus.
prometheus.retention.age¶	string	`3d`	Configure the time range Prometheus will retain metrics for.
prometheus.retention.alertmanager¶	string	—	See note
prometheus.retention.size¶	string	`4GiB`	Configure the total size Prometheus will retain metrics for.
prometheus.s3BucketAlerts¶	object	—	Configure S3 bucket alerts.
prometheus.s3BucketAlerts.buckets[]¶	array of object	—	Definitions for specific S3 bucket alerts. S3 Bucket Alert configuration for specific bucket
prometheus.s3BucketAlerts.exclude[]¶	array of string	—	Exclude buckets from S3 alerts.
prometheus.s3BucketAlerts.objects¶	object	—	Alert when an S3 buckets reaches the set percentage of the set number of objects.
prometheus.s3BucketAlerts.objects.count¶	number	`1638400`	—
prometheus.s3BucketAlerts.objects.enabled¶	boolean	—	—
prometheus.s3BucketAlerts.objects.percent¶	number	—	Percentage, 0% - 100%
prometheus.s3BucketAlerts.size¶	object	—	Alert when an S3 bucket reaches the set percentage of the set size.
prometheus.s3BucketAlerts.size.enabled¶	boolean	—	—
prometheus.s3BucketAlerts.size.percent¶	number	—	Percentage, 0% - 100%
prometheus.s3BucketAlerts.size.sizeQuotaGB¶	number	`1000`	—
prometheus.s3BucketAlerts.totalSize¶	object	—	Alert when all S3 buckets reaches the set percentage of the set size.
prometheus.s3BucketAlerts.totalSize.enabled¶	boolean	—	—
prometheus.s3BucketAlerts.totalSize.percent¶	number	—	Percentage, 0% - 100%
prometheus.s3BucketAlerts.totalSize.sizeQuotaGB¶	number	`1000`	—
prometheus.storage¶	object	—	Configure the persistent volume claim used for Promtheus storage.
prometheus.storage.enabled¶	boolean	—	By default Prometheus instances run without storage and are treated as ephemeral. See ADR-0007 for context.
prometheus.storage.size¶	string	`5Gi`	—
prometheus.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
prometheus.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
prometheus.webhookAlerts¶	object	—	Configure webhook alerts.
prometheus.webhookAlerts.enabled¶	boolean	`True`	—

Notes for `prometheus.additionalScrapeConfigs[]`

Configure additional scrape configs for Prometheus.

Note

See the upstream documentation for reference.

Notes for `prometheus.alertmanagerSpec`

Configure service cluster & workload cluster Alertmanager.

Alertmanager receives alerts from Prometheus and Thanos and forwards them to the configured notification channel.

Note

Alertmanager is installed in both service cluster and workload cluster, however this configuration key only applies to the service cluster, use user.alertmanager to configure it in the workload cluster.

Notes for `prometheus.alertmanagerSpec.groupBy[]`

Configure Alertmanager to group certain alerts based on labels.

Note

See the upstream documentation for reference.

Notes for `prometheus.alertmanagerSpec.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `prometheus.alertmanagerSpec.storage.volumeClaimTemplate.spec.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `prometheus.capacityManagementAlerts.nodeGroupRequestsExcludePattern`

Configure a pattern of node groups to exclude from the resource request alerts. This can be used to exclude certain node groups from request alerts, while still getting usage alerts for those node groups.

Examples:

.*redis.*|.*postgres.*

Notes for `prometheus.diskAlerts.inode.predictLinear[]`

Configure disk alerts when disk usage is predicted to reach the limit.

The hours key is only supported when configured under predictLinear.

Notes for `prometheus.diskAlerts.inode.space[]`

Configure disk alerts when disk usage is predicted to reach the limit.

The hours key is only supported when configured under predictLinear.

Notes for `prometheus.diskAlerts.storage.predictLinear[]`

Configure disk alerts when disk usage is predicted to reach the limit.

The hours key is only supported when configured under predictLinear.

Notes for `prometheus.diskAlerts.storage.space[]`

Configure disk alerts when disk usage is predicted to reach the limit.

The hours key is only supported when configured under predictLinear.

Notes for `prometheus.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `prometheus.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `prometheus.retention.alertmanager`

An amount of time

Examples:

300s

72h

3d

`prometheusBlackboxExporter`¶

Configure Prometheus Blackbox Exporter, the exporter used for probing endpoints.

Key	Type	Default	Description
prometheusBlackboxExporter.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
prometheusBlackboxExporter.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
prometheusBlackboxExporter.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
prometheusBlackboxExporter.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
prometheusBlackboxExporter.customKubeapiTargets[]¶	array of object	—	Configure custom Kube API targets Prometheus Blackbox Exporter should probe. Custom Kube API target Prometheus Blackbox Exporter should probe.
prometheusBlackboxExporter.hostAliases[]¶	array of object	—	Configure host aliases to resolve internally within the Pod. Configure a host alias to resolve internally within the Pod.
prometheusBlackboxExporter.resources¶	object	—	See note
prometheusBlackboxExporter.resources.limits¶	object	—	—
prometheusBlackboxExporter.resources.requests¶	object	—	—
prometheusBlackboxExporter.targets¶	object	—	Configure the targets Prometheus Blackbox Exporter should probe.
prometheusBlackboxExporter.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration

Notes for `prometheusBlackboxExporter.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`prometheusNodeExporter`¶

Configure Prometheus Node Exporter, the exporter used for collecting node metrics.

Key	Type	Default	Description
prometheusNodeExporter.resources¶	object	—	See note
prometheusNodeExporter.resources.limits¶	object	—	—
prometheusNodeExporter.resources.requests¶	object	—	—
prometheusNodeExporter.scrapeTimeout¶	string	—	—

Notes for `prometheusNodeExporter.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`prometheusOperator`¶

Configure Prometheus Operator.

Key	Type	Default	Description
prometheusOperator.prometheusConfigReloader¶	object	—	Configure Prometheus Operator config reloader.
prometheusOperator.prometheusConfigReloader.resources¶	object	—	See note
prometheusOperator.prometheusConfigReloader.resources.limits¶	object	—	—
prometheusOperator.prometheusConfigReloader.resources.requests¶	object	—	—
prometheusOperator.resources¶	object	—	See note
prometheusOperator.resources.limits¶	object	—	—
prometheusOperator.resources.requests¶	object	—	—

Notes for `prometheusOperator.prometheusConfigReloader.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `prometheusOperator.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`rookCeph`¶

Configure support for Rook Ceph.

This is deprecated and should be configured via compliantkubernetes-kubespray if used.

Key	Type	Default	Description
rookCeph.gatekeeperPsp¶	object	—	Configure Pod Security Policies for Rook Ceph.
rookCeph.gatekeeperPsp.enabled¶	boolean	—	—
rookCeph.monitoring¶	object	—	Configure Monitoring for Rook Ceph.
rookCeph.monitoring.enabled¶	boolean	—	—

`s3Exporter`¶

Configure S3 exporter, used to collect metrics about S3 usage.

Key	Type	Default	Description
s3Exporter.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
s3Exporter.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
s3Exporter.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
s3Exporter.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
s3Exporter.enabled¶	boolean	`True`	—
s3Exporter.interval¶	string	`60m`	—
s3Exporter.nodeSelector¶	object	—	See note
s3Exporter.resources¶	object	—	See note
s3Exporter.resources.limits¶	object	—	—
s3Exporter.resources.requests¶	object	—	—
s3Exporter.scrapeTimeout¶	string	—	—
s3Exporter.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration

Notes for `s3Exporter.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `s3Exporter.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`storageClasses`¶

Configuration options for using block storage in Welkin

Key	Type	Default	Description
storageClasses.default¶	string	`default`	The StorageClass to use for all persistent volumes in Welkin.

`tektonPipelines`¶

Configure Tekton Pipelines

Key	Type	Default	Description
tektonPipelines.controller¶	object	—	Configure the Tekton Controller
tektonPipelines.controller.replicas¶	integer	—	—
tektonPipelines.controller.resources¶	object	—	See note
tektonPipelines.controller.resources.limits¶	object	—	—
tektonPipelines.controller.resources.requests¶	object	—	—
tektonPipelines.customConfigDefaults¶	object	—	See note
tektonPipelines.enabled¶	boolean	—	—
tektonPipelines.remoteResolvers¶	object	—	Configure the Tekton Remote Resolver
tektonPipelines.remoteResolvers.replicas¶	integer	—	—
tektonPipelines.remoteResolvers.resources¶	object	—	See note
tektonPipelines.remoteResolvers.resources.limits¶	object	—	—
tektonPipelines.remoteResolvers.resources.requests¶	object	—	—
tektonPipelines.webhook¶	object	—	Configure the Tekton Webhook
tektonPipelines.webhook.replicas¶	integer	—	—
tektonPipelines.webhook.resources¶	object	—	See note
tektonPipelines.webhook.resources.limits¶	object	—	—
tektonPipelines.webhook.resources.requests¶	object	—	—

Notes for `tektonPipelines.controller.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `tektonPipelines.customConfigDefaults`

Configure custom default options for Tekton

Note

See the upstream documentation for available default config options.

Examples:

{'default-timeout-minutes': '30'}

Notes for `tektonPipelines.remoteResolvers.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `tektonPipelines.webhook.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`thanos`¶

Configuration for Thanos.

Thanos ingests metrics sent from Prometheus in both the service and workload clusters, and stores them in object storage.

This requires that objectStorage is configured, and will use the bucket or container set in objectStorage.buckets.thanos.

Note

Thanos and its components are installed in the service cluster, so this configuration mainly applies there.

Key	Type	Default	Description
thanos.bucketweb¶	object	—	Configure Thanos Bucket Web, the UI to view the state of the bucket or container in use by Thanos.
thanos.bucketweb.resources¶	object	—	See note
thanos.bucketweb.resources.limits¶	object	—	—
thanos.bucketweb.resources.requests¶	object	—	—
thanos.compactor¶	object	—	See note
thanos.compactor.deduplication¶	string	`none`	See note
thanos.compactor.persistence¶	object	—	Configure persistence for Thanos Compactor.
thanos.compactor.persistence.enabled¶	boolean	`True`	—
thanos.compactor.persistence.size¶	string	`8Gi`	—
thanos.compactor.resources¶	object	—	See note
thanos.compactor.resources.limits¶	object	—	—
thanos.compactor.resources.requests¶	object	—	—
thanos.compactor.retentionResolution1h¶	string	—	See note
thanos.compactor.retentionResolution5m¶	string	—	See note
thanos.compactor.retentionResolutionRaw¶	string	—	See note
thanos.compactor.verticalCompaction¶	boolean	—	When enabled series of metrics from multiple replicas will be merged into one.
thanos.enabled¶	boolean	`True`	> [!note] > Must be set for both service and workload cluster.
thanos.metrics¶	object	—	Configure metrics collected from Thanos.
thanos.metrics.enabled¶	boolean	`True`	—
thanos.metrics.serviceMonitor¶	object	—	Configure the service monitor used to collect metrics from Thanos.
thanos.metrics.serviceMonitor.enabled¶	boolean	`True`	—
thanos.objectStorage¶	object	—	Configure Object Storage for Thanos. Allows for using OpenStack Swift as the object storage backend type. Also allows use separate configuration of s3 specific to Thanos.
thanos.objectStorage.s3¶	object	—	Configurations for using S3 storage.
thanos.objectStorage.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
thanos.objectStorage.s3.region¶	string	—	Region to store data.
thanos.objectStorage.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
thanos.objectStorage.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
thanos.objectStorage.type¶	string	—	See note
thanos.query¶	object	—	Configure Thanos Query, the component executing metric queries.
thanos.query.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
thanos.query.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
thanos.query.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
thanos.query.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
thanos.query.enabled¶	boolean	`True`	—
thanos.query.replicaCount¶	number	`1`	—
thanos.query.resources¶	object	—	See note
thanos.query.resources.limits¶	object	—	—
thanos.query.resources.requests¶	object	—	—
thanos.query.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
thanos.queryFrontend¶	object	—	Configure Thanos Query Frontend, the component serving query requests from Grafana.
thanos.queryFrontend.resources¶	object	—	See note
thanos.queryFrontend.resources.limits¶	object	—	—
thanos.queryFrontend.resources.requests¶	object	—	—
thanos.receiveDistributor¶	object	—	Configure Thanos Receive Distributor, the component serving remote write requests from Prometheus. Also called routing receiver upstream.
thanos.receiveDistributor.extraFlags[]¶	array	—	See note
thanos.receiveDistributor.receiveHashringsAlgorithm¶	string	`ketama`	See note
thanos.receiveDistributor.receiveMaxConcurrency¶	integer	`5`	Maximum number of concurrent write requests allowed by Thanos receiveDistributor.
thanos.receiveDistributor.replicaCount¶	integer	`3`	—
thanos.receiveDistributor.replicationFactor¶	number	`1`	Requires that incoming remote write requests are replicated `(replicationFactor + 1) / 2`.
thanos.receiveDistributor.resources¶	object	—	See note
thanos.receiveDistributor.resources.limits¶	object	—	—
thanos.receiveDistributor.resources.requests¶	object	—	—
thanos.receiver¶	object	—	Configure Thanos Receiver, the component ingesting metrics collected by Prometheus and storing them in object storage. Also called ingesting receiver upstream.
thanos.receiver.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
thanos.receiver.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
thanos.receiver.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
thanos.receiver.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
thanos.receiver.basic_auth¶	object	—	Configure authentication to Thanos Receiver,
thanos.receiver.basic_auth.username¶	string	`thanos`	See note
thanos.receiver.enabled¶	boolean	`True`	—
thanos.receiver.mode¶	string	`dual-mode`	See note
thanos.receiver.outOfOrderTimeWindow¶	string	`600s`	—
thanos.receiver.persistence¶	object	—	Configure persistence for Thanos Receiver.
thanos.receiver.persistence.enabled¶	boolean	`True`	—
thanos.receiver.persistence.size¶	string	`50Gi`	—
thanos.receiver.replicaCount¶	number	`2`	—
thanos.receiver.resources¶	object	—	See note
thanos.receiver.resources.limits¶	object	—	—
thanos.receiver.resources.requests¶	object	—	—
thanos.receiver.subdomain¶	string	`thanos-receiver`	See note
thanos.receiver.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
thanos.receiver.tsdbRetention¶	string	`15d`	—
thanos.ruler¶	object	—	Configure Thanos Ruler, the component evaluating alerting and recording rules.
thanos.ruler.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
thanos.ruler.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
thanos.ruler.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
thanos.ruler.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
thanos.ruler.configReloader¶	object	—	Configure the config reloader sidecar for Thanos Ruler.
thanos.ruler.configReloader.resources¶	object	—	See note
thanos.ruler.configReloader.resources.limits¶	object	—	—
thanos.ruler.configReloader.resources.requests¶	object	—	—
thanos.ruler.enabled¶	boolean	`True`	—
thanos.ruler.persistence¶	object	—	Configure persistence for Thanos Ruler.
thanos.ruler.persistence.enabled¶	boolean	—	—
thanos.ruler.persistence.size¶	string	`8Gi`	—
thanos.ruler.replicaCount¶	number	`2`	—
thanos.ruler.resources¶	object	—	See note
thanos.ruler.resources.limits¶	object	—	—
thanos.ruler.resources.requests¶	object	—	—
thanos.ruler.topologySpreadConstraints[]¶	array	—	TopologySpreadConstraints describes how pods should spread across topology domains.
thanos.storegateway¶	object	—	Configure Thanos Store Gateway, the component fetching metrics from object storage.
thanos.storegateway.persistence¶	object	—	Configure persistence for Thanos Store Gateway.
thanos.storegateway.persistence.size¶	string	`8Gi`	—
thanos.storegateway.resources¶	object	—	See note
thanos.storegateway.resources.limits¶	object	—	—
thanos.storegateway.resources.requests¶	object	—	—

Notes for `thanos.bucketweb.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.compactor`

Configure Thanos Compactor, the component compacting and deduplicating metrics stored by Thanos.

Note

See the upstream documentation for reference.

Notes for `thanos.compactor.deduplication`

Configure deduplication of metrics.

Possible values:

none

receiverReplicas

prometheusReplicas

Notes for `thanos.compactor.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.compactor.retentionResolution1h`

An amount of time

Examples:

300s

72h

3d

Notes for `thanos.compactor.retentionResolution5m`

An amount of time

Examples:

300s

72h

3d

Notes for `thanos.compactor.retentionResolutionRaw`

An amount of time

Examples:

300s

72h

3d

Notes for `thanos.objectStorage.type`

Possible values:

swift

Notes for `thanos.query.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.queryFrontend.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.receiveDistributor.extraFlags[]`

When set, the arguments will be passed onto the component as command-line flags. Refer to the upstream doc for more details.

Notes for `thanos.receiveDistributor.receiveHashringsAlgorithm`

Algorithm used for distributing writes across Thanos receive replicas.

Possible values:

hashmod

ketama

Notes for `thanos.receiveDistributor.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.receiver.basic_auth.username`

Configure the username for authenticating to Thanos Receiver.

Note

Must be set for both service and workload clusters.

Notes for `thanos.receiver.mode`

Possible values:

standalone

dual-mode

Notes for `thanos.receiver.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.receiver.subdomain`

Subdomain of opsDomain that the Ingress to Thanos Receive will be created with.

Note

Must be set for both service and workload clusters.

Notes for `thanos.ruler.configReloader.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.ruler.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `thanos.storegateway.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

`trivy`¶

Configure Trivy Operator.

Trivy automatically scans the cluster for vulnerabilities, misconfigurations, and exposed secrets.

Key	Type	Default	Description
trivy.affinity¶	object	—	Affinity is a group of affinity scheduling rules.
trivy.affinity.nodeAffinity¶	—	—	Describes node affinity scheduling rules for the pod.
trivy.affinity.podAffinity¶	—	—	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
trivy.affinity.podAntiAffinity¶	—	—	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
trivy.enabled¶	boolean	`True`	—
trivy.excludeNamespaces¶	string	—	Configure a comma separated list of namespaces (or glob patterns) to be excluded from Trivy scanners.
trivy.nodeCollector¶	object	—	Configure the node collector created by Trivy.
trivy.nodeCollector.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
trivy.resources¶	object	—	See note
trivy.resources.limits¶	object	—	—
trivy.resources.requests¶	object	—	—
trivy.scanJobs¶	object	—	Configure the scan jobs created by Trivy.
trivy.scanJobs.concurrentLimit¶	number	`1`	—
trivy.scanJobs.retryDelay¶	string	`1m`	—
trivy.scanJobs.timeout¶	string	`5m`	—
trivy.scanner¶	object	—	See note
trivy.scanner.dbRegistry¶	string	—	—
trivy.scanner.dbRepository¶	string	—	—
trivy.scanner.dbRepositoryInsecure¶	boolean	—	—
trivy.scanner.imagePullSecret¶	object	—	Configure an image pull secret for Trivy to use. Create the secret in the `monitoring` namespace then configure the name here.
trivy.scanner.imagePullSecret.name¶	string	—	—
trivy.scanner.javaDbRegistry¶	string	—	—
trivy.scanner.javaDbRepository¶	string	—	—
trivy.scanner.offlineScanEnabled¶	boolean	—	—
trivy.scanner.registry¶	object	—	Configure registries for Trivy.
trivy.scanner.registry.mirror¶	object	—	See note
trivy.scanner.resources¶	object	—	See note
trivy.scanner.resources.limits¶	object	—	—
trivy.scanner.resources.requests¶	object	—	—
trivy.scanner.timeout¶	string	—	See note
trivy.serviceMonitor¶	object	—	Configure the service monitor collecting metrics from Trivy.
trivy.serviceMonitor.enabled¶	boolean	`True`	—
trivy.serviceMonitor.interval¶	string	—	See note
trivy.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
trivy.vulnerabilityScanner¶	object	—	Configure the vulnerability scanner for Trivy.
trivy.vulnerabilityScanner.scanOnlyCurrentRevisions¶	boolean	`True`	—
trivy.vulnerabilityScanner.scannerReportTTL¶	string	—	See note

Notes for `trivy.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `trivy.scanner`

Configure the scanner used by Trivy.

Note

Many of these must be configured to support an air-gapped environment. See the admin documentation for reference.

Notes for `trivy.scanner.registry.mirror`

Configure registry mirrors for Trivy.

The key represents the original registry and the value the mirror registry.

Examples:

{'docker.io': 'registry.example.com:5000', 'gcr.io': 'registry.example.com:5000', 'ghcr.io': 'registry.example.com:5000', 'index.docker.io': 'registry.example.com:5000', 'quay.io': 'registry.example.com:5000', 'registry.k8s.io': 'registry.example.com:5000'}

Notes for `trivy.scanner.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `trivy.scanner.timeout`

A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `trivy.serviceMonitor.interval`

An amount of time

Examples:

300s

72h

3d

Notes for `trivy.vulnerabilityScanner.scannerReportTTL`

An amount of time

Examples:

300s

72h

3d

`user`¶

Configuration for Application Developers (users), that use the workload cluster

Key	Type	Default	Description
user.adminGroups[]¶	array of string	—	List of groups that Application Developers are apart of that should have access to the cluster.
user.adminUsers[]¶	array of string	—	List of Application Developers that should have access to the cluster.
user.constraints¶	object	—	See note
user.createNamespaces¶	boolean	—	This only controls if the namespaces should be created, user RBAC is always created.
user.extraClusterRoleBindings¶	object	—	Configure extra ClusterRoleBindings for Application Developers
user.extraClusterRoles¶	object	—	Configure extra ClusterRoles that are not originally part of Welkin These are intended to be used for Application Developers
user.extraRoleBindings¶	object	—	Configure extra RoleBindings for Application Developers The RoleBindings are added to all Application Developer namespaces configured in user.namespaces
user.extraRoles¶	object	—	Configure extra Roles for Application Developers The Roles are added to all Application Developer namespaces configured in user.namespaces
user.fluxv2¶	object	—	Installs required cluster resources needed to install fluxv2. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.fluxv2.enabled¶	boolean	—	—
user.kafka¶	object	—	Installs required cluster resources needed to install kafka-operator. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.kafka.enabled¶	boolean	—	—
user.mongodb¶	object	—	Installs required cluster resources needed to install MongoDB. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.mongodb.enabled¶	boolean	—	—
user.namespaces[]¶	array of string	—	See note
user.sealedSecrets¶	object	—	Installs required cluster resources needed to install sealedSecrets. Requires that `gatekeeper.allowUserCRDs.enabled` is enabled.
user.sealedSecrets.enabled¶	boolean	—	—
user.serviceAccounts[]¶	array of string	—	See note

Notes for `user.constraints`

Any namespace listed in constraints are exempted from HNC managed namespaces.

This to override the Pod Security Admission level.

Example of constraint can be found here: Example Constraint

The only extra label `psaLevel: `` is shown in the following example:

<namespace>:
  psaLevel: <baseline/privileged>
  <service-name>:
    ...

Notes for `user.namespaces[]`

List of namespaces that should be created for Application Developer.

It is common to create one namespace for the Application Developer and then create namespaces via HNC.

Requires that user.createNamespaces is enabled.

Application developer kube-config for contributors

Notes for `user.serviceAccounts[]`

List of serviceAccounts to create RBAC rules for, used for dev situations.

`velero`¶

Configure Velero, the backup and snapshot tool for Kubernetes resources and volumes.

This requires that objectStorage is configured, and will use the bucket or container set in objectStorage.buckets.velero.

Key	Type	Default	Description
velero.enabled¶	boolean	`True`	—
velero.excludedExtraNamespaces[]¶	array of string	—	Configure dynamic namespaces to exclude from backups, prefer this for overrides over `excludedNamespaces`.
velero.excludedNamespaces[]¶	array of string	—	Configure system namespaces to exclude from backups.
velero.nodeAgent¶	object	—	Configure the node agent of Velero, used to take snapshots of volumes.
velero.nodeAgent.resources¶	object	—	See note
velero.nodeAgent.resources.limits¶	object	—	—
velero.nodeAgent.resources.requests¶	object	—	—
velero.nodeAgent.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
velero.nodeSelector¶	object	—	See note
velero.objectStorage¶	object	—	Configuration options for using object storage specific to Velero.
velero.objectStorage.s3¶	object	—	Configurations for using S3 storage.
velero.objectStorage.s3.forcePathStyle¶	boolean	—	Force the use of path style access instead of virtual host style access. Generally `false` when using AWS, Exoscale, and UpCloud and `true` for other providers.
velero.objectStorage.s3.region¶	string	—	Region to store data.
velero.objectStorage.s3.regionEndpoint¶	string	—	Endpoint to reach the S3 service, mainly applicable for non-AWS implementations. Make sure to prepend the protocol (e.g. `https://`).
velero.objectStorage.s3.v2Auth¶	boolean	—	Force the use of v2 authentication, will default to using v4 authentication otherwise.
velero.resources¶	object	—	See note
velero.resources.limits¶	object	—	—
velero.resources.requests¶	object	—	—
velero.restoreResourcePriorities[]¶	array of string	—	See note
velero.retentionPeriod¶	string	—	See note
velero.schedule¶	string	—	—
velero.storagePrefix¶	string	—	See note
velero.tolerations[]¶	array	—	Kubernetes Tolerations Kubernetes taint and toleration
velero.uploaderType¶	string	—	See note
velero.useVolumeSnapshots¶	boolean	—	—

Notes for `velero.nodeAgent.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

Notes for `velero.nodeSelector`

Kubernetes node selector

Examples:

{'kubernetes.io/os': 'linux'}

Notes for `velero.resources`

Resource requests are used by the kube-scheduler to pick a node to schedule pods on.

Limits are enforced. Resources are commonly 'cpu' and 'memory'.

Examples:

{'requests': {'memory': '128Mi', 'cpu': '100m'}, 'limits': {'memory': '256Mi', 'cpu': '250m'}}

See upstream documentation for reference

Notes for `velero.restoreResourcePriorities[]`

Configure restore order for resources

Note

Notes for `velero.retentionPeriod`

A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

Examples:

2h45m0s

Notes for `velero.storagePrefix`

Configure unique storage prefix for this cluster when storing backups and snapshots in object storage.

When multiple workload clusters share the same bucket or container ensure that they use separate storage prefixes.

Examples:

service-cluster

workload-cluster

Notes for `velero.uploaderType`

Possible values:

kopia

restic

`wcProbeIngress`¶

Configure a probe for the workload cluster Ingress Controller.

Key	Type	Default	Description
wcProbeIngress.enabled¶	boolean	—	—

`welcomingDashboard`¶

If you want to add extra text to the grafana/opensearch "welcoming dashboards" then write the text in these values as a one-line string. Note, first line of the string is a header, not all characters are supported. For newline in Grafana dashboard use format \\n

Key	Type	Default	Description
welcomingDashboard.extraTextGrafana¶	string	—	See note
welcomingDashboard.extraTextOpensearch¶	string	—	Extra text added to the Opensearch welcoming dashboard.
welcomingDashboard.extraVersions[]¶	array of object	—	List of additional components to list on the welcoming dashboard. Additional component to list on the welcoming dashboard.

Notes for `welcomingDashboard.extraTextGrafana`

Extra text added to the Grafana welcoming dashboard.

Examples:

Hello\n\n[This is an example link](https:/elastisys.io)