charts/kube-argo/values.yaml

## @param argo ## @skip argo argo: install: true ## Argo CD configuration ## Ref: https://github.com/argoproj/argo-cd ## # -- Provide a name in place of `argocd` nameOverride: argocd # -- String to fully override `"argo-cd.fullname"` fullnameOverride: "" # -- Override the Kubernetes version, which is used to evaluate certain manifests kubeVersionOverride: "" # Override APIVersions # If you want to template helm charts but cannot access k8s API server # you can set api versions here apiVersionOverrides: {} # -- Create aggregated roles that extend existing cluster roles to interact with argo-cd resources ## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles createAggregateRoles: false # -- Create cluster roles for cluster-wide installation. ## Used when you manage applications in the same cluster where Argo CD runs createClusterRoles: true openshift: # -- enables using arbitrary uid for argo repo server enabled: false ## Custom resource configuration crds: # -- Install and upgrade CRDs install: true # -- Keep CRDs on chart uninstall keep: true # -- Annotations to be added to all CRDs annotations: {} # -- Addtional labels to be added to all CRDs additionalLabels: {} ## Globally shared configuration global: # -- Default domain used by all components ## Used for ingresses, certificates, SSO, notifications, etc. domain: argocd.example.com # -- Common labels for the all resources additionalLabels: {} # app: argo-cd # -- Number of old deployment ReplicaSets to retain. The rest will be garbage collected. revisionHistoryLimit: 3 # Default image used by all components image: # -- If defined, a repository applied to all Argo CD deployments repository: quay.io/argoproj/argocd # -- Overrides the global Argo CD image tag whose default is the chart appVersion tag: "" # -- If defined, a imagePullPolicy applied to all Argo CD deployments imagePullPolicy: IfNotPresent # -- Secrets with credentials to pull images from a private registry imagePullSecrets: [] # Default logging options used by all components logging: # -- Set the global logging format. Either: `text` or `json` format: text # -- Set the global logging level. One of: `debug`, `info`, `warn` or `error` level: info # -- Annotations for the all deployed Statefulsets statefulsetAnnotations: {} # -- Annotations for the all deployed Deployments deploymentAnnotations: {} # -- Annotations for the all deployed pods podAnnotations: {} # -- Labels for the all deployed pods podLabels: {} # -- Add Prometheus scrape annotations to all metrics services. This can be used as an alternative to the ServiceMonitors. addPrometheusAnnotations: false # -- Toggle and define pod-level security context. # @default -- `{}` (See [values.yaml]) securityContext: {} # runAsUser: 999 # runAsGroup: 999 # fsGroup: 999 # -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files hostAliases: [] # - ip: 10.20.30.40 # hostnames: # - git.myhostname # Default network policy rules used by all components networkPolicy: # -- Create NetworkPolicy objects for all components create: false # -- Default deny all ingress traffic defaultDenyIngress: false # -- Default priority class for all components priorityClassName: "" # -- Default node selector for all components nodeSelector: {} # -- Default tolerations for all components tolerations: [] # Default affinity preset for all components affinity: # -- Default pod anti-affinity rules. Either: `none`, `soft` or `hard` podAntiAffinity: soft # Node affinity rules nodeAffinity: # -- Default node affinity rules. Either: `none`, `soft` or `hard` type: hard # -- Default match expressions for node affinity matchExpressions: [] # - key: topology.kubernetes.io/zone # operator: In # values: # - antarctica-east1 # - antarctica-west1 # -- Default [TopologySpreadConstraints] rules for all components ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector of the component topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Deployment strategy for the all deployed Deployments deploymentStrategy: {} # type: RollingUpdate # rollingUpdate: # maxSurge: 25% # maxUnavailable: 25% # -- Environment variables to pass to all deployed Deployments env: [] # -- Annotations for the all deployed Certificates certificateAnnotations: {} ## Argo Configs configs: # General Argo CD configuration ## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cm.yaml cm: # -- Create the argocd-cm configmap for [declarative setup] create: true # -- Annotations to be added to argocd-cm configmap annotations: {} # -- The name of tracking label used by Argo CD for resource pruning application.instanceLabelKey: argocd.argoproj.io/instance # -- Enable logs RBAC enforcement ## Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.3-2.4/#enable-logs-rbac-enforcement server.rbac.log.enforce.enable: false # -- Enable exec feature in Argo UI ## Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac/#exec-resource exec.enabled: false # -- Enable local admin user ## Ref: https://argo-cd.readthedocs.io/en/latest/faq/#how-to-disable-admin-user admin.enabled: true # -- Timeout to discover if a new manifests version got published to the repository timeout.reconciliation: 180s # -- Timeout to refresh application data as well as target manifests cache timeout.hard.reconciliation: 0s # Dex configuration # dex.config: | # connectors: # # GitHub example # - type: github # id: github # name: GitHub # config: # clientID: aabbccddeeff00112233 # clientSecret: $dex.github.clientSecret # Alternatively $<some_K8S_secret>:dex.github.clientSecret # orgs: # - name: your-github-org # OIDC configuration as an alternative to dex (optional). # oidc.config: | # name: AzureAD # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 # clientID: CLIENT_ID # clientSecret: $oidc.azuread.clientSecret # rootCA: | # -----BEGIN CERTIFICATE----- # ... encoded certificate data here ... # -----END CERTIFICATE----- # requestedIDTokenClaims: # groups: # essential: true # requestedScopes: # - openid # - profile # - email # Argo CD configuration parameters ## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cmd-params-cm.yaml params: # -- Create the argocd-cmd-params-cm configmap # If false, it is expected the configmap will be created by something else. create: true # -- Annotations to be added to the argocd-cmd-params-cm ConfigMap annotations: {} ## Generic parameters # -- Open-Telemetry collector address: (e.g. "otel-collector:4317") otlp.address: '' ## Controller Properties # -- Number of application status processors controller.status.processors: 20 # -- Number of application operation processors controller.operation.processors: 10 # -- Specifies timeout between application self heal attempts controller.self.heal.timeout.seconds: 5 # -- Repo server RPC call timeout seconds. controller.repo.server.timeout.seconds: 60 ## Server properties # -- Run server without TLS ## NOTE: This value should be set when you generate params by other means as it changes ports used by ingress template. server.insecure: false # -- Value for base href in index.html. Used if Argo CD is running behind reverse proxy under subpath different from / server.basehref: / # -- Used if Argo CD is running behind reverse proxy under subpath different from / server.rootpath: '' # -- Directory path that contains additional static assets server.staticassets: /shared/app # -- Disable Argo CD RBAC for user authentication server.disable.auth: false # -- Enable GZIP compression server.enable.gzip: true # -- Set X-Frame-Options header in HTTP responses to value. To disable, set to "". server.x.frame.options: sameorigin ## Repo-server properties # -- Limit on number of concurrent manifests generate requests. Any value less the 1 means no limit. reposerver.parallelism.limit: 0 ## ApplicationSet Properties # -- Modify how application is synced between the generator and the cluster. One of: `sync`, `create-only`, `create-update`, `create-delete` applicationsetcontroller.policy: sync # -- Enables use of the Progressive Syncs capability applicationsetcontroller.enable.progressive.syncs: false # -- Enables [Applications in any namespace] ## List of additional namespaces where applications may be created in and reconciled from. ## The namespace where Argo CD is installed to will always be allowed. ## Set comma-separated list. (e.g. app-team-one, app-team-two) application.namespaces: "" # Argo CD RBAC policy configuration ## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md rbac: # -- Create the argocd-rbac-cm configmap with ([Argo CD RBAC policy]) definitions. # If false, it is expected the configmap will be created by something else. # Argo CD will not work if there is no configmap created with the name above. create: true # -- Annotations to be added to argocd-rbac-cm configmap annotations: {} # -- The name of the default role which Argo CD will falls back to, when authorizing API requests (optional). # If omitted or empty, users may be still be able to login, but will see no apps, projects, etc... policy.default: '' # -- File containing user-defined policies and role definitions. # @default -- `''` (See [values.yaml]) policy.csv: '' # Policy rules are in the form: # p, subject, resource, action, object, effect # Role definitions and bindings are in the form: # g, subject, inherited-subject # policy.csv: | # p, role:org-admin, applications, *, */*, allow # p, role:org-admin, clusters, get, *, allow # p, role:org-admin, repositories, *, *, allow # p, role:org-admin, logs, get, *, allow # p, role:org-admin, exec, create, */*, allow # g, your-github-org:your-team, role:org-admin # -- OIDC scopes to examine during rbac enforcement (in addition to `sub` scope). # The scope value can be a string, or a list of strings. scopes: "[groups]" # -- Matcher function for Casbin, `glob` for glob matcher and `regex` for regex matcher. policy.matchMode: "glob" # GnuPG public keys for commit verification ## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/gpg-verification/ gpg: # -- Annotations to be added to argocd-gpg-keys-cm configmap annotations: {} # -- [GnuPG] public keys to add to the keyring # @default -- `{}` (See [values.yaml]) ## Note: Public keys should be exported with `gpg --export --armor <KEY>` keys: {} # 4AEE18F83AFDEB23: | # -----BEGIN PGP PUBLIC KEY BLOCK----- # ... # -----END PGP PUBLIC KEY BLOCK----- # SSH known hosts for Git repositories ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#ssh-known-host-public-keys ssh: # -- Annotations to be added to argocd-ssh-known-hosts-cm configmap annotations: {} # -- Known hosts to be added to the known host list by default. # @default -- See [values.yaml] knownHosts: | [ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= [ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl [ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE= bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M= github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY= gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9 ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H # -- Additional known hosts for private repositories extraHosts: '' # Repository TLS certificates # Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories-using-self-signed-tls-certificates-or-are-signed-by-custom-ca tls: # -- Annotations to be added to argocd-tls-certs-cm configmap annotations: {} # -- TLS certificates for Git repositories # @default -- `{}` (See [values.yaml]) certificates: {} # server.example.com: | # -----BEGIN CERTIFICATE----- # ... # -----END CERTIFICATE----- # ConfigMap for Config Management Plugins # Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/config-management-plugins/ cmp: # -- Create the argocd-cmp-cm configmap create: false # -- Annotations to be added to argocd-cmp-cm configmap annotations: {} # -- Plugin yaml files to be added to argocd-cmp-cm plugins: {} # --- First plugin # my-plugin: # init: # command: [sh] # args: [-c, 'echo "Initializing..."'] # generate: # command: [sh, -c] # args: # - | # echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"Foo\": \"$ARGOCD_ENV_FOO\", \"KubeVersion\": \"$KUBE_VERSION\", \"KubeApiVersion\": \"$KUBE_API_VERSIONS\",\"Bar\": \"baz\"}}}" # discover: # fileName: "./subdir/s*.yaml" # find: # glob: "**/Chart.yaml" # command: [sh, -c, find . -name env.yaml] # --- Second plugin # my-plugin2: # init: # command: [sh] # args: [-c, 'echo "Initializing..."'] # generate: # command: [sh, -c] # args: # - | # echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"Foo\": \"$ARGOCD_ENV_FOO\", \"KubeVersion\": \"$KUBE_VERSION\", \"KubeApiVersion\": \"$KUBE_API_VERSIONS\",\"Bar\": \"baz\"}}}" # discover: # fileName: "./subdir/s*.yaml" # find: # glob: "**/Chart.yaml" # command: [sh, -c, find . -name env.yaml] # -- Provide one or multiple [external cluster credentials] # @default -- `[]` (See [values.yaml]) ## Ref: ## - https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters ## - https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#external-cluster-credentials ## - https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters clusterCredentials: [] # - name: mycluster # server: https://mycluster.example.com # labels: {} # annotations: {} # config: # bearerToken: "<authentication token>" # tlsClientConfig: # insecure: false # caData: "<base64 encoded certificate>" # - name: mycluster2 # server: https://mycluster2.example.com # labels: {} # annotations: {} # namespaces: namespace1,namespace2 # clusterResources: true # config: # bearerToken: "<authentication token>" # tlsClientConfig: # insecure: false # caData: "<base64 encoded certificate>" # - name: mycluster3-project-scoped # server: https://mycluster3.example.com # labels: {} # annotations: {} # project: my-project1 # config: # bearerToken: "<authentication token>" # tlsClientConfig: # insecure: false # caData: "<base64 encoded certificate>" # -- Repository credentials to be used as Templates for other repos ## Creates a secret for each key/value specified below to create repository credentials credentialTemplates: {} # github-enterprise-creds-1: # url: https://github.com/argoproj # githubAppID: 1 # githubAppInstallationID: 2 # githubAppEnterpriseBaseUrl: https://ghe.example.com/api/v3 # githubAppPrivateKey: | # -----BEGIN OPENSSH PRIVATE KEY----- # ... # -----END OPENSSH PRIVATE KEY----- # https-creds: # url: https://github.com/argoproj # password: my-password # username: my-username # ssh-creds: # url: git@github.com:argoproj-labs # sshPrivateKey: | # -----BEGIN OPENSSH PRIVATE KEY----- # ... # -----END OPENSSH PRIVATE KEY----- # -- Annotations to be added to `configs.credentialTemplates` Secret credentialTemplatesAnnotations: {} # -- Repositories list to be used by applications ## Creates a secret for each key/value specified below to create repositories ## Note: the last example in the list would use a repository credential template, configured under "configs.credentialTemplates". repositories: {} # istio-helm-repo: # url: https://storage.googleapis.com/istio-prerelease/daily-build/master-latest-daily/charts # name: istio.io # type: helm # private-helm-repo: # url: https://my-private-chart-repo.internal # name: private-repo # type: helm # password: my-password # username: my-username # private-repo: # url: https://github.com/argoproj/private-repo # -- Annotations to be added to `configs.repositories` Secret repositoriesAnnotations: {} # Argo CD sensitive data # Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets secret: # -- Create the argocd-secret createSecret: true # -- Labels to be added to argocd-secret labels: {} # -- Annotations to be added to argocd-secret annotations: {} # -- Shared secret for authenticating GitHub webhook events githubSecret: "" # -- Shared secret for authenticating GitLab webhook events gitlabSecret: "" # -- Shared secret for authenticating BitbucketServer webhook events bitbucketServerSecret: "" # -- UUID for authenticating Bitbucket webhook events bitbucketUUID: "" # -- Shared secret for authenticating Gogs webhook events gogsSecret: "" ## Azure DevOps azureDevops: # -- Shared secret username for authenticating Azure DevOps webhook events username: "" # -- Shared secret password for authenticating Azure DevOps webhook events password: "" # -- add additional secrets to be added to argocd-secret ## Custom secrets. Useful for injecting SSO secrets into environment variables. ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets ## Note that all values must be non-empty. extra: {} # LDAP_PASSWORD: "mypassword" # -- Bcrypt hashed admin password ## Argo expects the password in the secret to be bcrypt hashed. You can create this hash with ## `htpasswd -nbBC 10 "" $ARGO_PWD | tr -d ':\n' | sed 's/$2y/$2a/'` argocdServerAdminPassword: "" # -- Admin password modification time. Eg. `"2006-01-02T15:04:05Z"` # @default -- `""` (defaults to current time) argocdServerAdminPasswordMtime: "" # -- Define custom [CSS styles] for your argo instance. # This setting will automatically mount the provided CSS and reference it in the argo configuration. # @default -- `""` (See [values.yaml]) ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/custom-styles/ styles: "" # styles: | # .sidebar { # background: linear-gradient(to bottom, #999, #777, #333, #222, #111); # } # -- Array of extra K8s manifests to deploy ## Note: Supports use of custom Helm templates extraObjects: [] # - apiVersion: secrets-store.csi.x-k8s.io/v1 # kind: SecretProviderClass # metadata: # name: argocd-secrets-store # spec: # provider: aws # parameters: # objects: | # - objectName: "argocd" # objectType: "secretsmanager" # jmesPath: # - path: "client_id" # objectAlias: "client_id" # - path: "client_secret" # objectAlias: "client_secret" # secretObjects: # - data: # - key: client_id # objectName: client_id # - key: client_secret # objectName: client_secret # secretName: argocd-secrets-store # type: Opaque # labels: # app.kubernetes.io/part-of: argocd ## Application controller controller: # -- Application controller name string name: application-controller # -- The number of application controller pods to run. # Additional replicas will cause sharding of managed clusters across number of replicas. ## With dynamic cluster distribution turned on, sharding of the clusters will gracefully ## rebalance if the number of replica's changes or one becomes unhealthy. (alpha) replicas: 1 # -- Enable dynamic cluster distribution (alpha) # Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution ## This is done using a deployment instead of a statefulSet ## When replicas are added or removed, the sharding algorithm is re-run to ensure that the ## clusters are distributed according to the algorithm. If the algorithm is well-balanced, ## like round-robin, then the shards will be well-balanced. dynamicClusterDistribution: false # -- Application controller heartbeat time # Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution/#working-of-dynamic-distribution heartbeatTime: 10 # -- Maximum number of controller revisions that will be maintained in StatefulSet history revisionHistoryLimit: 5 ## Application controller Pod Disruption Budget ## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ pdb: # -- Deploy a [PodDisruptionBudget] for the application controller enabled: false # -- Labels to be added to application controller pdb labels: {} # -- Annotations to be added to application controller pdb annotations: {} # -- Number of pods that are available after eviction as number or percentage (eg.: 50%) # @default -- `""` (defaults to 0 if not specified) minAvailable: "" # -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%). ## Has higher precedence over `controller.pdb.minAvailable` maxUnavailable: "" ## Application controller image image: # -- Repository to use for the application controller # @default -- `""` (defaults to global.image.repository) repository: "" # -- Tag to use for the application controller # @default -- `""` (defaults to global.image.tag) tag: "" # -- Image pull policy for the application controller # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- Secrets with credentials to pull images from a private registry # @default -- `[]` (defaults to global.imagePullSecrets) imagePullSecrets: [] # -- Additional command line arguments to pass to application controller extraArgs: [] # -- Environment variables to pass to application controller env: [] # -- envFrom to pass to application controller # @default -- `[]` (See [values.yaml]) envFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name # -- Additional containers to be added to the application controller pod ## Note: Supports use of custom Helm templates extraContainers: [] # -- Init containers to add to the application controller pod ## If your target Kubernetes cluster(s) require a custom credential (exec) plugin ## you could use this (and the same in the server pod) to provide such executable ## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins ## Note: Supports use of custom Helm templates initContainers: [] # - name: download-tools # image: alpine:3 # command: [sh, -c] # args: # - wget -qO kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.0.25/kubelogin-linux-amd64.zip && # unzip kubelogin.zip && mv bin/linux_amd64/kubelogin /custom-tools/ # volumeMounts: # - mountPath: /custom-tools # name: custom-tools # -- Additional volumeMounts to the application controller main container volumeMounts: [] # - mountPath: /usr/local/bin/kubelogin # name: custom-tools # subPath: kubelogin # -- Additional volumes to the application controller pod volumes: [] # - name: custom-tools # emptyDir: {} # -- Annotations for the application controller StatefulSet statefulsetAnnotations: {} # -- Annotations for the application controller Deployment deploymentAnnotations: {} # -- Annotations to be added to application controller pods podAnnotations: {} # -- Labels to be added to application controller pods podLabels: {} # -- Resource limits and requests for the application controller pods resources: {} # limits: # cpu: 500m # memory: 512Mi # requests: # cpu: 250m # memory: 256Mi # Application controller container ports containerPorts: # -- Metrics container port metrics: 8082 # -- Host Network for application controller pods hostNetwork: false # -- [DNS configuration] dnsConfig: {} # -- Alternative DNS policy for application controller pods dnsPolicy: "ClusterFirst" # -- Application controller container-level security context # @default -- See [values.yaml] containerSecurityContext: runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault capabilities: drop: - ALL # Readiness probe for application controller ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ readinessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 # -- terminationGracePeriodSeconds for container lifecycle hook terminationGracePeriodSeconds: 30 # -- Priority class for the application controller pods # @default -- `""` (defaults to global.priorityClassName) priorityClassName: "" # -- [Node selector] # @default -- `{}` (defaults to global.nodeSelector) nodeSelector: {} # -- [Tolerations] for use with node taints # @default -- `[]` (defaults to global.tolerations) tolerations: [] # -- Assign custom [affinity] rules to the deployment # @default -- `{}` (defaults to global.affinity preset) affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the application controller # @default -- `[]` (defaults to global.topologySpreadConstraints) ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule serviceAccount: # -- Create a service account for the application controller create: true # -- Service account name name: argocd-application-controller # -- Annotations applied to created service account annotations: {} # -- Labels applied to created service account labels: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: true ## Application controller metrics configuration metrics: # -- Deploy metrics service enabled: false # -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used. scrapeTimeout: "" applicationLabels: # -- Enables additional labels in argocd_app_labels metric enabled: false # -- Additional labels labels: [] service: # -- Metrics service type type: ClusterIP # -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP) clusterIP: "" # -- Metrics service annotations annotations: {} # -- Metrics service labels labels: {} # -- Metrics service port servicePort: 8082 # -- Metrics service port name portName: http-metrics serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Prometheus ServiceMonitor interval interval: 30s # -- Prometheus [RelabelConfigs] to apply to samples before scraping relabelings: [] # -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion metricRelabelings: [] # -- Prometheus ServiceMonitor selector selector: {} # prometheus: kube-prometheus # -- Prometheus ServiceMonitor scheme scheme: "" # -- Prometheus ServiceMonitor tlsConfig tlsConfig: {} # -- Prometheus ServiceMonitor namespace namespace: "" # -- Prometheus ServiceMonitor labels additionalLabels: {} # -- Prometheus ServiceMonitor annotations annotations: {} rules: # -- Deploy a PrometheusRule for the application controller enabled: false # -- PrometheusRule namespace namespace: "" # -- PrometheusRule selector selector: {} # prometheus: kube-prometheus # -- PrometheusRule labels additionalLabels: {} # -- PrometheusRule annotations annotations: {} # -- PrometheusRule.Spec for the application controller spec: [] # - alert: ArgoAppMissing # expr: | # absent(argocd_app_info) == 1 # for: 15m # labels: # severity: critical # annotations: # summary: "[Argo CD] No reported applications" # description: > # Argo CD has not reported any applications data for the past 15 minutes which # means that it must be down or not functioning properly. This needs to be # resolved for this cloud to continue to maintain state. # - alert: ArgoAppNotSynced # expr: | # argocd_app_info{sync_status!="Synced"} == 1 # for: 12h # labels: # severity: warning # annotations: # summary: "[{{`{{$labels.name}}`}}] Application not synchronized" # description: > # The application [{{`{{$labels.name}}`}} has not been synchronized for over # 12 hours which means that the state of this cloud has drifted away from the # state inside Git. ## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource. ## Defaults to off clusterRoleRules: # -- Enable custom rules for the application controller's ClusterRole resource enabled: false # -- List of custom rules for the application controller's ClusterRole resource rules: [] ## Dex dex: # -- Enable dex enabled: true # -- Dex name name: dex-server # -- Additional command line arguments to pass to the Dex server extraArgs: [] metrics: # -- Deploy metrics service enabled: false service: # -- Metrics service annotations annotations: {} # -- Metrics service labels labels: {} # -- Metrics service port name portName: http-metrics serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Prometheus ServiceMonitor interval interval: 30s # -- Prometheus [RelabelConfigs] to apply to samples before scraping relabelings: [] # -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion metricRelabelings: [] # -- Prometheus ServiceMonitor selector selector: {} # prometheus: kube-prometheus # -- Prometheus ServiceMonitor scheme scheme: "" # -- Prometheus ServiceMonitor tlsConfig tlsConfig: {} # -- Prometheus ServiceMonitor namespace namespace: "" # -- Prometheus ServiceMonitor labels additionalLabels: {} # -- Prometheus ServiceMonitor annotations annotations: {} ## Dex Pod Disruption Budget ## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ pdb: # -- Deploy a [PodDisruptionBudget] for the Dex server enabled: false # -- Labels to be added to Dex server pdb labels: {} # -- Annotations to be added to Dex server pdb annotations: {} # -- Number of pods that are available after eviction as number or percentage (eg.: 50%) # @default -- `""` (defaults to 0 if not specified) minAvailable: "" # -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%). ## Has higher precedence over `dex.pdb.minAvailable` maxUnavailable: "" ## Dex image image: # -- Dex image repository repository: ghcr.io/dexidp/dex # -- Dex image tag tag: v2.38.0 # -- Dex imagePullPolicy # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- Secrets with credentials to pull images from a private registry # @default -- `[]` (defaults to global.imagePullSecrets) imagePullSecrets: [] # Argo CD init image that creates Dex config initImage: # -- Argo CD init image repository # @default -- `""` (defaults to global.image.repository) repository: "" # -- Argo CD init image tag # @default -- `""` (defaults to global.image.tag) tag: "" # -- Argo CD init image imagePullPolicy # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- Argo CD init image resources # @default -- `{}` (defaults to dex.resources) resources: {} # requests: # cpu: 5m # memory: 96Mi # limits: # cpu: 10m # memory: 144Mi # -- Environment variables to pass to the Dex server env: [] # -- envFrom to pass to the Dex server # @default -- `[]` (See [values.yaml]) envFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name # -- Additional containers to be added to the dex pod ## Note: Supports use of custom Helm templates extraContainers: [] # -- Init containers to add to the dex pod ## Note: Supports use of custom Helm templates initContainers: [] # -- Additional volumeMounts to the dex main container volumeMounts: [] # -- Additional volumes to the dex pod volumes: [] # TLS certificate configuration via Secret ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-dex-server ## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart Dex automatically without extra controllers. certificateSecret: # -- Create argocd-dex-server-tls secret enabled: false # -- Labels to be added to argocd-dex-server-tls secret labels: {} # -- Annotations to be added to argocd-dex-server-tls secret annotations: {} # -- Certificate authority. Required for self-signed certificates. ca: '' # -- Certificate private key key: '' # -- Certificate data. Must contain SANs of Dex service (ie: argocd-dex-server, argocd-dex-server.argo-cd.svc) crt: '' # -- Annotations to be added to the Dex server Deployment deploymentAnnotations: {} # -- Annotations to be added to the Dex server pods podAnnotations: {} # -- Labels to be added to the Dex server pods podLabels: {} # -- Resource limits and requests for dex resources: {} # limits: # cpu: 50m # memory: 64Mi # requests: # cpu: 10m # memory: 32Mi # Dex container ports # NOTE: These ports are currently hardcoded and cannot be changed containerPorts: # -- HTTP container port http: 5556 # -- gRPC container port grpc: 5557 # -- Metrics container port metrics: 5558 # -- [DNS configuration] dnsConfig: {} # -- Alternative DNS policy for Dex server pods dnsPolicy: "ClusterFirst" # -- Dex container-level security context # @default -- See [values.yaml] containerSecurityContext: runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault capabilities: drop: - ALL ## Probes for Dex server ## Supported from Dex >= 2.28.0 livenessProbe: # -- Enable Kubernetes liveness probe for Dex >= 2.28.0 enabled: false # -- Http path to use for the liveness probe httpPath: /healthz/live # -- Http port to use for the liveness probe httpPort: metrics # -- Scheme to use for for the liveness probe (can be HTTP or HTTPS) httpScheme: HTTP # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 readinessProbe: # -- Enable Kubernetes readiness probe for Dex >= 2.28.0 enabled: false # -- Http path to use for the readiness probe httpPath: /healthz/ready # -- Http port to use for the readiness probe httpPort: metrics # -- Scheme to use for for the liveness probe (can be HTTP or HTTPS) httpScheme: HTTP # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 # -- terminationGracePeriodSeconds for container lifecycle hook terminationGracePeriodSeconds: 30 serviceAccount: # -- Create dex service account create: true # -- Dex service account name name: argocd-dex-server # -- Annotations applied to created service account annotations: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: true # -- Service port for HTTP access servicePortHttp: 5556 # -- Service port name for HTTP access servicePortHttpName: http # -- Service port for gRPC access servicePortGrpc: 5557 # -- Service port name for gRPC access servicePortGrpcName: grpc # -- Service port for metrics access servicePortMetrics: 5558 # -- Priority class for the dex pods # @default -- `""` (defaults to global.priorityClassName) priorityClassName: "" # -- [Node selector] # @default -- `{}` (defaults to global.nodeSelector) nodeSelector: {} # -- [Tolerations] for use with node taints # @default -- `[]` (defaults to global.tolerations) tolerations: [] # -- Assign custom [affinity] rules to the deployment # @default -- `{}` (defaults to global.affinity preset) affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to dex # @default -- `[]` (defaults to global.topologySpreadConstraints) ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Deployment strategy to be added to the Dex server Deployment deploymentStrategy: {} # type: RollingUpdate # rollingUpdate: # maxSurge: 25% # maxUnavailable: 25% # -- Dex log format. Either `text` or `json` # @default -- `""` (defaults to global.logging.format) logFormat: "" # -- Dex log level. One of: `debug`, `info`, `warn`, `error` # @default -- `""` (defaults to global.logging.level) logLevel: "" ## Redis redis: # -- Enable redis enabled: true # -- Redis name name: redis ## Redis Pod Disruption Budget ## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ pdb: # -- Deploy a [PodDisruptionBudget] for the Redis enabled: false # -- Labels to be added to Redis pdb labels: {} # -- Annotations to be added to Redis pdb annotations: {} # -- Number of pods that are available after eviction as number or percentage (eg.: 50%) # @default -- `""` (defaults to 0 if not specified) minAvailable: "" # -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%). ## Has higher precedence over `redis.pdb.minAvailable` maxUnavailable: "" ## Redis image image: # -- Redis repository repository: public.ecr.aws/docker/library/redis # -- Redis tag tag: 7.2.4-alpine # -- Redis image pull policy # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" ## Prometheus redis-exporter sidecar exporter: # -- Enable Prometheus redis-exporter sidecar enabled: false # -- Environment variables to pass to the Redis exporter env: [] ## Prometheus redis-exporter image image: # -- Repository to use for the redis-exporter repository: public.ecr.aws/bitnami/redis-exporter # -- Tag to use for the redis-exporter tag: 1.58.0 # -- Image pull policy for the redis-exporter # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- Redis exporter security context # @default -- See [values.yaml] containerSecurityContext: runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault capabilities: drop: - ALL ## Probes for Redis exporter (optional) ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ readinessProbe: # -- Enable Kubernetes liveness probe for Redis exporter (optional) enabled: false # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 30 # -- How often (in seconds) to perform the [probe] periodSeconds: 15 # -- Number of seconds after which the [probe] times out timeoutSeconds: 15 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 5 livenessProbe: # -- Enable Kubernetes liveness probe for Redis exporter enabled: false # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 30 # -- How often (in seconds) to perform the [probe] periodSeconds: 15 # -- Number of seconds after which the [probe] times out timeoutSeconds: 15 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 5 # -- Resource limits and requests for redis-exporter sidecar resources: {} # limits: # cpu: 50m # memory: 64Mi # requests: # cpu: 10m # memory: 32Mi # -- Secrets with credentials to pull images from a private registry # @default -- `[]` (defaults to global.imagePullSecrets) imagePullSecrets: [] # -- Additional command line arguments to pass to redis-server extraArgs: [] # - --bind # - "0.0.0.0" # -- Environment variables to pass to the Redis server env: [] # -- envFrom to pass to the Redis server # @default -- `[]` (See [values.yaml]) envFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name ## Probes for Redis server (optional) ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ readinessProbe: # -- Enable Kubernetes liveness probe for Redis server enabled: false # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 30 # -- How often (in seconds) to perform the [probe] periodSeconds: 15 # -- Number of seconds after which the [probe] times out timeoutSeconds: 15 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 5 livenessProbe: # -- Enable Kubernetes liveness probe for Redis server enabled: false # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 30 # -- How often (in seconds) to perform the [probe] periodSeconds: 15 # -- Number of seconds after which the [probe] times out timeoutSeconds: 15 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 5 # -- Additional containers to be added to the redis pod ## Note: Supports use of custom Helm templates extraContainers: [] # -- Init containers to add to the redis pod ## Note: Supports use of custom Helm templates initContainers: [] # -- Additional volumeMounts to the redis container volumeMounts: [] # -- Additional volumes to the redis pod volumes: [] # -- Annotations to be added to the Redis server Deployment deploymentAnnotations: {} # -- Annotations to be added to the Redis server pods podAnnotations: {} # -- Labels to be added to the Redis server pods podLabels: {} # -- Resource limits and requests for redis resources: {} # limits: # cpu: 200m # memory: 128Mi # requests: # cpu: 100m # memory: 64Mi # -- Redis pod-level security context # @default -- See [values.yaml] securityContext: runAsNonRoot: true runAsUser: 999 seccompProfile: type: RuntimeDefault # Redis container ports containerPorts: # -- Redis container port redis: 6379 # -- Metrics container port metrics: 9121 # -- [DNS configuration] dnsConfig: {} # -- Alternative DNS policy for Redis server pods dnsPolicy: "ClusterFirst" # -- Redis container-level security context # @default -- See [values.yaml] containerSecurityContext: readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: drop: - ALL # -- Redis service port servicePort: 6379 # -- Priority class for redis pods # @default -- `""` (defaults to global.priorityClassName) priorityClassName: "" # -- [Node selector] # @default -- `{}` (defaults to global.nodeSelector) nodeSelector: {} # -- [Tolerations] for use with node taints # @default -- `[]` (defaults to global.tolerations) tolerations: [] # -- Assign custom [affinity] rules to the deployment # @default -- `{}` (defaults to global.affinity preset) affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to redis # @default -- `[]` (defaults to global.topologySpreadConstraints) ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- terminationGracePeriodSeconds for container lifecycle hook terminationGracePeriodSeconds: 30 serviceAccount: # -- Create a service account for the redis pod create: false # -- Service account name for redis pod name: "" # -- Annotations applied to created service account annotations: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: false service: # -- Redis service annotations annotations: {} # -- Additional redis service labels labels: {} metrics: # -- Deploy metrics service enabled: false # Redis metrics service configuration service: # -- Metrics service type type: ClusterIP # -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP) clusterIP: None # -- Metrics service annotations annotations: {} # -- Metrics service labels labels: {} # -- Metrics service port servicePort: 9121 # -- Metrics service port name portName: http-metrics serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Interval at which metrics should be scraped interval: 30s # -- Prometheus [RelabelConfigs] to apply to samples before scraping relabelings: [] # -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion metricRelabelings: [] # -- Prometheus ServiceMonitor selector selector: {} # prometheus: kube-prometheus # -- Prometheus ServiceMonitor scheme scheme: "" # -- Prometheus ServiceMonitor tlsConfig tlsConfig: {} # -- Prometheus ServiceMonitor namespace namespace: "" # -- Prometheus ServiceMonitor labels additionalLabels: {} # -- Prometheus ServiceMonitor annotations annotations: {} ## Redis-HA subchart replaces custom redis deployment when `redis-ha.enabled=true` # Ref: https://github.com/DandyDeveloper/charts/blob/master/charts/redis-ha/values.yaml redis-ha: # -- Enables the Redis HA subchart and disables the custom Redis single node deployment enabled: false ## Redis image image: # -- Redis repository repository: public.ecr.aws/docker/library/redis # -- Redis tag tag: 7.2.4-alpine ## Prometheus redis-exporter sidecar exporter: # -- Enable Prometheus redis-exporter sidecar enabled: false # -- Repository to use for the redis-exporter image: public.ecr.aws/bitnami/redis-exporter # -- Tag to use for the redis-exporter tag: 1.58.0 persistentVolume: # -- Configures persistence on Redis nodes enabled: false ## Redis specific configuration options redis: # -- Redis convention for naming the cluster group: must match `^[\\w-\\.]+$` and can be templated masterGroupName: argocd # -- Any valid redis config options in this section will be applied to each server (see `redis-ha` chart) # @default -- See [values.yaml] config: # -- Will save the DB if both the given number of seconds and the given number of write operations against the DB occurred. `""` is disabled # @default -- `'""'` save: '""' ## Enables a HA Proxy for better LoadBalancing / Sentinel Master support. Automatically proxies to Redis master. haproxy: # -- Enabled HAProxy LoadBalancing/Proxy enabled: true metrics: # -- HAProxy enable prometheus metric scraping enabled: true # -- Whether the haproxy pods should be forced to run on separate nodes. hardAntiAffinity: true # -- Additional affinities to add to the haproxy pods. additionalAffinities: {} # -- Assign custom [affinity] rules to the haproxy pods. affinity: | # -- [Tolerations] for use with node taints for haproxy pods. tolerations: [] # -- HAProxy container-level security context # @default -- See [values.yaml] containerSecurityContext: readOnlyRootFilesystem: true # -- Whether the Redis server pods should be forced to run on separate nodes. hardAntiAffinity: true # -- Additional affinities to add to the Redis server pods. additionalAffinities: {} # -- Assign custom [affinity] rules to the Redis pods. affinity: | # -- [Tolerations] for use with node taints for Redis pods. tolerations: [] # -- Assign custom [TopologySpreadConstraints] rules to the Redis pods. ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ topologySpreadConstraints: # -- Enable Redis HA topology spread constraints enabled: false # -- Max skew of pods tolerated # @default -- `""` (defaults to `1`) maxSkew: "" # -- Topology key for spread # @default -- `""` (defaults to `topology.kubernetes.io/zone`) topologyKey: "" # -- Enforcement policy, hard or soft # @default -- `""` (defaults to `ScheduleAnyway`) whenUnsatisfiable: "" # -- Redis HA statefulset container-level security context # @default -- See [values.yaml] containerSecurityContext: readOnlyRootFilesystem: true # External Redis parameters externalRedis: # -- External Redis server host host: "" # -- External Redis username username: "" # -- External Redis password password: "" # -- External Redis server port port: 6379 # -- The name of an existing secret with Redis credentials (must contain key `redis-password`). # When it's set, the `externalRedis.password` parameter is ignored existingSecret: "" # -- External Redis Secret annotations secretAnnotations: {} ## Server server: # -- Argo CD server name name: server # -- The number of server pods to run replicas: 1 ## Argo CD server Horizontal Pod Autoscaler autoscaling: # -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo CD server enabled: false # -- Minimum number of replicas for the Argo CD server [HPA] minReplicas: 1 # -- Maximum number of replicas for the Argo CD server [HPA] maxReplicas: 5 # -- Average CPU utilization percentage for the Argo CD server [HPA] targetCPUUtilizationPercentage: 50 # -- Average memory utilization percentage for the Argo CD server [HPA] targetMemoryUtilizationPercentage: 50 # -- Configures the scaling behavior of the target in both Up and Down directions. behavior: {} # scaleDown: # stabilizationWindowSeconds: 300 # policies: # - type: Pods # value: 1 # periodSeconds: 180 # scaleUp: # stabilizationWindowSeconds: 300 # policies: # - type: Pods # value: 2 # periodSeconds: 60 # -- Configures custom HPA metrics for the Argo CD server # Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ metrics: [] ## Argo CD server Pod Disruption Budget ## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ pdb: # -- Deploy a [PodDisruptionBudget] for the Argo CD server enabled: false # -- Labels to be added to Argo CD server pdb labels: {} # -- Annotations to be added to Argo CD server pdb annotations: {} # -- Number of pods that are available after eviction as number or percentage (eg.: 50%) # @default -- `""` (defaults to 0 if not specified) minAvailable: "" # -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%). ## Has higher precedence over `server.pdb.minAvailable` maxUnavailable: "" ## Argo CD server image image: # -- Repository to use for the Argo CD server # @default -- `""` (defaults to global.image.repository) repository: "" # defaults to global.image.repository # -- Tag to use for the Argo CD server # @default -- `""` (defaults to global.image.tag) tag: "" # -- Image pull policy for the Argo CD server # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- Secrets with credentials to pull images from a private registry # @default -- `[]` (defaults to global.imagePullSecrets) imagePullSecrets: [] # -- Additional command line arguments to pass to Argo CD server extraArgs: [] # -- Environment variables to pass to Argo CD server env: [] # -- envFrom to pass to Argo CD server # @default -- `[]` (See [values.yaml]) envFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name # -- Specify postStart and preStop lifecycle hooks for your argo-cd-server container lifecycle: {} ## Argo CD extensions ## This function in tech preview stage, do expect instability or breaking changes in newer versions. ## Ref: https://github.com/argoproj-labs/argocd-extension-installer ## When you enable extensions, you need to configure RBAC of logged in Argo CD user. ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#the-extensions-resource extensions: # -- Enable support for Argo CD extensions enabled: false ## Argo CD extension installer image image: # -- Repository to use for extension installer image repository: "quay.io/argoprojlabs/argocd-extension-installer" # -- Tag to use for extension installer image tag: "v0.0.1" # -- Image pull policy for extensions # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- Extensions for Argo CD # @default -- `[]` (See [values.yaml]) ## Ref: https://github.com/argoproj-labs/argocd-extension-metrics#install-ui-extension extensionList: [] # - name: extension-metrics # env: # - name: EXTENSION_URL # value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension.tar.gz # - name: EXTENSION_CHECKSUM_URL # value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension_checksums.txt # -- Server UI extensions container-level security context # @default -- See [values.yaml] containerSecurityContext: runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false runAsUser: 1000 seccompProfile: type: RuntimeDefault capabilities: drop: - ALL # -- Resource limits and requests for the argocd-extensions container resources: {} # limits: # cpu: 50m # memory: 128Mi # requests: # cpu: 10m # memory: 64Mi # -- Additional containers to be added to the server pod ## Note: Supports use of custom Helm templates extraContainers: [] # - name: my-sidecar # image: nginx:latest # - name: lemonldap-ng-controller # image: lemonldapng/lemonldap-ng-controller:0.2.0 # args: # - /lemonldap-ng-controller # - --alsologtostderr # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration # env: # - name: POD_NAME # valueFrom: # fieldRef: # fieldPath: metadata.name # - name: POD_NAMESPACE # valueFrom: # fieldRef: # fieldPath: metadata.namespace # volumeMounts: # - name: copy-portal-skins # mountPath: /srv/var/lib/lemonldap-ng/portal/skins # -- Init containers to add to the server pod ## If your target Kubernetes cluster(s) require a custom credential (exec) plugin ## you could use this (and the same in the application controller pod) to provide such executable ## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins initContainers: [] # - name: download-tools # image: alpine:3 # command: [sh, -c] # args: # - wget -qO kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.0.25/kubelogin-linux-amd64.zip && # unzip kubelogin.zip && mv bin/linux_amd64/kubelogin /custom-tools/ # volumeMounts: # - mountPath: /custom-tools # name: custom-tools # -- Additional volumeMounts to the server main container volumeMounts: [] # - mountPath: /usr/local/bin/kubelogin # name: custom-tools # subPath: kubelogin # -- Additional volumes to the server pod volumes: [] # - name: custom-tools # emptyDir: {} # -- Annotations to be added to server Deployment deploymentAnnotations: {} # -- Annotations to be added to server pods podAnnotations: {} # -- Labels to be added to server pods podLabels: {} # -- Resource limits and requests for the Argo CD server resources: {} # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 50m # memory: 64Mi # Server container ports containerPorts: # -- Server container port server: 8080 # -- Metrics container port metrics: 8083 # -- Host Network for Server pods hostNetwork: false # -- [DNS configuration] dnsConfig: {} # -- Alternative DNS policy for Server pods dnsPolicy: "ClusterFirst" # -- Server container-level security context # @default -- See [values.yaml] containerSecurityContext: runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault capabilities: drop: - ALL ## Readiness and liveness probes for default backend ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ readinessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 livenessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 # -- terminationGracePeriodSeconds for container lifecycle hook terminationGracePeriodSeconds: 30 # -- Priority class for the Argo CD server pods # @default -- `""` (defaults to global.priorityClassName) priorityClassName: "" # -- [Node selector] # @default -- `{}` (defaults to global.nodeSelector) nodeSelector: {} # -- [Tolerations] for use with node taints # @default -- `[]` (defaults to global.tolerations) tolerations: [] # -- Assign custom [affinity] rules to the deployment # @default -- `{}` (defaults to global.affinity preset) affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the Argo CD server # @default -- `[]` (defaults to global.topologySpreadConstraints) ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Deployment strategy to be added to the server Deployment deploymentStrategy: {} # type: RollingUpdate # rollingUpdate: # maxSurge: 25% # maxUnavailable: 25% # TLS certificate configuration via cert-manager ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server certificate: # -- Deploy a Certificate resource (requires cert-manager) enabled: false # -- The name of the Secret that will be automatically created and managed by this Certificate resource secretName: argocd-server-tls # -- Certificate primary domain (commonName) # @default -- `""` (defaults to global.domain) domain: "" # -- Certificate Subject Alternate Names (SANs) additionalHosts: [] # -- The requested 'duration' (i.e. lifetime) of the certificate. # @default -- `""` (defaults to 2160h = 90d if not specified) ## Ref: https://cert-manager.io/docs/usage/certificate/#renewal duration: "" # -- How long before the expiry a certificate should be renewed. # @default -- `""` (defaults to 360h = 15d if not specified) ## Ref: https://cert-manager.io/docs/usage/certificate/#renewal renewBefore: "" # Certificate issuer ## Ref: https://cert-manager.io/docs/concepts/issuer issuer: # -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io` group: "" # -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer` kind: "" # -- Certificate issuer name. Eg. `letsencrypt` name: "" # Private key of the certificate privateKey: # -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always` rotationPolicy: Never # -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8` encoding: PKCS1 # -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA` algorithm: RSA # -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored. size: 2048 # -- Annotations to be applied to the Server Certificate annotations: {} # -- Usages for the certificate ### Ref: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage usages: [] # TLS certificate configuration via Secret ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server certificateSecret: # -- Create argocd-server-tls secret enabled: false # -- Annotations to be added to argocd-server-tls secret annotations: {} # -- Labels to be added to argocd-server-tls secret labels: {} # -- Private Key of the certificate key: '' # -- Certificate data crt: '' ## Server service configuration service: # -- Server service annotations annotations: {} # -- Server service labels labels: {} # -- Server service type type: ClusterIP # -- Server service http port for NodePort service type (only if `server.service.type` is set to "NodePort") nodePortHttp: 30080 # -- Server service https port for NodePort service type (only if `server.service.type` is set to "NodePort") nodePortHttps: 30443 # -- Server service http port servicePortHttp: 80 # -- Server service https port servicePortHttps: 443 # -- Server service http port name, can be used to route traffic via istio servicePortHttpName: http # -- Server service https port name, can be used to route traffic via istio servicePortHttpsName: https # -- Server service https port appProtocol. (should be upper case - i.e. HTTPS) # servicePortHttpsAppProtocol: HTTPS # -- LoadBalancer will get created with the IP specified in this field loadBalancerIP: "" # -- Source IP ranges to allow access to service from loadBalancerSourceRanges: [] # -- Server service external IPs externalIPs: [] # -- Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints externalTrafficPolicy: "" # -- Used to maintain session affinity. Supports `ClientIP` and `None` sessionAffinity: "" ## Server metrics service configuration metrics: # -- Deploy metrics service enabled: false service: # -- Metrics service type type: ClusterIP # -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP) clusterIP: "" # -- Metrics service annotations annotations: {} # -- Metrics service labels labels: {} # -- Metrics service port servicePort: 8083 # -- Metrics service port name portName: http-metrics serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Prometheus ServiceMonitor interval interval: 30s # -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used. scrapeTimeout: "" # -- Prometheus [RelabelConfigs] to apply to samples before scraping relabelings: [] # -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion metricRelabelings: [] # -- Prometheus ServiceMonitor selector selector: {} # prometheus: kube-prometheus # -- Prometheus ServiceMonitor scheme scheme: "" # -- Prometheus ServiceMonitor tlsConfig tlsConfig: {} # -- Prometheus ServiceMonitor namespace namespace: "" # monitoring # -- Prometheus ServiceMonitor labels additionalLabels: {} # -- Prometheus ServiceMonitor annotations annotations: {} serviceAccount: # -- Create server service account create: true # -- Server service account name name: argocd-server # -- Annotations applied to created service account annotations: {} # -- Labels applied to created service account labels: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: true # Argo CD server ingress configuration ingress: # -- Enable an ingress resource for the Argo CD server enabled: false # -- Specific implementation for ingress controller. One of `generic`, `aws` or `gke` ## Additional configuration might be required in related configuration sections controller: generic # -- Additional ingress labels labels: {} # -- Additional ingress annotations ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough annotations: {} # nginx.ingress.kubernetes.io/force-ssl-redirect: "true" # nginx.ingress.kubernetes.io/ssl-passthrough: "true" # -- Defines which ingress controller will implement the resource ingressClassName: "" # -- Argo CD server hostname # @default -- `""` (defaults to global.domain) hostname: "" # -- The path to Argo CD server path: / # -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific` pathType: Prefix # -- Enable TLS configuration for the hostname defined at `server.ingress.hostname` ## TLS certificate will be retrieved from a TLS secret `argocd-server-tls` ## You can create this secret via `certificate` or `certificateSecret` option tls: false # -- The list of additional hostnames to be covered by ingress record # @default -- `[]` (See [values.yaml]) extraHosts: [] # - name: argocd.example.com # path: / # -- Additional ingress paths # @default -- `[]` (See [values.yaml]) ## Note: Supports use of custom Helm templates extraPaths: [] # - path: /* # pathType: Prefix # backend: # service: # name: ssl-redirect # port: # name: use-annotation # -- Additional ingress rules # @default -- `[]` (See [values.yaml]) ## Note: Supports use of custom Helm templates extraRules: [] # - http: # paths: # - path: / # pathType: Prefix # backend: # service: # name: '{{ include "argo-cd.server.fullname" . }}' # port: # name: '{{ .Values.server.service.servicePortHttpsName }}' # -- Additional TLS configuration # @default -- `[]` (See [values.yaml]) extraTls: [] # - hosts: # - argocd.example.com # secretName: your-certificate-name # AWS specific options for Application Load Balancer # Applies only when `serv.ingress.controller` is set to `aws` ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#aws-application-load-balancers-albs-and-classic-elb-http-mode aws: # -- Backend protocol version for the AWS ALB gRPC service ## This tells AWS to send traffic from the ALB using gRPC. ## For more information: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html#health-check-settings backendProtocolVersion: GRPC # -- Service type for the AWS ALB gRPC service ## Can be of type NodePort or ClusterIP depending on which mode you are running. ## Instance mode needs type NodePort, IP mode needs type ClusterIP ## Ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/how-it-works/#ingress-traffic serviceType: NodePort # Google specific options for Google Application Load Balancer # Applies only when `server.ingress.controller` is set to `gke` ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#google-cloud-load-balancers-with-kubernetes-ingress gke: # -- Google [BackendConfig] resource, for use with the GKE Ingress Controller # @default -- `{}` (See [values.yaml]) ## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters backendConfig: {} # iap: # enabled: true # oauthclientCredentials: # secretName: argocd-secret # -- Google [FrontendConfig] resource, for use with the GKE Ingress Controller # @default -- `{}` (See [values.yaml]) ## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters frontendConfig: {} # redirectToHttps: # enabled: true # responseCodeName: RESPONSE_CODE # Managed GKE certificate for ingress hostname managedCertificate: # -- Create ManagedCertificate resource and annotations for Google Load balancer ## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs create: true # -- Additional domains for ManagedCertificate resource extraDomains: [] # - argocd.example.com # Dedicated gRPC ingress for ingress controllers that supports only single backend protocol per Ingress resource # Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts ingressGrpc: # -- Enable an ingress resource for the Argo CD server for dedicated [gRPC-ingress] enabled: false # -- Additional ingress annotations for dedicated [gRPC-ingress] annotations: {} # -- Additional ingress labels for dedicated [gRPC-ingress] labels: {} # -- Defines which ingress controller will implement the resource [gRPC-ingress] ingressClassName: "" # -- Argo CD server hostname for dedicated [gRPC-ingress] # @default -- `""` (defaults to grpc.`server.ingress.hostname`) hostname: "" # -- Argo CD server ingress path for dedicated [gRPC-ingress] path: / # -- Ingress path type for dedicated [gRPC-ingress]. One of `Exact`, `Prefix` or `ImplementationSpecific` pathType: Prefix # -- Enable TLS configuration for the hostname defined at `server.ingressGrpc.hostname` ## TLS certificate will be retrieved from a TLS secret with name: `argocd-server-grpc-tls` tls: false # -- The list of additional hostnames to be covered by ingress record # @default -- `[]` (See [values.yaml]) extraHosts: [] # - name: grpc.argocd.example.com # path: / # -- Additional ingress paths for dedicated [gRPC-ingress] # @default -- `[]` (See [values.yaml]) ## Note: Supports use of custom Helm templates extraPaths: [] # - path: /* # pathType: Prefix # backend: # service: # name: ssl-redirect # port: # name: use-annotation # -- Additional ingress rules # @default -- `[]` (See [values.yaml]) ## Note: Supports use of custom Helm templates extraRules: [] # - http: # paths: # - path: / # pathType: Prefix # backend: # service: # name: '{{ include "argo-cd.server.fullname" . }}' # port: # name: '{{ .Values.server.service.servicePortHttpName }}' # -- Additional TLS configuration for dedicated [gRPC-ingress] # @default -- `[]` (See [values.yaml]) extraTls: [] # - secretName: your-certificate-name # hosts: # - argocd.example.com # Create a OpenShift Route with SSL passthrough for UI and CLI # Consider setting 'hostname' e.g. https://argocd.apps-crc.testing/ using your Default Ingress Controller Domain # Find your domain with: kubectl describe --namespace=openshift-ingress-operator ingresscontroller/default | grep Domain: # If 'hostname' is an empty string "" OpenShift will create a hostname for you. route: # -- Enable an OpenShift Route for the Argo CD server enabled: false # -- Openshift Route annotations annotations: {} # -- Hostname of OpenShift Route hostname: "" # -- Termination type of Openshift Route termination_type: passthrough # -- Termination policy of Openshift Route termination_policy: None ## Repo Server repoServer: # -- Repo server name name: repo-server # -- The number of repo server pods to run replicas: 1 ## Repo server Horizontal Pod Autoscaler autoscaling: # -- Enable Horizontal Pod Autoscaler ([HPA]) for the repo server enabled: false # -- Minimum number of replicas for the repo server [HPA] minReplicas: 1 # -- Maximum number of replicas for the repo server [HPA] maxReplicas: 5 # -- Average CPU utilization percentage for the repo server [HPA] targetCPUUtilizationPercentage: 50 # -- Average memory utilization percentage for the repo server [HPA] targetMemoryUtilizationPercentage: 50 # -- Configures the scaling behavior of the target in both Up and Down directions. behavior: {} # scaleDown: # stabilizationWindowSeconds: 300 # policies: # - type: Pods # value: 1 # periodSeconds: 180 # scaleUp: # stabilizationWindowSeconds: 300 # policies: # - type: Pods # value: 2 # periodSeconds: 60 # -- Configures custom HPA metrics for the Argo CD repo server # Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ metrics: [] ## Repo server Pod Disruption Budget ## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ pdb: # -- Deploy a [PodDisruptionBudget] for the repo server enabled: false # -- Labels to be added to repo server pdb labels: {} # -- Annotations to be added to repo server pdb annotations: {} # -- Number of pods that are available after eviction as number or percentage (eg.: 50%) # @default -- `""` (defaults to 0 if not specified) minAvailable: "" # -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%). ## Has higher precedence over `repoServer.pdb.minAvailable` maxUnavailable: "" ## Repo server image image: # -- Repository to use for the repo server # @default -- `""` (defaults to global.image.repository) repository: "" # -- Tag to use for the repo server # @default -- `""` (defaults to global.image.tag) tag: "" # -- Image pull policy for the repo server # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- Secrets with credentials to pull images from a private registry # @default -- `[]` (defaults to global.imagePullSecrets) imagePullSecrets: [] # -- Additional command line arguments to pass to repo server extraArgs: [] # -- Environment variables to pass to repo server env: [] # -- envFrom to pass to repo server # @default -- `[]` (See [values.yaml]) envFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name # -- Specify postStart and preStop lifecycle hooks for your argo-repo-server container lifecycle: {} # -- Additional containers to be added to the repo server pod ## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/ ## Note: Supports use of custom Helm templates extraContainers: [] # - name: cmp-my-plugin # command: # - "/var/run/argocd/argocd-cmp-server" # image: busybox # securityContext: # runAsNonRoot: true # runAsUser: 999 # volumeMounts: # - mountPath: /var/run/argocd # name: var-files # - mountPath: /home/argocd/cmp-server/plugins # name: plugins # # Remove this volumeMount if you've chosen to bake the config file into the sidecar image. # - mountPath: /home/argocd/cmp-server/config/plugin.yaml # subPath: my-plugin.yaml # name: argocd-cmp-cm # # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps # # mitigate path traversal attacks. # - mountPath: /tmp # name: cmp-tmp # - name: cmp-my-plugin2 # command: # - "/var/run/argocd/argocd-cmp-server" # image: busybox # securityContext: # runAsNonRoot: true # runAsUser: 999 # volumeMounts: # - mountPath: /var/run/argocd # name: var-files # # Remove this volumeMount if you've chosen to bake the config file into the sidecar image. # - mountPath: /home/argocd/cmp-server/plugins # name: plugins # - mountPath: /home/argocd/cmp-server/config/plugin.yaml # subPath: my-plugin2.yaml # name: argocd-cmp-cm # # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps # # mitigate path traversal attacks. # - mountPath: /tmp # name: cmp-tmp # -- Init containers to add to the repo server pods initContainers: [] # -- Additional volumeMounts to the repo server main container volumeMounts: [] # -- Additional volumes to the repo server pod volumes: [] # - name: argocd-cmp-cm # configMap: # name: argocd-cmp-cm # - name: cmp-tmp # emptyDir: {} # -- Volumes to be used in replacement of emptydir on default volumes existingVolumes: {} # gpgKeyring: # persistentVolumeClaim: # claimName: pvc-argocd-repo-server-keyring # helmWorkingDir: # persistentVolumeClaim: # claimName: pvc-argocd-repo-server-workdir # tmp: # persistentVolumeClaim: # claimName: pvc-argocd-repo-server-tmp # varFiles: # persistentVolumeClaim: # claimName: pvc-argocd-repo-server-varfiles # plugins: # persistentVolumeClaim: # claimName: pvc-argocd-repo-server-plugins # -- Toggle the usage of a ephemeral Helm working directory useEphemeralHelmWorkingDir: true # -- Annotations to be added to repo server Deployment deploymentAnnotations: {} # -- Annotations to be added to repo server pods podAnnotations: {} # -- Labels to be added to repo server pods podLabels: {} # -- Resource limits and requests for the repo server pods resources: {} # limits: # cpu: 50m # memory: 128Mi # requests: # cpu: 10m # memory: 64Mi # Repo server container ports containerPorts: # -- Repo server container port server: 8081 # -- Metrics container port metrics: 8084 # -- Host Network for Repo server pods hostNetwork: false # -- [DNS configuration] dnsConfig: {} # -- Alternative DNS policy for Repo server pods dnsPolicy: "ClusterFirst" # -- Repo server container-level security context # @default -- See [values.yaml] containerSecurityContext: runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault capabilities: drop: - ALL ## Readiness and liveness probes for default backend ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ readinessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 livenessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 # -- terminationGracePeriodSeconds for container lifecycle hook terminationGracePeriodSeconds: 30 # -- [Node selector] # @default -- `{}` (defaults to global.nodeSelector) nodeSelector: {} # -- [Tolerations] for use with node taints # @default -- `[]` (defaults to global.tolerations) tolerations: [] # -- Assign custom [affinity] rules to the deployment # @default -- `{}` (defaults to global.affinity preset) affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the repo server # @default -- `[]` (defaults to global.topologySpreadConstraints) ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Deployment strategy to be added to the repo server Deployment deploymentStrategy: {} # type: RollingUpdate # rollingUpdate: # maxSurge: 25% # maxUnavailable: 25% # -- Priority class for the repo server pods # @default -- `""` (defaults to global.priorityClassName) priorityClassName: "" # TLS certificate configuration via Secret ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-repo-server ## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart repo server automatically without extra controllers. certificateSecret: # -- Create argocd-repo-server-tls secret enabled: false # -- Annotations to be added to argocd-repo-server-tls secret annotations: {} # -- Labels to be added to argocd-repo-server-tls secret labels: {} # -- Certificate authority. Required for self-signed certificates. ca: '' # -- Certificate private key key: '' # -- Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc) crt: '' ## Repo server service configuration service: # -- Repo server service annotations annotations: {} # -- Repo server service labels labels: {} # -- Repo server service port port: 8081 # -- Repo server service port name portName: tcp-repo-server ## Repo server metrics service configuration metrics: # -- Deploy metrics service enabled: false service: # -- Metrics service type type: ClusterIP # -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP) clusterIP: "" # -- Metrics service annotations annotations: {} # -- Metrics service labels labels: {} # -- Metrics service port servicePort: 8084 # -- Metrics service port name portName: http-metrics serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Prometheus ServiceMonitor interval interval: 30s # -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used. scrapeTimeout: "" # -- Prometheus [RelabelConfigs] to apply to samples before scraping relabelings: [] # -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion metricRelabelings: [] # -- Prometheus ServiceMonitor selector selector: {} # prometheus: kube-prometheus # -- Prometheus ServiceMonitor scheme scheme: "" # -- Prometheus ServiceMonitor tlsConfig tlsConfig: {} # -- Prometheus ServiceMonitor namespace namespace: "" # -- Prometheus ServiceMonitor labels additionalLabels: {} # -- Prometheus ServiceMonitor annotations annotations: {} ## Enable Custom Rules for the Repo server's Cluster Role resource ## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource. ## Defaults to off clusterRoleRules: # -- Enable custom rules for the Repo server's Cluster Role resource enabled: false # -- List of custom rules for the Repo server's Cluster Role resource rules: [] ## Repo server service account ## If create is set to true, make sure to uncomment the name and update the rbac section below serviceAccount: # -- Create repo server service account create: true # -- Repo server service account name name: "" # -- Annotations applied to created service account annotations: {} # -- Labels applied to created service account labels: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: true # -- Repo server rbac rules rbac: [] # - apiGroups: # - argoproj.io # resources: # - applications # verbs: # - get # - list # - watch ## ApplicationSet controller applicationSet: # -- Enable ApplicationSet controller enabled: true # -- ApplicationSet controller name string name: applicationset-controller # -- The number of ApplicationSet controller pods to run replicas: 1 ## ApplicationSet controller Pod Disruption Budget ## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ pdb: # -- Deploy a [PodDisruptionBudget] for the ApplicationSet controller enabled: false # -- Labels to be added to ApplicationSet controller pdb labels: {} # -- Annotations to be added to ApplicationSet controller pdb annotations: {} # -- Number of pods that are available after eviction as number or percentage (eg.: 50%) # @default -- `""` (defaults to 0 if not specified) minAvailable: "" # -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%). ## Has higher precedence over `applicationSet.pdb.minAvailable` maxUnavailable: "" ## ApplicationSet controller image image: # -- Repository to use for the ApplicationSet controller # @default -- `""` (defaults to global.image.repository) repository: "" # -- Tag to use for the ApplicationSet controller # @default -- `""` (defaults to global.image.tag) tag: "" # -- Image pull policy for the ApplicationSet controller # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- If defined, uses a Secret to pull an image from a private Docker registry or repository. # @default -- `[]` (defaults to global.imagePullSecrets) imagePullSecrets: [] # -- ApplicationSet controller command line flags extraArgs: [] # -- Environment variables to pass to the ApplicationSet controller extraEnv: [] # - name: "MY_VAR" # value: "value" # -- envFrom to pass to the ApplicationSet controller # @default -- `[]` (See [values.yaml]) extraEnvFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name # -- Additional containers to be added to the ApplicationSet controller pod ## Note: Supports use of custom Helm templates extraContainers: [] # -- Init containers to add to the ApplicationSet controller pod ## Note: Supports use of custom Helm templates initContainers: [] # -- List of extra mounts to add (normally used with extraVolumes) extraVolumeMounts: [] # -- List of extra volumes to add extraVolumes: [] ## Metrics service configuration metrics: # -- Deploy metrics service enabled: false service: # -- Metrics service type type: ClusterIP # -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP) clusterIP: "" # -- Metrics service annotations annotations: {} # -- Metrics service labels labels: {} # -- Metrics service port servicePort: 8080 # -- Metrics service port name portName: http-metrics serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Prometheus ServiceMonitor interval interval: 30s # -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used. scrapeTimeout: "" # -- Prometheus [RelabelConfigs] to apply to samples before scraping relabelings: [] # -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion metricRelabelings: [] # -- Prometheus ServiceMonitor selector selector: {} # prometheus: kube-prometheus # -- Prometheus ServiceMonitor scheme scheme: "" # -- Prometheus ServiceMonitor tlsConfig tlsConfig: {} # -- Prometheus ServiceMonitor namespace namespace: "" # monitoring # -- Prometheus ServiceMonitor labels additionalLabels: {} # -- Prometheus ServiceMonitor annotations annotations: {} ## ApplicationSet service configuration service: # -- ApplicationSet service annotations annotations: {} # -- ApplicationSet service labels labels: {} # -- ApplicationSet service type type: ClusterIP # -- ApplicationSet service port port: 7000 # -- ApplicationSet service port name portName: http-webhook serviceAccount: # -- Create ApplicationSet controller service account create: true # -- ApplicationSet controller service account name name: argocd-applicationset-controller # -- Annotations applied to created service account annotations: {} # -- Labels applied to created service account labels: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: true # -- Annotations to be added to ApplicationSet controller Deployment deploymentAnnotations: {} # -- Annotations for the ApplicationSet controller pods podAnnotations: {} # -- Labels for the ApplicationSet controller pods podLabels: {} # -- Resource limits and requests for the ApplicationSet controller pods. resources: {} # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi # ApplicationSet controller container ports containerPorts: # -- Metrics container port metrics: 8080 # -- Probe container port probe: 8081 # -- Webhook container port webhook: 7000 # -- [DNS configuration] dnsConfig: {} # -- Alternative DNS policy for ApplicationSet controller pods dnsPolicy: "ClusterFirst" # -- ApplicationSet controller container-level security context # @default -- See [values.yaml] containerSecurityContext: runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault capabilities: drop: - ALL ## Probes for ApplicationSet controller (optional) ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ readinessProbe: # -- Enable Kubernetes liveness probe for ApplicationSet controller enabled: false # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 livenessProbe: # -- Enable Kubernetes liveness probe for ApplicationSet controller enabled: false # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- terminationGracePeriodSeconds for container lifecycle hook terminationGracePeriodSeconds: 30 # -- [Node selector] # @default -- `{}` (defaults to global.nodeSelector) nodeSelector: {} # -- [Tolerations] for use with node taints # @default -- `[]` (defaults to global.tolerations) tolerations: [] # -- Assign custom [affinity] rules # @default -- `{}` (defaults to global.affinity preset) affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the ApplicationSet controller # @default -- `[]` (defaults to global.topologySpreadConstraints) ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Deployment strategy to be added to the ApplicationSet controller Deployment deploymentStrategy: {} # type: RollingUpdate # rollingUpdate: # maxSurge: 25% # maxUnavailable: 25% # -- Priority class for the ApplicationSet controller pods # @default -- `""` (defaults to global.priorityClassName) priorityClassName: "" # TLS certificate configuration via cert-manager ## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-configuration certificate: # -- Deploy a Certificate resource (requires cert-manager) enabled: false # -- The name of the Secret that will be automatically created and managed by this Certificate resource secretName: argocd-applicationset-controller-tls # -- Certificate primary domain (commonName) # @default -- `""` (defaults to global.domain) domain: "" # -- Certificate Subject Alternate Names (SANs) additionalHosts: [] # -- The requested 'duration' (i.e. lifetime) of the certificate. # @default -- `""` (defaults to 2160h = 90d if not specified) ## Ref: https://cert-manager.io/docs/usage/certificate/#renewal duration: "" # -- How long before the expiry a certificate should be renewed. # @default -- `""` (defaults to 360h = 15d if not specified) ## Ref: https://cert-manager.io/docs/usage/certificate/#renewal renewBefore: "" # Certificate issuer ## Ref: https://cert-manager.io/docs/concepts/issuer issuer: # -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io` group: "" # -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer` kind: "" # -- Certificate issuer name. Eg. `letsencrypt` name: "" # Private key of the certificate privateKey: # -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always` rotationPolicy: Never # -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8` encoding: PKCS1 # -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA` algorithm: RSA # -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored. size: 2048 # -- Annotations to be applied to the ApplicationSet Certificate annotations: {} ## Ingress for the Git Generator webhook ## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration) ingress: # -- Enable an ingress resource for ApplicationSet webhook enabled: false # -- Additional ingress labels labels: {} # -- Additional ingress annotations annotations: {} # -- Defines which ingress ApplicationSet controller will implement the resource ingressClassName: "" # -- Argo CD ApplicationSet hostname # @default -- `""` (defaults to global.domain) hostname: "" # -- List of ingress paths path: /api/webhook # -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific` pathType: Prefix # -- Enable TLS configuration for the hostname defined at `applicationSet.webhook.ingress.hostname` ## TLS certificate will be retrieved from a TLS secret with name:`argocd-applicationset-controller-tls` tls: false # -- The list of additional hostnames to be covered by ingress record # @default -- `[]` (See [values.yaml]) extraHosts: [] # - name: argocd.example.com # path: / # -- Additional ingress paths # @default -- `[]` (See [values.yaml]) extraPaths: [] # - path: /* # pathType: Prefix # backend: # service: # name: ssl-redirect # port: # name: use-annotation # -- Additional ingress rules # @default -- `[]` (See [values.yaml]) ## Note: Supports use of custom Helm templates extraRules: [] # - http: # paths: # - path: /api/webhook # pathType: Prefix # backend: # service: # name: '{{ include "argo-cd.applicationSet.fullname" . }}' # port: # name: '{{ .Values.applicationSet.service.portName }}' # -- Additional ingress TLS configuration # @default -- `[]` (See [values.yaml]) extraTls: [] # - secretName: argocd-applicationset-tls # hosts: # - argocd-applicationset.example.com # -- Enable ApplicationSet in any namespace feature allowAnyNamespace: false ## Notifications controller notifications: # -- Enable notifications controller enabled: true # -- Notifications controller name string name: notifications-controller # -- Argo CD dashboard url; used in place of {{.context.argocdUrl}} in templates # @default -- `""` (defaults to https://`global.domain`) argocdUrl: "" ## Notifications controller Pod Disruption Budget ## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ pdb: # -- Deploy a [PodDisruptionBudget] for the notifications controller enabled: false # -- Labels to be added to notifications controller pdb labels: {} # -- Annotations to be added to notifications controller pdb annotations: {} # -- Number of pods that are available after eviction as number or percentage (eg.: 50%) # @default -- `""` (defaults to 0 if not specified) minAvailable: "" # -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%). ## Has higher precedence over `notifications.pdb.minAvailable` maxUnavailable: "" ## Notifications controller image image: # -- Repository to use for the notifications controller # @default -- `""` (defaults to global.image.repository) repository: "" # -- Tag to use for the notifications controller # @default -- `""` (defaults to global.image.tag) tag: "" # -- Image pull policy for the notifications controller # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- Secrets with credentials to pull images from a private registry # @default -- `[]` (defaults to global.imagePullSecrets) imagePullSecrets: [] # -- Notifications controller log format. Either `text` or `json` # @default -- `""` (defaults to global.logging.format) logFormat: "" # -- Notifications controller log level. One of: `debug`, `info`, `warn`, `error` # @default -- `""` (defaults to global.logging.level) logLevel: "" # -- Extra arguments to provide to the notifications controller extraArgs: [] # -- Additional container environment variables extraEnv: [] # -- envFrom to pass to the notifications controller # @default -- `[]` (See [values.yaml]) extraEnvFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name # -- Additional containers to be added to the notifications controller pod ## Note: Supports use of custom Helm templates extraContainers: [] # -- Init containers to add to the notifications controller pod ## Note: Supports use of custom Helm templates initContainers: [] # -- List of extra mounts to add (normally used with extraVolumes) extraVolumeMounts: [] # -- List of extra volumes to add extraVolumes: [] # -- Define user-defined context ## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/#defining-user-defined-context context: {} # region: east # environmentName: staging secret: # -- Whether helm chart creates notifications controller secret ## If true, will create a secret with the name below. Otherwise, will assume existence of a secret with that name. create: true # -- notifications controller Secret name name: "argocd-notifications-secret" # -- key:value pairs of annotations to be added to the secret annotations: {} # -- key:value pairs of labels to be added to the secret labels: {} # -- Generic key:value pairs to be inserted into the secret ## Can be used for templates, notification services etc. Some examples given below. ## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/ items: {} # slack-token: # # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/slack/ # grafana-apiKey: # # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/grafana/ # webhooks-github-token: # email-username: # email-password: # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/email/ metrics: # -- Enables prometheus metrics server enabled: false # -- Metrics port port: 9001 service: # -- Metrics service type type: ClusterIP # -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP) clusterIP: "" # -- Metrics service annotations annotations: {} # -- Metrics service labels labels: {} # -- Metrics service port name portName: http-metrics serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Prometheus ServiceMonitor selector selector: {} # prometheus: kube-prometheus # -- Prometheus ServiceMonitor labels additionalLabels: {} # -- Prometheus ServiceMonitor annotations annotations: {} # namespace: monitoring # interval: 30s # scrapeTimeout: 10s # -- Prometheus ServiceMonitor scheme scheme: "" # -- Prometheus ServiceMonitor tlsConfig tlsConfig: {} # -- Prometheus [RelabelConfigs] to apply to samples before scraping relabelings: [] # -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion metricRelabelings: [] # -- Configures notification services such as slack, email or custom webhook # @default -- See [values.yaml] ## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/ notifiers: {} # service.slack: | # token: $slack-token # -- Annotations to be applied to the notifications controller Deployment deploymentAnnotations: {} # -- Annotations to be applied to the notifications controller Pods podAnnotations: {} # -- Labels to be applied to the notifications controller Pods podLabels: {} # -- Resource limits and requests for the notifications controller resources: {} # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi # Notification controller container ports containerPorts: # -- Metrics container port metrics: 9001 # -- [DNS configuration] dnsConfig: {} # -- Alternative DNS policy for notifications controller Pods dnsPolicy: "ClusterFirst" # -- Notification controller container-level security Context # @default -- See [values.yaml] containerSecurityContext: runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault capabilities: drop: - ALL # -- terminationGracePeriodSeconds for container lifecycle hook terminationGracePeriodSeconds: 30 # -- [Node selector] # @default -- `{}` (defaults to global.nodeSelector) nodeSelector: {} # -- [Tolerations] for use with node taints # @default -- `[]` (defaults to global.tolerations) tolerations: [] # -- Assign custom [affinity] rules # @default -- `{}` (defaults to global.affinity preset) affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the application controller # @default -- `[]` (defaults to global.topologySpreadConstraints) ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Deployment strategy to be added to the notifications controller Deployment deploymentStrategy: type: Recreate # -- Priority class for the notifications controller pods # @default -- `""` (defaults to global.priorityClassName) priorityClassName: "" serviceAccount: # -- Create notifications controller service account create: true # -- Notification controller service account name name: argocd-notifications-controller # -- Annotations applied to created service account annotations: {} # -- Labels applied to created service account labels: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: true cm: # -- Whether helm chart creates notifications controller config map create: true ## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource. ## Defaults to off clusterRoleRules: # -- List of custom rules for the notifications controller's ClusterRole resource rules: [] # -- Contains centrally managed global application subscriptions ## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/subscriptions/ subscriptions: [] # # subscription for on-sync-status-unknown trigger notifications # - recipients: # - slack:test2 # - email:test@gmail.com # triggers: # - on-sync-status-unknown # # subscription restricted to applications with matching labels only # - recipients: # - slack:test3 # selector: test=true # triggers: # - on-sync-status-unknown # -- The notification template is used to generate the notification content ## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/ templates: {} # template.app-deployed: | # email: # subject: New version of an application {{.app.metadata.name}} is up and running. # message: | # {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests. # slack: # attachments: | # [{ # "title": "{{ .app.metadata.name}}", # "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", # "color": "#18be52", # "fields": [ # { # "title": "Sync Status", # "value": "{{.app.status.sync.status}}", # "short": true # }, # { # "title": "Repository", # "value": "{{.app.spec.source.repoURL}}", # "short": true # }, # { # "title": "Revision", # "value": "{{.app.status.sync.revision}}", # "short": true # } # {{range $index, $c := .app.status.conditions}} # {{if not $index}},{{end}} # {{if $index}},{{end}} # { # "title": "{{$c.type}}", # "value": "{{$c.message}}", # "short": true # } # {{end}} # ] # }] # template.app-health-degraded: | # email: # subject: Application {{.app.metadata.name}} has degraded. # message: | # {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded. # Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}. # slack: # attachments: |- # [{ # "title": "{{ .app.metadata.name}}", # "title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", # "color": "#f4c030", # "fields": [ # { # "title": "Sync Status", # "value": "{{.app.status.sync.status}}", # "short": true # }, # { # "title": "Repository", # "value": "{{.app.spec.source.repoURL}}", # "short": true # } # {{range $index, $c := .app.status.conditions}} # {{if not $index}},{{end}} # {{if $index}},{{end}} # { # "title": "{{$c.type}}", # "value": "{{$c.message}}", # "short": true # } # {{end}} # ] # }] # template.app-sync-failed: | # email: # subject: Failed to sync application {{.app.metadata.name}}. # message: | # {{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}} # Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true . # slack: # attachments: |- # [{ # "title": "{{ .app.metadata.name}}", # "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", # "color": "#E96D76", # "fields": [ # { # "title": "Sync Status", # "value": "{{.app.status.sync.status}}", # "short": true # }, # { # "title": "Repository", # "value": "{{.app.spec.source.repoURL}}", # "short": true # } # {{range $index, $c := .app.status.conditions}} # {{if not $index}},{{end}} # {{if $index}},{{end}} # { # "title": "{{$c.type}}", # "value": "{{$c.message}}", # "short": true # } # {{end}} # ] # }] # template.app-sync-running: | # email: # subject: Start syncing application {{.app.metadata.name}}. # message: | # The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}. # Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true . # slack: # attachments: |- # [{ # "title": "{{ .app.metadata.name}}", # "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", # "color": "#0DADEA", # "fields": [ # { # "title": "Sync Status", # "value": "{{.app.status.sync.status}}", # "short": true # }, # { # "title": "Repository", # "value": "{{.app.spec.source.repoURL}}", # "short": true # } # {{range $index, $c := .app.status.conditions}} # {{if not $index}},{{end}} # {{if $index}},{{end}} # { # "title": "{{$c.type}}", # "value": "{{$c.message}}", # "short": true # } # {{end}} # ] # }] # template.app-sync-status-unknown: | # email: # subject: Application {{.app.metadata.name}} sync status is 'Unknown' # message: | # {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'. # Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}. # {{if ne .serviceType "slack"}} # {{range $c := .app.status.conditions}} # * {{$c.message}} # {{end}} # {{end}} # slack: # attachments: |- # [{ # "title": "{{ .app.metadata.name}}", # "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", # "color": "#E96D76", # "fields": [ # { # "title": "Sync Status", # "value": "{{.app.status.sync.status}}", # "short": true # }, # { # "title": "Repository", # "value": "{{.app.spec.source.repoURL}}", # "short": true # } # {{range $index, $c := .app.status.conditions}} # {{if not $index}},{{end}} # {{if $index}},{{end}} # { # "title": "{{$c.type}}", # "value": "{{$c.message}}", # "short": true # } # {{end}} # ] # }] # template.app-sync-succeeded: | # email: # subject: Application {{.app.metadata.name}} has been successfully synced. # message: | # {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}. # Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true . # slack: # attachments: |- # [{ # "title": "{{ .app.metadata.name}}", # "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", # "color": "#18be52", # "fields": [ # { # "title": "Sync Status", # "value": "{{.app.status.sync.status}}", # "short": true # }, # { # "title": "Repository", # "value": "{{.app.spec.source.repoURL}}", # "short": true # } # {{range $index, $c := .app.status.conditions}} # {{if not $index}},{{end}} # {{if $index}},{{end}} # { # "title": "{{$c.type}}", # "value": "{{$c.message}}", # "short": true # } # {{end}} # ] # }] # -- The trigger defines the condition when the notification should be sent ## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/ triggers: {} # trigger.on-deployed: | # - description: Application is synced and healthy. Triggered once per commit. # oncePer: app.status.sync.revision # send: # - app-deployed # when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status == 'Healthy' # trigger.on-health-degraded: | # - description: Application has degraded # send: # - app-health-degraded # when: app.status.health.status == 'Degraded' # trigger.on-sync-failed: | # - description: Application syncing has failed # send: # - app-sync-failed # when: app.status.operationState.phase in ['Error', 'Failed'] # trigger.on-sync-running: | # - description: Application is being synced # send: # - app-sync-running # when: app.status.operationState.phase in ['Running'] # trigger.on-sync-status-unknown: | # - description: Application status is 'Unknown' # send: # - app-sync-status-unknown # when: app.status.sync.status == 'Unknown' # trigger.on-sync-succeeded: | # - description: Application syncing has succeeded # send: # - app-sync-succeeded # when: app.status.operationState.phase in ['Succeeded'] # # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/#default-triggers # defaultTriggers: | # - on-sync-status-unknown ## @param events ## @skip events events: install: false ## Argo Events configuration ## Ref: https://github.com/argoproj/argo-events ## # -- Provide a name in place of `argo-events` nameOverride: argo-events # -- String to fully override "argo-events.fullname" template fullnameOverride: "" # -- Override the namespace # @default -- `.Release.Namespace` namespaceOverride: "" # -- Deploy on OpenShift openshift: false # -- Create clusterroles that extend existing clusterroles to interact with argo-events crds # Only applies for cluster-wide installation (`controller.rbac.namespaced: false`) ## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles createAggregateRoles: false ## Custom resource configuration crds: # -- Install and upgrade CRDs install: true # -- Keep CRDs on chart uninstall keep: true # -- Annotations to be added to all CRDs annotations: {} global: image: # -- If defined, a repository applied to all Argo Events deployments repository: quay.io/argoproj/argo-events # -- Overrides the global Argo Events image tag whose default is the chart appVersion tag: "" # -- If defined, a imagePullPolicy applied to all Argo Events deployments imagePullPolicy: IfNotPresent # -- If defined, uses a Secret to pull an image from a private Docker registry or repository imagePullSecrets: [] # -- Annotations for the all deployed pods podAnnotations: {} # -- Labels for the all deployed pods podLabels: {} # -- Additional labels to add to all resources additionalLabels: {} # app: argo-events # -- Toggle and define securityContext. See [values.yaml] securityContext: {} # runAsNonRoot: true # runAsUser: 9731 # runAsGroup: 9731 # fsGroup: 9731 # -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files hostAliases: [] # - ip: 10.20.30.40 # hostnames: # - git.myhostname ## Event bus configuration configs: ## NATS event bus nats: # -- Supported versions of NATS event bus # @default -- See [values.yaml] versions: - version: latest natsStreamingImage: nats-streaming:latest metricsExporterImage: natsio/prometheus-nats-exporter:latest - version: 0.22.1 natsStreamingImage: nats-streaming:0.22.1 metricsExporterImage: natsio/prometheus-nats-exporter:0.8.0 ## JetStream event bus jetstream: # Default JetStream settings, could be overridden by EventBus JetStream spec # Ref: https://docs.nats.io/running-a-nats-service/configuration#jetstream settings: # -- Maximum size of the memory storage (e.g. 1G) maxMemoryStore: -1 # -- Maximum size of the file storage (e.g. 20G) maxFileStore: -1 streamConfig: # -- Maximum number of messages before expiring oldest message maxMsgs: 1000000 # -- Maximum age of existing messages, i.e. “72h”, “4h35m” maxAge: 72h # Total size of messages before expiring oldest message, 0 means unlimited. maxBytes: 1GB # -- Number of replicas, defaults to 3 and requires minimal 3 replicas: 3 # -- Not documented at the moment duplicates: 300s # Supported versions of JetStream eventbus versions: - version: "latest" natsImage: nats:latest metricsExporterImage: natsio/prometheus-nats-exporter:latest configReloaderImage: natsio/nats-server-config-reloader:latest startCommand: /nats-server # -- Array of extra K8s manifests to deploy ## Note: Supports use of custom Helm templates extraObjects: [] # - apiVersion: secrets-store.csi.x-k8s.io/v1 # kind: SecretProviderClass # metadata: # name: argo-events-secrets-store # spec: # provider: aws # parameters: # objects: | # - objectName: "argo-events" # objectType: "secretsmanager" # jmesPath: # - path: "client_id" # objectAlias: "client_id" # - path: "client_secret" # objectAlias: "client_secret" # secretObjects: # - data: # - key: client_id # objectName: client_id # - key: client_secret # objectName: client_secret # secretName: argo-events-secrets-store # type: Opaque # labels: # app.kubernetes.io/part-of: argocd ## Argo Events controller controller: # -- Argo Events controller name string name: controller-manager rbac: # -- Create events controller RBAC enabled: true # -- Restrict events controller to operate only in a single namespace instead of cluster-wide scope. namespaced: false # -- Additional namespace to be monitored by the controller managedNamespace: "" # -- Additional user rules for event controller's rbac rules: [] image: # -- Repository to use for the events controller # @default -- `""` (defaults to global.image.repository) repository: "" # -- Tag to use for the events controller # @default -- `""` (defaults to global.image.tag) tag: "" # -- Image pull policy for the events controller # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- The number of events controller pods to run. replicas: 1 # Pod disruption budget pdb: # -- Deploy a PodDisruptionBudget for the events controller enabled: false # minAvailable: 1 # maxUnavailable: 0 # -- Labels to be added to events controller pdb labels: {} # -- Annotations to be added to events controller pdb annotations: {} # -- Environment variables to pass to events controller env: [] # - name: DEBUG_LOG # value: "true" # -- envFrom to pass to events controller # @default -- `[]` (See [values.yaml]) envFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name # -- Annotations to be added to events controller pods podAnnotations: {} # -- Labels to be added to events controller pods podLabels: {} # -- Events controller container-level security context containerSecurityContext: {} # capabilities: # drop: # - all # readOnlyRootFilesystem: true # runAsNonRoot: true ## Readiness and liveness probes for default backend ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ readinessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 livenessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 # -- Additional volumes to the events controller pod volumes: [] # -- Additional volumeMounts to the events controller main container volumeMounts: [] # -- [Node selector] nodeSelector: {} # -- [Tolerations] for use with node taints tolerations: [] # -- Assign custom [affinity] rules to the deployment affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the events controller ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Priority class for the events controller pods priorityClassName: "" # -- Resource limits and requests for the events controller pods resources: {} # limits: # cpu: 500m # memory: 512Mi # requests: # cpu: 250m # memory: 256Mi # -- Additional containers to be added to the events controller pods extraContainers: [] # -- Init containers to add to the events controller pods initContainers: [] serviceAccount: # -- Create a service account for the events controller create: true # -- Service account name name: "" # -- Annotations applied to created service account annotations: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: true ## Events controller metrics configuration metrics: # -- Deploy metrics service enabled: false service: # -- Metrics service annotations annotations: {} # -- Metrics service labels labels: {} # -- Metrics service port servicePort: 8082 serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Prometheus ServiceMonitor interval interval: 30s # -- Prometheus [RelabelConfigs] to apply to samples before scraping relabelings: [] # -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion metricRelabelings: [] # -- Prometheus ServiceMonitor selector selector: {} # prometheus: kube-prometheus # -- Prometheus ServiceMonitor namespace namespace: "" # -- Prometheus ServiceMonitor labels additionalLabels: {} ## Argo Events admission webhook webhook: # -- Enable admission webhook. Applies only for cluster-wide installation enabled: false # -- Argo Events admission webhook name string name: events-webhook image: # -- Repository to use for the event controller # @default -- `""` (defaults to global.image.repository) repository: "" # -- Tag to use for the event controller # @default -- `""` (defaults to global.image.tag) tag: "" # -- Image pull policy for the event controller # @default -- `""` (defaults to global.image.imagePullPolicy) imagePullPolicy: "" # -- The number of webhook pods to run. replicas: 1 # Pod disruption budget pdb: # -- Deploy a PodDisruptionBudget for the admission webhook enabled: false # minAvailable: 1 # maxUnavailable: 0 # -- Labels to be added to admission webhook pdb labels: {} # -- Annotations to be added to admission webhook pdb annotations: {} # -- Environment variables to pass to event controller # @default -- `[]` (See [values.yaml]) env: [] # - name: DEBUG_LOG # value: "true" # -- envFrom to pass to event controller # @default -- `[]` (See [values.yaml]) envFrom: [] # - configMapRef: # name: config-map-name # - secretRef: # name: secret-name # -- Annotations to be added to event controller pods podAnnotations: {} # -- Labels to be added to event controller pods podLabels: {} # -- Port to listen on port: 443 # -- Event controller container-level security context containerSecurityContext: {} # capabilities: # drop: # - all # readOnlyRootFilesystem: true # runAsNonRoot: true ## Readiness and liveness probes for default backend ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ readinessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 livenessProbe: # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded failureThreshold: 3 # -- Number of seconds after the container has started before [probe] is initiated initialDelaySeconds: 10 # -- How often (in seconds) to perform the [probe] periodSeconds: 10 # -- Minimum consecutive successes for the [probe] to be considered successful after having failed successThreshold: 1 # -- Number of seconds after which the [probe] times out timeoutSeconds: 1 # -- Additional volumeMounts to the event controller main container volumeMounts: [] # -- Additional volumes to the event controller pod volumes: [] # -- [Node selector] nodeSelector: {} # -- [Tolerations] for use with node taints tolerations: [] # -- Assign custom [affinity] rules to the deployment affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the event controller ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Priority class for the event controller pods priorityClassName: "" # -- Resource limits and requests for the event controller pods resources: {} # limits: # cpu: 500m # memory: 512Mi # requests: # cpu: 250m # memory: 256Mi serviceAccount: # -- Create a service account for the admission webhook create: true # -- Service account name name: "" # -- Annotations applied to created service account annotations: {} # -- Automount API credentials for the Service Account automountServiceAccountToken: true ## @param rollouts ## @skip rollouts rollouts: install: false # -- Install and upgrade CRDs installCRDs: true # -- Keep CRD's on helm uninstall keepCRDs: true # -- `false` runs controller in namespaced mode (does not require cluster RBAC) clusterInstall: true # -- flag to enable creation of cluster aggregate roles (requires cluster RBAC) createClusterAggregateRoles: true # -- String to partially override "argo-rollouts.fullname" template nameOverride: # -- String to fully override "argo-rollouts.fullname" template fullnameOverride: ## Override APIVersions ## If you want to template helm charts but cannot access k8s API server ## you can set api versions here apiVersionOverrides: # -- String to override apiVersion of ingresses rendered by this helm chart ingress: "" # -- Override the Kubernetes version, which is used to evaluate certain manifests kubeVersionOverride: "" # -- Additional manifests to deploy within the chart. A list of objects. ## Can be used to add secrets for Analysis with 3rd-party monitoring solutions. extraObjects: [] # - apiVersion: v1 # kind: Secret # metadata: # name: datadog # type: Opaque # data: # address: https://api.datadoghq.com # api-key: <datadog-api-key> # app-key: <datadog-app-key> global: # -- Annotations for all deployed Deployments deploymentAnnotations: {} # -- Labels for all deployed Deployments deploymentLabels: {} controller: # -- Value of label `app.kubernetes.io/component` component: rollouts-controller # -- Annotations to be added to the controller deployment deploymentAnnotations: {} # -- Labels to be added to the controller deployment deploymentLabels: {} # -- Annotations to be added to application controller pods podAnnotations: {} # -- [Node selector] nodeSelector: {} # -- [Tolerations] for use with node taints tolerations: [] # -- Assign custom [affinity] rules to the deployment affinity: {} logging: # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`) level: info # -- Set the klog logging level kloglevel: "0" # -- Set the logging format (one of: `text`, `json`) format: "text" # -- Assign custom [TopologySpreadConstraints] rules to the controller ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- [priorityClassName] for the controller priorityClassName: "" # -- The number of controller pods to run replicas: 2 image: # -- Registry to use registry: quay.io # -- Repository to use repository: argoproj/argo-rollouts # -- Overrides the image tag (default is the chart appVersion) tag: "" # -- Image pull policy pullPolicy: IfNotPresent # -- Additional command line arguments to pass to rollouts-controller. A list of flags. extraArgs: [] # -- Additional environment variables for rollouts-controller. A list of name/value maps. extraEnv: [] # - name: AWS_REGION # value: us-east-1 # -- Literal yaml for extra containers to be added to controller deployment. ## Additional containers to add to the rollouts controller deployment ## This will be rendered as the literal yaml extraContainers: [] # -- Init containers to add to the rollouts controller pod ## This will be rendered as the literal yaml initContainers: [] # - name: download-tools # image: alpine:3.8 # command: [sh, -c] # args: # - ls # -- Resource limits and requests for the controller pods. resources: {} # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 50m # memory: 64Mi # -- flag to enable creation of cluster controller role (requires cluster RBAC) createClusterRole: true # Controller container ports containerPorts: # -- Metrics container port metrics: 8090 # -- Healthz container port healthz: 8080 metrics: # -- Deploy metrics service enabled: false service: # -- Metrics service port name portName: metrics # -- Metrics service port port: 8090 # -- Service annotations annotations: {} serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Namespace to be used for the ServiceMonitor namespace: "" # -- Labels to be added to the ServiceMonitor additionalLabels: {} # -- Annotations to be added to the ServiceMonitor additionalAnnotations: {} # -- RelabelConfigs to apply to samples before scraping relabelings: [] # -- MetricRelabelConfigs to apply to samples before ingestion metricRelabelings: [] # -- Configure liveness [probe] for the controller # @default -- See [values.yaml] livenessProbe: httpGet: path: /healthz port: healthz initialDelaySeconds: 30 periodSeconds: 20 failureThreshold: 3 successThreshold: 1 timeoutSeconds: 10 # -- Configure readiness [probe] for the controller # @default -- See [values.yaml] readinessProbe: httpGet: path: /metrics port: metrics initialDelaySeconds: 15 periodSeconds: 5 failureThreshold: 3 successThreshold: 1 timeoutSeconds: 4 ## Configure Pod Disruption Budget for the controller pdb: # -- Labels to be added to controller [Pod Disruption Budget] labels: {} # -- Annotations to be added to controller [Pod Disruption Budget] annotations: {} # -- Deploy a [Pod Disruption Budget] for the controller enabled: false # -- Minimum number / percentage of pods that should remain scheduled minAvailable: # -- Maximum number / percentage of pods that may be made unavailable maxUnavailable: # -- Additional volumes to add to the controller pod volumes: [] # - configMap: # name: my-certs-cm # name: my-certs # -- Additional volumeMounts to add to the controller container volumeMounts: [] # - mountPath: /etc/ssl/certs # name: my-certs # -- Configures 3rd party metric providers for controller ## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/ metricProviderPlugins: {} # metricProviderPlugins: |- # - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration # location: "file://./my-custom-plugin" # supports http(s):// urls and file:// # -- Configures 3rd party traffic router plugins for controller ## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/ trafficRouterPlugins: {} # trafficRouterPlugins: |- # - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration # location: "file://./my-custom-plugin" # supports http(s):// urls and file:// serviceAccount: # -- Specifies whether a service account should be created create: true # -- Annotations to add to the service account annotations: {} # -- The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" # -- Annotations to be added to all CRDs crdAnnotations: {} # -- Annotations for the all deployed pods podAnnotations: {} # -- Security Context to set on pod level podSecurityContext: runAsNonRoot: true # -- Security Context to set on container level containerSecurityContext: {} # capabilities: # drop: # - ALL # readOnlyRootFilesystem: true # runAsNonRoot: true # runAsUser: 1000 # -- Annotations to be added to the Rollout service serviceAnnotations: {} # -- Labels to be added to the Rollout pods podLabels: {} # -- Secrets with credentials to pull images from a private registry. Registry secret names as an array. imagePullSecrets: [] # - name: argo-pull-secret providerRBAC: # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole enabled: true # providerRBAC.enabled must be true in order to toggle the individual providers providers: # -- Adds RBAC rules for the Istio provider istio: true # -- Adds RBAC rules for the SMI provider smi: true # -- Adds RBAC rules for the Ambassador provider ambassador: true # -- Adds RBAC rules for the AWS Load Balancer Controller provider awsLoadBalancerController: true # -- Adds RBAC rules for the AWS App Mesh provider awsAppMesh: true # -- Adds RBAC rules for the Traefik provider traefik: true # -- Adds RBAC rules for the Apisix provider apisix: true # -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md` contour: true # -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md` glooPlatform: true # -- Adds RBAC rules for the Gateway API provider gatewayAPI: true # -- Additional RBAC rules for others providers additionalRules: [] dashboard: # -- Deploy dashboard server enabled: false # -- Set cluster role to readonly readonly: false # -- Value of label `app.kubernetes.io/component` component: rollouts-dashboard # -- Annotations to be added to the dashboard deployment deploymentAnnotations: {} # -- Labels to be added to the dashboard deployment deploymentLabels: {} # -- Annotations to be added to application dashboard pods podAnnotations: {} # -- [Node selector] nodeSelector: {} # -- [Tolerations] for use with node taints tolerations: [] # -- Assign custom [affinity] rules to the deployment affinity: {} logging: # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`) level: info # -- Set the klog logging level kloglevel: "0" # -- Assign custom [TopologySpreadConstraints] rules to the dashboard server ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- [priorityClassName] for the dashboard server priorityClassName: "" # -- flag to enable creation of dashbord cluster role (requires cluster RBAC) createClusterRole: true # -- The number of dashboard pods to run replicas: 1 image: # -- Registry to use registry: quay.io # -- Repository to use repository: argoproj/kubectl-argo-rollouts # -- Overrides the image tag (default is the chart appVersion) tag: "" # -- Image pull policy pullPolicy: IfNotPresent # -- Additional command line arguments to pass to rollouts-dashboard. A list of flags. extraArgs: [] # -- Additional environment variables for rollouts-dashboard. A list of name/value maps. extraEnv: [] # - name: FOO # value: bar # -- Resource limits and requests for the dashboard pods. resources: {} # -- Security Context to set on pod level podSecurityContext: runAsNonRoot: true # -- Security Context to set on container level containerSecurityContext: {} service: # -- Sets the type of the Service type: ClusterIP # -- LoadBalancer will get created with the IP specified in this field loadBalancerIP: "" # -- Source IP ranges to allow access to service from loadBalancerSourceRanges: [] # -- Dashboard service external IPs externalIPs: [] # -- Service annotations annotations: {} # -- Service labels labels: {} # -- Service port name portName: dashboard # -- Service port port: 3100 # -- Service target port targetPort: 3100 # -- (int) Service nodePort nodePort: serviceAccount: # -- Specifies whether a dashboard service account should be created create: true # -- Annotations to add to the dashboard service account annotations: {} # -- The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" ## Configure Pod Disruption Budget for the dashboard pdb: # -- Labels to be added to dashboard [Pod Disruption Budget] labels: {} # -- Annotations to be added to dashboard [Pod Disruption Budget] annotations: {} # -- Deploy a [Pod Disruption Budget] for the dashboard enabled: false # -- Minimum number / percentage of pods that should remain scheduled minAvailable: # -- Maximum number / percentage of pods that may be made unavailable maxUnavailable: ## Ingress configuration. ## ref: https://kubernetes.io/docs/user-guide/ingress/ ## ingress: # -- Enable dashboard ingress support enabled: false # -- Dashboard ingress annotations annotations: {} # -- Dashboard ingress labels labels: {} # -- Dashboard ingress class name ingressClassName: "" # -- Dashboard ingress hosts ## Argo Rollouts Dashboard Ingress. ## Hostnames must be provided if Ingress is enabled. ## Secrets must be manually created in the namespace hosts: [] # - argorollouts.example.com # -- Dashboard ingress paths paths: - / # -- Dashboard ingress path type pathType: Prefix # -- Dashboard ingress extra paths extraPaths: [] # - path: /* # backend: # serviceName: ssl-redirect # servicePort: use-annotation ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used) # - path: /* # pathType: Prefix # backend: # service # name: ssl-redirect # port: # name: use-annotation # -- Dashboard ingress tls tls: [] # - secretName: argorollouts-example-tls # hosts: # - argorollouts.example.com # -- Additional volumes to add to the dashboard pod volumes: [] # -- Additional volumeMounts to add to the dashboard container volumeMounts: [] notifications: secret: # -- Whether to create notifications secret create: false # -- Generic key:value pairs to be inserted into the notifications secret items: {} # slack-token: # -- Configures notification services notifiers: {} # service.slack: | # token: $slack-token # -- Notification templates templates: {} # template.my-purple-template: | # message: | # Rollout {{.rollout.metadata.name}} has purple image # slack: # attachments: | # [{ # "title": "{{ .rollout.metadata.name}}", # "color": "#800080" # }] # -- The trigger defines the condition when the notification should be sent triggers: {} # trigger.on-purple: | # - send: [my-purple-template] # when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple' ## @param workflows ## @skip workflows workflows: install: false images: # -- Common tag for Argo Workflows images. Defaults to `.Chart.AppVersion`. tag: "" # -- imagePullPolicy to apply to all containers pullPolicy: Always # -- Secrets with credentials to pull images from a private registry pullSecrets: [] # - name: argo-pull-secret ## Custom resource configuration crds: # -- Install and upgrade CRDs install: true # -- Keep CRDs on chart uninstall keep: true # -- Annotations to be added to all CRDs annotations: {} # -- Create clusterroles that extend existing clusterroles to interact with argo-cd crds ## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles createAggregateRoles: true # -- String to partially override "argo-workflows.fullname" template nameOverride: # -- String to fully override "argo-workflows.fullname" template fullnameOverride: # -- Override the namespace # @default -- `.Release.Namespace` namespaceOverride: "" # -- Labels to set on all resources commonLabels: {} # -- Override the Kubernetes version, which is used to evaluate certain manifests kubeVersionOverride: "" # Override APIVersions apiVersionOverrides: # -- String to override apiVersion of autoscaling rendered by this helm chart autoscaling: "" # -- String to override apiVersion of GKE resources rendered by this helm chart cloudgoogle: "" # -- String to override apiVersion of monitoring CRDs (ServiceMonitor) rendered by this helm chart monitoring: "" # -- Restrict Argo to operate only in a single namespace (the namespace of the # Helm release) by apply Roles and RoleBindings instead of the Cluster # equivalents, and start workflow-controller with the --namespaced flag. Use it # in clusters with strict access policy. singleNamespace: false workflow: # -- Deprecated; use controller.workflowNamespaces instead. namespace: serviceAccount: # -- Specifies whether a service account should be created create: false # -- Labels applied to created service account labels: {} # -- Annotations applied to created service account annotations: {} # -- Service account which is used to run workflows name: "argo-workflow" # -- Secrets with credentials to pull images from a private registry. Same format as `.Values.images.pullSecrets` pullSecrets: [] rbac: # -- Adds Role and RoleBinding for the above specified service account to be able to run workflows. # A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below) create: true controller: image: # -- Registry to use for the controller registry: quay.io # -- Registry to use for the controller repository: argoproj/workflow-controller # -- Image tag for the workflow controller. Defaults to `.Values.images.tag`. tag: "" # -- parallelism dictates how many workflows can be running at the same time parallelism: # -- Globally limits the rate at which pods are created. # This is intended to mitigate flooding of the Kubernetes API server by workflows with a large amount of # parallel nodes. resourceRateLimit: {} # limit: 10 # burst: 1 rbac: # -- Adds Role and RoleBinding for the controller. create: true # -- Allows controller to get, list, and watch certain k8s secrets secretWhitelist: [] # -- Allows controller to get, list and watch all k8s secrets. Can only be used if secretWhitelist is empty. accessAllSecrets: false # -- Allows controller to create and update ConfigMaps. Enables memoization feature writeConfigMaps: false configMap: # -- Create a ConfigMap for the controller create: true # -- ConfigMap name name: "" # -- Limits the maximum number of incomplete workflows in a namespace namespaceParallelism: # -- Resolves ongoing, uncommon AWS EKS bug: https://github.com/argoproj/argo-workflows/pull/4224 initialDelay: # -- deploymentAnnotations is an optional map of annotations to be applied to the controller Deployment deploymentAnnotations: {} # -- podAnnotations is an optional map of annotations to be applied to the controller Pods podAnnotations: {} # -- Optional labels to add to the controller pods podLabels: {} # -- SecurityContext to set on the controller pods podSecurityContext: {} # podPortName: http metricsConfig: # -- Enables prometheus metrics server enabled: false # -- Path is the path where metrics are emitted. Must start with a "/". path: /metrics # -- Port is the port where metrics are emitted port: 9090 # -- How often custom metrics are cleared from memory metricsTTL: "" # -- Flag that instructs prometheus to ignore metric emission errors. ignoreErrors: false # -- Flag that use a self-signed cert for TLS secure: false # -- Container metrics port name portName: metrics # -- Service metrics port servicePort: 8080 # -- Service metrics port name servicePortName: metrics # -- ServiceMonitor relabel configs to apply to samples before scraping ## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#relabelconfig relabelings: [] # -- ServiceMonitor metric relabel configs to apply to samples before ingestion ## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint metricRelabelings: [] # -- ServiceMonitor will add labels from the service to the Prometheus metric ## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitorspec targetLabels: [] # -- the controller container's securityContext securityContext: readOnlyRootFilesystem: true runAsNonRoot: true allowPrivilegeEscalation: false capabilities: drop: - ALL # -- enable Workflow Archive to store the status of workflows. Postgres and MySQL (>= 5.7.8) are available. ## Ref: https://argo-workflows.readthedocs.io/en/stable/workflow-archive/ persistence: {} # connectionPool: # maxIdleConns: 100 # maxOpenConns: 0 # # save the entire workflow into etcd and DB # nodeStatusOffLoad: false # # enable archiving of old workflows # archive: false # postgresql: # host: localhost # port: 5432 # database: postgres # tableName: argo_workflows # # the database secrets must be in the same namespace of the controller # userNameSecret: # name: argo-postgres-config # key: username # passwordSecret: # name: argo-postgres-config # key: password # ssl: true # # sslMode must be one of: disable, require, verify-ca, verify-full # # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq # sslMode: require # mysql: # host: localhost # port: 3306 # database: argo # tableName: argo_workflows # userNameSecret: # name: argo-mysql-config # key: username # passwordSecret: # name: argo-mysql-config # key: password # -- Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level. # Only valid for 2.7+ ## See more: https://argo-workflows.readthedocs.io/en/stable/default-workflow-specs/ workflowDefaults: {} # spec: # ttlStrategy: # secondsAfterCompletion: 84600 # # Ref: https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/ # artifactRepositoryRef: # configMap: my-artifact-repository # default is "artifact-repositories" # key: v2-s3-artifact-repository # default can be set by the `workflows.argoproj.io/default-artifact-repository` annotation in config map. # -- Number of workflow workers workflowWorkers: # -- Number of workflow TTL workers workflowTTLWorkers: # -- Number of pod cleanup workers podCleanupWorkers: # -- Number of cron workflow workers # Only valid for 3.5+ cronWorkflowWorkers: # -- Restricts the Workflows that the controller will process. # Only valid for 2.9+ workflowRestrictions: {} # templateReferencing: Strict|Secure # telemetryConfig controls the path and port for prometheus telemetry. Telemetry is enabled and emitted in the same endpoint # as metrics by default, but can be overridden using this config. telemetryConfig: # -- Enables prometheus telemetry server enabled: false # -- telemetry path path: /telemetry # -- telemetry container port port: 8081 # -- How often custom metrics are cleared from memory metricsTTL: "" # -- Flag that instructs prometheus to ignore metric emission errors. ignoreErrors: false # -- Flag that use a self-signed cert for TLS secure: false # -- telemetry service port servicePort: 8081 # -- telemetry service port name servicePortName: telemetry serviceMonitor: # -- Enable a prometheus ServiceMonitor enabled: false # -- Prometheus ServiceMonitor labels additionalLabels: {} # -- Prometheus ServiceMonitor namespace namespace: "" serviceAccount: # -- Create a service account for the controller create: true # -- Service account name name: "" # -- Labels applied to created service account labels: {} # -- Annotations applied to created service account annotations: {} # -- Workflow controller name string name: workflow-controller # -- Specify all namespaces where this workflow controller instance will manage # workflows. This controls where the service account and RBAC resources will # be created. Only valid when singleNamespace is false. workflowNamespaces: - default instanceID: # -- Configures the controller to filter workflow submissions # to only those which have a matching instanceID attribute. ## NOTE: If `instanceID.enabled` is set to `true` then either `instanceID.userReleaseName` ## or `instanceID.explicitID` must be defined. enabled: false # -- Use ReleaseName as instanceID useReleaseName: false # useReleaseName: true # -- Use a custom instanceID explicitID: "" # explicitID: unique-argo-controller-identifier logging: # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`) level: info # -- Set the glog logging level globallevel: "0" # -- Set the logging format (one of: `text`, `json`) format: "text" # -- Service type of the controller Service serviceType: ClusterIP # -- Annotations to be applied to the controller Service serviceAnnotations: {} # -- Optional labels to add to the controller Service serviceLabels: {} # -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer` loadBalancerSourceRanges: [] # -- Resource limits and requests for the controller resources: {} # -- Configure liveness [probe] for the controller # @default -- See [values.yaml] livenessProbe: httpGet: port: 6060 path: /healthz failureThreshold: 3 initialDelaySeconds: 90 periodSeconds: 60 timeoutSeconds: 30 # -- Extra environment variables to provide to the controller container extraEnv: [] # - name: FOO # value: "bar" # -- Extra arguments to be added to the controller extraArgs: [] # -- Additional volume mounts to the controller main container volumeMounts: [] # -- Additional volumes to the controller pod volumes: [] # -- The number of controller pods to run replicas: 1 # -- The number of revisions to keep. revisionHistoryLimit: 10 pdb: # -- Configure [Pod Disruption Budget] for the controller pods enabled: false # minAvailable: 1 # maxUnavailable: 1 # -- [Node selector] nodeSelector: kubernetes.io/os: linux # -- [Tolerations] for use with node taints tolerations: [] # -- Assign custom [affinity] rules affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the workflow controller ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Leverage a PriorityClass to ensure your pods survive resource shortages. ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ priorityClassName: "" # -- Configure Argo Server to show custom [links] ## Ref: https://argo-workflows.readthedocs.io/en/stable/links/ links: [] # -- Configure Argo Server to show custom [columns] ## Ref: https://github.com/argoproj/argo-workflows/pull/10693 columns: [] # -- Set ui navigation bar background color navColor: "" clusterWorkflowTemplates: # -- Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates. enabled: true # -- Extra containers to be added to the controller deployment extraContainers: [] # -- Enables init containers to be added to the controller deployment extraInitContainers: [] # -- Workflow retention by number of workflows retentionPolicy: {} # completed: 10 # failed: 3 # errored: 3 nodeEvents: # -- Enable to emit events on node completion. ## This can take up a lot of space in k8s (typically etcd) resulting in errors when trying to create new events: ## "Unable to create audit event: etcdserver: mvcc: database space exceeded" enabled: true # -- Configure when workflow controller runs in a different k8s cluster with the workflow workloads, # or needs to communicate with the k8s apiserver using an out-of-cluster kubeconfig secret. # @default -- `{}` (See [values.yaml]) kubeConfig: {} # # name of the kubeconfig secret, may not be empty when kubeConfig specified # secretName: kubeconfig-secret # # key of the kubeconfig secret, may not be empty when kubeConfig specified # secretKey: kubeconfig # # mounting path of the kubeconfig secret, default to /kube/config # mountPath: /kubeconfig/mount/path # # volume name when mounting the secret, default to kubeconfig # volumeName: kube-config-volume # -- Specifies the duration in seconds before a terminating pod is forcefully killed. A zero value indicates that the pod will be forcefully terminated immediately. # @default -- `30` seconds (Kubernetes default) podGCGracePeriodSeconds: # -- The duration in seconds before the pods in the GC queue get deleted. A zero value indicates that the pods will be deleted immediately. # @default -- `5s` (Argo Workflows default) podGCDeleteDelayDuration: "" # mainContainer adds default config for main container that could be overriden in workflows template mainContainer: # -- imagePullPolicy to apply to Workflow main container. Defaults to `.Values.images.pullPolicy`. imagePullPolicy: "" # -- Resource limits and requests for the Workflow main container resources: {} # -- Adds environment variables for the Workflow main container env: [] # -- Adds reference environment variables for the Workflow main container envFrom: [] # -- sets security context for the Workflow main container securityContext: {} # executor controls how the init and wait container should be customized executor: image: # -- Registry to use for the Workflow Executors registry: quay.io # -- Repository to use for the Workflow Executors repository: argoproj/argoexec # -- Image tag for the workflow executor. Defaults to `.Values.images.tag`. tag: "" # -- Image PullPolicy to use for the Workflow Executors. Defaults to `.Values.images.pullPolicy`. pullPolicy: "" # -- Resource limits and requests for the Workflow Executors resources: {} # -- Passes arguments to the executor processes args: [] # -- Adds environment variables for the executor. env: [] # -- sets security context for the executor container securityContext: {} server: # -- Deploy the Argo Server enabled: true # -- Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /. ## only updates base url of resources on client side, ## it's expected that a proxy server rewrites the request URL and gets rid of this prefix ## https://github.com/argoproj/argo-workflows/issues/716#issuecomment-433213190 baseHref: / image: # -- Registry to use for the server registry: quay.io # -- Repository to use for the server repository: argoproj/argocli # -- Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`. tag: "" # -- optional map of annotations to be applied to the ui Deployment deploymentAnnotations: {} # -- optional map of annotations to be applied to the ui Pods podAnnotations: {} # -- Optional labels to add to the UI pods podLabels: {} # -- SecurityContext to set on the server pods podSecurityContext: {} rbac: # -- Adds Role and RoleBinding for the server. create: true # -- Servers container-level security context securityContext: readOnlyRootFilesystem: false runAsNonRoot: true allowPrivilegeEscalation: false capabilities: drop: - ALL # -- Server name string name: server # -- Service type for server pods serviceType: ClusterIP # -- Service port for server servicePort: 2746 # -- Service node port serviceNodePort: # -- Service port name servicePortName: "" # -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files hostAliases: [] # - ip: 10.20.30.40 # hostnames: # - git.myhostname serviceAccount: # -- Create a service account for the server create: true # -- Service account name name: "" # -- Labels applied to created service account labels: {} # -- Annotations applied to created service account annotations: {} # -- Annotations to be applied to the UI Service serviceAnnotations: {} # -- Optional labels to add to the UI Service serviceLabels: {} # -- Static IP address to assign to loadBalancer service type `LoadBalancer` loadBalancerIP: "" # -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer` loadBalancerSourceRanges: [] # -- Resource limits and requests for the server resources: {} # -- The number of server pods to run replicas: 1 # -- The number of revisions to keep. revisionHistoryLimit: 10 ## Argo Server Horizontal Pod Autoscaler autoscaling: # -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo Server enabled: false # -- Minimum number of replicas for the Argo Server [HPA] minReplicas: 1 # -- Maximum number of replicas for the Argo Server [HPA] maxReplicas: 5 # -- Average CPU utilization percentage for the Argo Server [HPA] targetCPUUtilizationPercentage: 50 # -- Average memory utilization percentage for the Argo Server [HPA] targetMemoryUtilizationPercentage: 50 # -- Configures the scaling behavior of the target in both Up and Down directions. # This is only available on HPA apiVersion `autoscaling/v2beta2` and newer behavior: {} # scaleDown: # stabilizationWindowSeconds: 300 # policies: # - type: Pods # value: 1 # periodSeconds: 180 # scaleUp: # stabilizationWindowSeconds: 300 # policies: # - type: Pods # value: 2 pdb: # -- Configure [Pod Disruption Budget] for the server pods enabled: false # minAvailable: 1 # maxUnavailable: 1 # -- [Node selector] nodeSelector: kubernetes.io/os: linux # -- [Tolerations] for use with node taints tolerations: [] # -- Assign custom [affinity] rules affinity: {} # -- Assign custom [TopologySpreadConstraints] rules to the argo server ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule # -- Leverage a PriorityClass to ensure your pods survive resource shortages ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ priorityClassName: "" # -- Run the argo server in "secure" mode. Configure this value instead of `--secure` in extraArgs. ## See the following documentation for more details on secure mode: ## https://argo-workflows.readthedocs.io/en/stable/tls/ secure: false # -- Extra environment variables to provide to the argo-server container extraEnv: [] # - name: FOO # value: "bar" # -- Deprecated; use server.authModes instead. authMode: "" # -- A list of supported authentication modes. Available values are `server`, `client`, or `sso`. If you provide sso, please configure `.Values.server.sso` as well. ## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server-auth-mode/ authModes: [] # -- Extra arguments to provide to the Argo server binary. ## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server/#options extraArgs: [] logging: # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`) level: info # -- Set the glog logging level globallevel: "0" # -- Set the logging format (one of: `text`, `json`) format: "text" # -- Volume to be mounted in Pods for temporary files. tmpVolume: emptyDir: {} # -- Additional volume mounts to the server main container. volumeMounts: [] # -- Additional volumes to the server pod. volumes: [] ## Ingress configuration. # ref: https://kubernetes.io/docs/user-guide/ingress/ ingress: # -- Enable an ingress resource enabled: false # -- Additional ingress annotations annotations: {} # -- Additional ingress labels labels: {} # -- Defines which ingress controller will implement the resource ingressClassName: "" # -- List of ingress hosts ## Hostnames must be provided if Ingress is enabled. ## Secrets must be manually created in the namespace hosts: [] # - argoworkflows.example.com # -- List of ingress paths paths: - / # -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific` pathType: Prefix # -- Additional ingress paths extraPaths: [] # - path: /* # backend: # serviceName: ssl-redirect # servicePort: use-annotation ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used) # - path: /* # pathType: Prefix # backend: # service # name: ssl-redirect # port: # name: use-annotation # -- Ingress TLS configuration tls: [] # - secretName: argoworkflows-example-tls # hosts: # - argoworkflows.example.com ## Create a Google Backendconfig for use with the GKE Ingress Controller ## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters GKEbackendConfig: # -- Enable BackendConfig custom resource for Google Kubernetes Engine enabled: false # -- [BackendConfigSpec] spec: {} # spec: # iap: # enabled: true # oauthclientCredentials: # secretName: argoworkflows-secret ## Create a Google Managed Certificate for use with the GKE Ingress Controller ## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs GKEmanagedCertificate: # -- Enable ManagedCertificate custom resource for Google Kubernetes Engine. enabled: false # -- Domains for the Google Managed Certificate domains: - argoworkflows.example.com ## Create a Google FrontendConfig Custom Resource, for use with the GKE Ingress Controller ## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters GKEfrontendConfig: # -- Enable FrontConfig custom resource for Google Kubernetes Engine enabled: false # -- [FrontendConfigSpec] spec: {} # spec: # redirectToHttps: # enabled: true # responseCodeName: RESPONSE_CODE clusterWorkflowTemplates: # -- Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates. enabled: true # -- Give the server permissions to edit ClusterWorkflowTemplates. enableEditing: true # SSO configuration when SSO is specified as a server auth mode. sso: # -- Create SSO configuration. If you set `true` , please also set `.Values.server.authMode` as `sso`. enabled: false # -- The root URL of the OIDC identity provider issuer: https://accounts.google.com clientId: # -- Name of secret to retrieve the app OIDC client ID name: argo-server-sso # -- Key of secret to retrieve the app OIDC client ID key: client-id clientSecret: # -- Name of a secret to retrieve the app OIDC client secret name: argo-server-sso # -- Key of a secret to retrieve the app OIDC client secret key: client-secret # - The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback. redirectUrl: "" rbac: # -- Adds ServiceAccount Policy to server (Cluster)Role. enabled: true # -- Whitelist to allow server to fetch Secrets ## When present, restricts secrets the server can read to a given list. ## You can use it to restrict the server to only be able to access the ## service account token secrets that are associated with service accounts ## used for authorization. secretWhitelist: [] # -- Scopes requested from the SSO ID provider ## The 'groups' scope requests group membership information, which is usually used for authorization decisions. scopes: [] # - groups # -- Define how long your login is valid for (in hours) ## If omitted, defaults to 10h. sessionExpiry: "" # -- Alternate root URLs that can be included for some OIDC providers issuerAlias: "" # -- Override claim name for OIDC groups customGroupClaimName: "" # -- Specify the user info endpoint that contains the groups claim ## Configure this if your OIDC provider provides groups information only using the user-info endpoint (e.g. Okta) userInfoPath: "" # -- Skip TLS verification for the HTTP client insecureSkipVerify: false # -- Filter the groups returned by the OIDC provider ## A logical "OR" is used between each regex in the list filterGroupsRegex: [] # - ".*argo-wf.*" # - ".*argo-workflow.*" # -- Extra containers to be added to the server deployment extraContainers: [] # -- Enables init containers to be added to the server deployment extraInitContainers: [] # -- Array of extra K8s manifests to deploy extraObjects: [] # - apiVersion: secrets-store.csi.x-k8s.io/v1 # kind: SecretProviderClass # metadata: # name: argo-server-sso # spec: # provider: aws # parameters: # objects: | # - objectName: "argo/server/sso" # objectType: "secretsmanager" # jmesPath: # - path: "client_id" # objectAlias: "client_id" # - path: "client_secret" # objectAlias: "client_secret" # secretObjects: # - data: # - key: client_id # objectName: client_id # - key: client_secret # objectName: client_secret # secretName: argo-server-sso-secrets-store # type: Opaque # -- Use static credentials for S3 (eg. when not using AWS IRSA) useStaticCredentials: true artifactRepository: # -- Archive the main container logs as an artifact archiveLogs: false # -- Store artifact in a S3-compliant object store # @default -- See [values.yaml] s3: {} # # Note the `key` attribute is not the actual secret, it's the PATH to # # the contents in the associated secret, as defined by the `name` attribute. # accessKeySecret: # name: "{{ .Release.Name }}-minio" # key: accesskey # secretKeySecret: # name: "{{ .Release.Name }}-minio" # key: secretkey # # insecure will disable TLS. Primarily used for minio installs not configured with TLS # insecure: false # caSecret: # name: ca-root # key: cert.pem # bucket: # endpoint: # region: # roleARN: # useSDKCreds: true # encryptionOptions: # enableEncryption: true # -- Store artifact in a GCS object store # @default -- `{}` (See [values.yaml]) gcs: {} # bucket: <project>-argo # keyFormat: "{{ \"{{workflow.namespace}}/{{workflow.name}}/{{pod.name}}\" }}" # # serviceAccountKeySecret is a secret selector. # # It references the k8s secret named 'my-gcs-credentials'. # # This secret is expected to have have the key 'serviceAccountKey', # # containing the base64 encoded credentials # # to the bucket. # # # # If it's running on GKE and Workload Identity is used, # # serviceAccountKeySecret is not needed. # serviceAccountKeySecret: # name: my-gcs-credentials # key: serviceAccountKey # -- Store artifact in Azure Blob Storage # @default -- `{}` (See [values.yaml]) azure: {} # endpoint: https://mystorageaccountname.blob.core.windows.net # container: my-container-name # blobNameFormat: path/in/container # # accountKeySecret is a secret selector. # # It references the k8s secret named 'my-azure-storage-credentials'. # # This secret is expected to have have the key 'account-access-key', # # containing the base64 encoded credentials to the storage account. # # If a managed identity has been assigned to the machines running the # # workflow (e.g., https://docs.microsoft.com/en-us/azure/aks/use-managed-identity) # # then accountKeySecret is not needed, and useSDKCreds should be # # set to true instead: # useSDKCreds: true # accountKeySecret: # name: my-azure-storage-credentials # key: account-access-key # -- The section of custom artifact repository. # Utilize a custom artifact repository that is not one of the current base ones (s3, gcs, azure) customArtifactRepository: {} # artifactory: # repoUrl: https://artifactory.example.com/raw # usernameSecret: # name: artifactory-creds # key: username # passwordSecret: # name: artifactory-creds # key: password # -- The section of [artifact repository ref](https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/). # Each map key is the name of configmap # @default -- `{}` (See [values.yaml]) artifactRepositoryRef: {} # # -- 1st ConfigMap # # If you want to use this config map by default, name it "artifact-repositories". # # Otherwise, you can provide a reference to a # # different config map in `artifactRepositoryRef.configMap`. # artifact-repositories: # # -- v3.0 and after - if you want to use a specific key, put that key into this annotation. # annotations: # workflows.argoproj.io/default-artifact-repository: default-v1-s3-artifact-repository # # 1st data of configmap. See above artifactRepository or customArtifactRepository. # default-v1-s3-artifact-repository: # archiveLogs: false # s3: # bucket: my-bucket # endpoint: minio:9000 # insecure: true # accessKeySecret: # name: my-minio-cred # key: accesskey # secretKeySecret: # name: my-minio-cred # key: secretkey # # 2nd data # oss-artifact-repository: # archiveLogs: false # oss: # endpoint: http://oss-cn-zhangjiakou-internal.aliyuncs.com # bucket: $mybucket # # accessKeySecret and secretKeySecret are secret selectors. # # It references the k8s secret named 'bucket-workflow-artifect-credentials'. # # This secret is expected to have have the keys 'accessKey' # # and 'secretKey', containing the base64 encoded credentials # # to the bucket. # accessKeySecret: # name: $mybucket-credentials # key: accessKey # secretKeySecret: # name: $mybucket-credentials # key: secretKey # # 2nd ConfigMap # another-artifact-repositories: # annotations: # workflows.argoproj.io/default-artifact-repository: gcs # gcs: # bucket: my-bucket # keyFormat: prefix/in/bucket/{{workflow.name}}/{{pod.name}} # serviceAccountKeySecret: # name: my-gcs-credentials # key: serviceAccountKey emissary: # -- The command/args for each image on workflow, needed when the command is not specified and the emissary executor is used. ## See more: https://argo-workflows.readthedocs.io/en/stable/workflow-executors/#emissary-emissary images: [] # argoproj/argosay:v2: # cmd: [/argosay] # docker/whalesay:latest: # cmd: [/bin/bash]

charts/kube-argo/values.yaml (1,644 lines of code) (raw):