## @param spec Specify the Ingress Nginx Controller configuration
## @skip spec
spec:
  ## nginx configuration
  ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md
  ##
  ## Overrides for generated resource names
  # See templates/_helpers.tpl
  # nameOverride:
  # fullnameOverride:
  # -- Override the deployment namespace; defaults to .Release.Namespace
  ## @param namespaceOverride Override the deployment namespace; defaults to .Release.Namespace
  ## @skip namespaceOverride
  namespaceOverride: ""
  ## Labels to apply to all resources
  ## @param commonLabels Labels to apply to all resources
  ## @skip commonLabels
  commonLabels: {}
  # scmhash: abc123
  # myLabel: aakkmd
  ## @param controller Specify controller configurations
  ## @skip controller
  controller:
    name: controller
    enableAnnotationValidations: false
    image:
      ## Keep false as default for now!
      chroot: false
      registry: registry.k8s.io
      image: ingress-nginx/controller
      ## for backwards compatibility consider setting the full image url via the repository value below
      ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
      ## repository:
      tag: "v1.10.0"
      digest: sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c
      digestChroot: sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096
      pullPolicy: IfNotPresent
      runAsNonRoot: true
      # www-data -> uid 101
      runAsUser: 101
      allowPrivilegeEscalation: false
      seccompProfile:
        type: RuntimeDefault
      readOnlyRootFilesystem: false
    # -- Use an existing PSP instead of creating one
    existingPsp: ""
    # -- Configures the controller container name
    containerName: controller
    # -- Configures the ports that the nginx-controller listens on
    containerPort:
      http: 80
      https: 443
    # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
    config: {}
    # -- Annotations to be added to the controller config configuration configmap.
    configAnnotations: {}
    # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers
    proxySetHeaders: {}
    # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
    addHeaders: {}
    # -- Optionally customize the pod dnsConfig.
    dnsConfig: {}
    # -- Optionally customize the pod hostAliases.
    hostAliases: []
    # - ip: 127.0.0.1
    #   hostnames:
    #   - foo.local
    #   - bar.local
    # - ip: 10.1.2.3
    #   hostnames:
    #   - foo.remote
    #   - bar.remote
    # -- Optionally customize the pod hostname.
    hostname: {}
    # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.
    # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller
    # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
    dnsPolicy: ClusterFirst
    # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
    # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
    reportNodeInternalIp: false
    # -- Process Ingress objects without ingressClass annotation/ingressClassName field
    # Overrides value for --watch-ingress-without-class flag of the controller binary
    # Defaults to false
    watchIngressWithoutClass: false
    # -- Process IngressClass per name (additionally as per spec.controller).
    ingressClassByName: false
    # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto"
    # Defaults to false
    enableTopologyAwareRouting: false
    # -- This configuration disable Nginx Controller Leader Election
    disableLeaderElection: false
    # -- This configuration defines if Ingress Controller should allow users to set
    # their own *-snippet annotations, otherwise this is forbidden / dropped
    # when users add those annotations.
    # Global snippets in ConfigMap are still respected
    allowSnippetAnnotations: false
    # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),
    # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920
    # is merged
    hostNetwork: false
    ## Use host ports 80 and 443
    ## Disabled by default
    hostPort:
      # -- Enable 'hostPort' or not
      enabled: false
      ports:
        # -- 'hostPort' http port
        http: 80
        # -- 'hostPort' https port
        https: 443
    # NetworkPolicy for controller component.
    networkPolicy:
      # -- Enable 'networkPolicy' or not
      enabled: false
    # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'
    electionID: ""
    ## This section refers to the creation of the IngressClass resource
    ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19
    ingressClassResource:
      # -- Name of the ingressClass
      name: nginx
      # -- Is this ingressClass enabled or not
      enabled: true
      # -- Is this the default ingressClass for the cluster
      default: false
      # -- Controller-value of the controller that is processing this ingressClass
      controllerValue: "k8s.io/ingress-nginx"
      # -- Parameters is a link to a custom resource containing additional
      # configuration for the controller. This is optional if the controller
      # does not require extra parameters.
      parameters: {}
    # -- For backwards compatibility with ingress.class annotation, use ingressClass.
    # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation
    ingressClass: nginx
    # -- Labels to add to the pod container metadata
    podLabels: {}
    #  key: value
    # -- Security context for controller pods
    podSecurityContext: {}
    # -- sysctls for controller pods
    ## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
    sysctls: {}
    # sysctls:
    #   "net.core.somaxconn": "8192"
    # -- Security context for controller containers
    containerSecurityContext: {}
    # -- Allows customization of the source of the IP address or FQDN to report
    # in the ingress status field. By default, it reads the information provided
    # by the service. If disable, the status field reports the IP address of the
    # node or nodes where an ingress controller pod is running.
    publishService:
      # -- Enable 'publishService' or not
      enabled: true
      # -- Allows overriding of the publish service to bind to
      # Must be <namespace>/<service_name>
      pathOverride: ""
    # Limit the scope of the controller to a specific namespace
    scope:
      # -- Enable 'scope' or not
      enabled: false
      # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)
      namespace: ""
      # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels
      # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.
      namespaceSelector: ""
    # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)
    configMapNamespace: ""
    tcp:
      # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)
      configMapNamespace: ""
      # -- Annotations to be added to the tcp config configmap
      annotations: {}
    udp:
      # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)
      configMapNamespace: ""
      # -- Annotations to be added to the udp config configmap
      annotations: {}
    # -- Maxmind license key to download GeoLite2 Databases.
    ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases
    maxmindLicenseKey: ""
    # -- Additional command line arguments to pass to Ingress-Nginx Controller
    # E.g. to specify the default SSL certificate you can use
    extraArgs: {}
    ## extraArgs:
    ##   default-ssl-certificate: "<namespace>/<secret_name>"
    ##   time-buckets: "0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10"
    ##   length-buckets: "10,20,30,40,50,60,70,80,90,100"
    ##   size-buckets: "10,100,1000,10000,100000,1e+06,1e+07"
    # -- Additional environment variables to set
    extraEnvs: []
    # extraEnvs:
    #   - name: FOO
    #     valueFrom:
    #       secretKeyRef:
    #         key: FOO
    #         name: secret-resource
    # -- Use a `DaemonSet` or `Deployment`
    kind: Deployment
    # -- Annotations to be added to the controller Deployment or DaemonSet
    ##
    annotations: {}
    #  keel.sh/pollSchedule: "@every 60m"
    # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels
    ##
    labels: {}
    #  keel.sh/policy: patch
    #  keel.sh/trigger: poll
    # -- The update strategy to apply to the Deployment or DaemonSet
    ##
    updateStrategy: {}
    #  rollingUpdate:
    #    maxUnavailable: 1
    #  type: RollingUpdate
    # -- `minReadySeconds` to avoid killing pods before we are ready
    ##
    minReadySeconds: 0
    # -- Node tolerations for server scheduling to nodes with taints
    ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
    ##
    tolerations: []
    #  - key: "key"
    #    operator: "Equal|Exists"
    #    value: "value"
    #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
    # -- Affinity and anti-affinity rules for server scheduling to nodes
    ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
    ##
    affinity: {}
    # # An example of preferred pod anti-affinity, weight is in the range 1-100
    # podAntiAffinity:
    #   preferredDuringSchedulingIgnoredDuringExecution:
    #   - weight: 100
    #     podAffinityTerm:
    #       labelSelector:
    #         matchExpressions:
    #         - key: app.kubernetes.io/name
    #           operator: In
    #           values:
    #           - ingress-nginx
    #         - key: app.kubernetes.io/instance
    #           operator: In
    #           values:
    #           - ingress-nginx
    #         - key: app.kubernetes.io/component
    #           operator: In
    #           values:
    #           - controller
    #       topologyKey: kubernetes.io/hostname
    # # An example of required pod anti-affinity
    # podAntiAffinity:
    #   requiredDuringSchedulingIgnoredDuringExecution:
    #   - labelSelector:
    #       matchExpressions:
    #       - key: app.kubernetes.io/name
    #         operator: In
    #         values:
    #         - ingress-nginx
    #       - key: app.kubernetes.io/instance
    #         operator: In
    #         values:
    #         - ingress-nginx
    #       - key: app.kubernetes.io/component
    #         operator: In
    #         values:
    #         - controller
    #     topologyKey: "kubernetes.io/hostname"
    # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.
    ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
    ##
    topologySpreadConstraints: []
    # - labelSelector:
    #     matchLabels:
    #       app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
    #       app.kubernetes.io/instance: '{{ .Release.Name }}'
    #       app.kubernetes.io/component: controller
    #   topologyKey: topology.kubernetes.io/zone
    #   maxSkew: 1
    #   whenUnsatisfiable: ScheduleAnyway
    # - labelSelector:
    #     matchLabels:
    #       app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
    #       app.kubernetes.io/instance: '{{ .Release.Name }}'
    #       app.kubernetes.io/component: controller
    #   topologyKey: kubernetes.io/hostname
    #   maxSkew: 1
    #   whenUnsatisfiable: ScheduleAnyway
    # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready
    ## wait up to five minutes for the drain of connections
    ##
    terminationGracePeriodSeconds: 300
    # -- Node labels for controller pod assignment
    ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
    ##
    nodeSelector:
      kubernetes.io/os: linux
    ## Liveness and readiness probe values
    ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
    ##
    ## startupProbe:
    ##   httpGet:
    ##     # should match container.healthCheckPath
    ##     path: "/healthz"
    ##     port: 10254
    ##     scheme: HTTP
    ##   initialDelaySeconds: 5
    ##   periodSeconds: 5
    ##   timeoutSeconds: 2
    ##   successThreshold: 1
    ##   failureThreshold: 5
    livenessProbe:
      httpGet:
        # should match container.healthCheckPath
        path: "/healthz"
        port: 10254
        scheme: HTTP
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 1
      successThreshold: 1
      failureThreshold: 5
    readinessProbe:
      httpGet:
        # should match container.healthCheckPath
        path: "/healthz"
        port: 10254
        scheme: HTTP
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 1
      successThreshold: 1
      failureThreshold: 3
    # -- Path of the health check endpoint. All requests received on the port defined by
    # the healthz-port parameter are forwarded internally to this path.
    healthCheckPath: "/healthz"
    # -- Address to bind the health check endpoint.
    # It is better to set this option to the internal node address
    # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.
    healthCheckHost: ""
    # -- Annotations to be added to controller pods
    ##
    podAnnotations: {}
    replicaCount: 1
    # -- Minimum available pods set in PodDisruptionBudget.
    # Define either 'minAvailable' or 'maxUnavailable', never both.
    minAvailable: 1
    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
    # maxUnavailable: 1
    ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes
    ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903
    ## Ideally, there should be no limits.
    ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/
    resources:
      ##  limits:
      ##    cpu: 100m
      ##    memory: 90Mi
      requests:
        cpu: 100m
        memory: 90Mi
    # Mutually exclusive with keda autoscaling
    autoscaling:
      enabled: false
      annotations: {}
      minReplicas: 1
      maxReplicas: 11
      targetCPUUtilizationPercentage: 50
      targetMemoryUtilizationPercentage: 50
      behavior: {}
      # scaleDown:
      #   stabilizationWindowSeconds: 300
      #   policies:
      #   - type: Pods
      #     value: 1
      #     periodSeconds: 180
      # scaleUp:
      #   stabilizationWindowSeconds: 300
      #   policies:
      #   - type: Pods
      #     value: 2
      #     periodSeconds: 60
    autoscalingTemplate: []
    # Custom or additional autoscaling metrics
    # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
    # - type: Pods
    #   pods:
    #     metric:
    #       name: nginx_ingress_controller_nginx_process_requests_total
    #     target:
    #       type: AverageValue
    #       averageValue: 10000m
    # Mutually exclusive with hpa autoscaling
    keda:
      apiVersion: "keda.sh/v1alpha1"
      ## apiVersion changes with keda 1.x vs 2.x
      ## 2.x = keda.sh/v1alpha1
      ## 1.x = keda.k8s.io/v1alpha1
      enabled: false
      minReplicas: 1
      maxReplicas: 11
      pollingInterval: 30
      cooldownPeriod: 300
      # fallback:
      #   failureThreshold: 3
      #   replicas: 11
      restoreToOriginalReplicaCount: false
      scaledObject:
        annotations: {}
        # Custom annotations for ScaledObject resource
        #  annotations:
        # key: value
      triggers: []
      # - type: prometheus
      #   metadata:
      #     serverAddress: http://<prometheus-host>:9090
      #     metricName: http_requests_total
      #     threshold: '100'
      #     query: sum(rate(http_requests_total{deployment="my-deployment"}[2m]))
      behavior: {}
      # scaleDown:
      #   stabilizationWindowSeconds: 300
      #   policies:
      #   - type: Pods
      #     value: 1
      #     periodSeconds: 180
      # scaleUp:
      #   stabilizationWindowSeconds: 300
      #   policies:
      #   - type: Pods
      #     value: 2
      #     periodSeconds: 60
    # -- Enable mimalloc as a drop-in replacement for malloc.
    ## ref: https://github.com/microsoft/mimalloc
    ##
    enableMimalloc: true
    ## Override NGINX template
    customTemplate:
      configMapName: ""
      configMapKey: ""
    service:
      # -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.
      enabled: true
      external:
        # -- Enable the external controller service or not. Useful for internal-only deployments.
        enabled: true
      # -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.
      annotations: {}
      # -- Labels to be added to both controller services.
      labels: {}
      # -- Type of the external controller service.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
      type: LoadBalancer
      # -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.
      # This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
      clusterIP: ""
      # -- List of node IP addresses at which the external controller service is available.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
      externalIPs: []
      # -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
      loadBalancerIP: ""
      # -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.
      loadBalancerSourceRanges: []
      # -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
      loadBalancerClass: ""
      # -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation
      # allocateLoadBalancerNodePorts: true
      # -- External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it.
      # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
      externalTrafficPolicy: ""
      # -- Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".
      # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
      sessionAffinity: ""
      # -- Specifies the health check node port (numeric port number) for the external controller service.
      # If not specified, the service controller allocates a port from your cluster's node port range.
      # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
      # healthCheckNodePort: 0
      # -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.
      # Fields `ipFamilies` and `clusterIP` depend on the value of this field.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
      ipFamilyPolicy: SingleStack
      # -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
      ipFamilies:
        - IPv4
      # -- Enable the HTTP listener on both controller services or not.
      enableHttp: true
      # -- Enable the HTTPS listener on both controller services or not.
      enableHttps: true
      ports:
        # -- Port the external HTTP listener is published with.
        http: 80
        # -- Port the external HTTPS listener is published with.
        https: 443
      targetPorts:
        # -- Port of the ingress controller the external HTTP listener is mapped to.
        http: http
        # -- Port of the ingress controller the external HTTPS listener is mapped to.
        https: https
      # -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.
      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol
      appProtocol: true
      nodePorts:
        # -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.
        http: ""
        # -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.
        https: ""
        # -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.
        # Example:
        # tcp:
        #   8080: 30080
        tcp: {}
        # -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.
        # Example:
        # udp:
        #   53: 30053
        udp: {}
      internal:
        # -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.
        enabled: false
        # -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
        annotations: {}
        # -- Type of the internal controller service.
        # Defaults to the value of `controller.service.type`.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
        type: ""
        # -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.
        # This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
        clusterIP: ""
        # -- List of node IP addresses at which the internal controller service is available.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
        externalIPs: []
        # -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
        loadBalancerIP: ""
        # -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.
        loadBalancerSourceRanges: []
        # -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
        loadBalancerClass: ""
        # -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation
        # allocateLoadBalancerNodePorts: true
        # -- External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it.
        # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
        externalTrafficPolicy: ""
        # -- Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".
        # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
        sessionAffinity: ""
        # -- Specifies the health check node port (numeric port number) for the internal controller service.
        # If not specified, the service controller allocates a port from your cluster's node port range.
        # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
        # healthCheckNodePort: 0
        # -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.
        # Fields `ipFamilies` and `clusterIP` depend on the value of this field.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
        ipFamilyPolicy: SingleStack
        # -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
        ipFamilies:
          - IPv4
        ports: {}
        # -- Port the internal HTTP listener is published with.
        # Defaults to the value of `controller.service.ports.http`.
        # http: 80
        # -- Port the internal HTTPS listener is published with.
        # Defaults to the value of `controller.service.ports.https`.
        # https: 443
        targetPorts: {}
        # -- Port of the ingress controller the internal HTTP listener is mapped to.
        # Defaults to the value of `controller.service.targetPorts.http`.
        # http: http
        # -- Port of the ingress controller the internal HTTPS listener is mapped to.
        # Defaults to the value of `controller.service.targetPorts.https`.
        # https: https
        # -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.
        # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol
        appProtocol: true
        nodePorts:
          # -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.
          http: ""
          # -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.
          https: ""
          # -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.
          # Example:
          # tcp:
          #   8080: 30080
          tcp: {}
          # -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.
          # Example:
          # udp:
          #   53: 30053
          udp: {}
    # shareProcessNamespace enables process namespace sharing within the pod.
    # This can be used for example to signal log rotation using `kill -USR1` from a sidecar.
    shareProcessNamespace: false
    # -- Additional containers to be added to the controller pod.
    # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.
    extraContainers: []
    #  - name: my-sidecar
    #    image: nginx:latest
    #  - name: lemonldap-ng-controller
    #    image: lemonldapng/lemonldap-ng-controller:0.2.0
    #    args:
    #      - /lemonldap-ng-controller
    #      - --alsologtostderr
    #      - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration
    #    env:
    #      - name: POD_NAME
    #        valueFrom:
    #          fieldRef:
    #            fieldPath: metadata.name
    #      - name: POD_NAMESPACE
    #        valueFrom:
    #          fieldRef:
    #            fieldPath: metadata.namespace
    #    volumeMounts:
    #    - name: copy-portal-skins
    #      mountPath: /srv/var/lib/lemonldap-ng/portal/skins
    # -- Additional volumeMounts to the controller main container.
    extraVolumeMounts: []
    #  - name: copy-portal-skins
    #   mountPath: /var/lib/lemonldap-ng/portal/skins
    # -- Additional volumes to the controller pod.
    extraVolumes: []
    #  - name: copy-portal-skins
    #    emptyDir: {}
    # -- Containers, which are run before the app containers are started.
    extraInitContainers: []
    # - name: init-myservice
    #   image: busybox
    #   command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
    # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module
    extraModules: []
    # - name: mytestmodule
    #   image:
    #     registry: registry.k8s.io
    #     image: ingress-nginx/mytestmodule
    #     ## for backwards compatibility consider setting the full image url via the repository value below
    #     ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
    #     ## repository:
    #     tag: "v1.0.0"
    #     digest: ""
    #     distroless: false
    #   containerSecurityContext:
    #     runAsNonRoot: true
    #     runAsUser: <user-id>
    #     allowPrivilegeEscalation: false
    #     seccompProfile:
    #       type: RuntimeDefault
    #     capabilities:
    #       drop:
    #       - ALL
    #     readOnlyRootFilesystem: true
    #   resources: {}
    #
    # The image must contain a `/usr/local/bin/init_module.sh` executable, which
    # will be executed as initContainers, to move its config files within the
    # mounted volume.
    opentelemetry:
      enabled: false
      name: opentelemetry
      image:
        registry: registry.k8s.io
        image: ingress-nginx/opentelemetry
        ## for backwards compatibility consider setting the full image url via the repository value below
        ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
        ## repository:
        tag: "v20230721-3e2062ee5"
        digest: sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
        distroless: true
      containerSecurityContext:
        runAsNonRoot: true
        # -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.
        runAsUser: 65532
        allowPrivilegeEscalation: false
        seccompProfile:
          type: RuntimeDefault
        capabilities:
          drop:
            - ALL
        readOnlyRootFilesystem: true
      resources: {}
    admissionWebhooks:
      name: admission
      annotations: {}
      # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem".
      ## Additional annotations to the admission webhooks.
      ## These annotations will be added to the ValidatingWebhookConfiguration and
      ## the Jobs Spec of the admission webhooks.
      enabled: true
      # -- Additional environment variables to set
      extraEnvs: []
      # extraEnvs:
      #   - name: FOO
      #     valueFrom:
      #       secretKeyRef:
      #         key: FOO
      #         name: secret-resource
      # -- Admission Webhook failure policy to use
      failurePolicy: Fail
      # timeoutSeconds: 10
      port: 8443
      certificate: "/usr/local/certificates/cert"
      key: "/usr/local/certificates/key"
      namespaceSelector: {}
      objectSelector: {}
      # -- Labels to be added to admission webhooks
      labels: {}
      # -- Use an existing PSP instead of creating one
      existingPsp: ""
      service:
        annotations: {}
        # clusterIP: ""
        externalIPs: []
        # loadBalancerIP: ""
        loadBalancerSourceRanges: []
        servicePort: 443
        type: ClusterIP
      createSecretJob:
        name: create
        # -- Security context for secret creation containers
        securityContext:
          runAsNonRoot: true
          runAsUser: 65532
          allowPrivilegeEscalation: false
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop:
              - ALL
          readOnlyRootFilesystem: true
        resources: {}
        # limits:
        #   cpu: 10m
        #   memory: 20Mi
        # requests:
        #   cpu: 10m
        #   memory: 20Mi
      patchWebhookJob:
        name: patch
        # -- Security context for webhook patch containers
        securityContext:
          runAsNonRoot: true
          runAsUser: 65532
          allowPrivilegeEscalation: false
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop:
              - ALL
          readOnlyRootFilesystem: true
        resources: {}
      patch:
        enabled: true
        image:
          registry: registry.k8s.io
          image: ingress-nginx/kube-webhook-certgen
          ## for backwards compatibility consider setting the full image url via the repository value below
          ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
          ## repository:
          tag: v1.4.0
          digest: sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334
          pullPolicy: IfNotPresent
        # -- Provide a priority class name to the webhook patching job
        ##
        priorityClassName: ""
        podAnnotations: {}
        # NetworkPolicy for webhook patch
        networkPolicy:
          # -- Enable 'networkPolicy' or not
          enabled: false
        nodeSelector:
          kubernetes.io/os: linux
        tolerations: []
        # -- Labels to be added to patch job resources
        labels: {}
        # -- Security context for secret creation & webhook patch pods
        securityContext: {}
      # Use certmanager to generate webhook certs
      certManager:
        enabled: false
        # self-signed root certificate
        rootCert:
          # default to be 5y
          duration: ""
        admissionCert:
          # default to be 1y
          duration: ""
          # issuerRef:
          #   name: "issuer"
          #   kind: "ClusterIssuer"
    metrics:
      port: 10254
      portName: metrics
      # if this port is changed, change healthz-port: in extraArgs: accordingly
      enabled: false
      service:
        annotations: {}
        # prometheus.io/scrape: "true"
        # prometheus.io/port: "10254"
        # -- Labels to be added to the metrics service resource
        labels: {}
        # clusterIP: ""
        # -- List of IP addresses at which the stats-exporter service is available
        ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
        ##
        externalIPs: []
        # loadBalancerIP: ""
        loadBalancerSourceRanges: []
        servicePort: 10254
        type: ClusterIP
        # externalTrafficPolicy: ""
        # nodePort: ""
      serviceMonitor:
        enabled: false
        additionalLabels: {}
        annotations: {}
        ## The label to use to retrieve the job name from.
        ## jobLabel: "app.kubernetes.io/name"
        namespace: ""
        namespaceSelector: {}
        ## Default: scrape .Release.Namespace or namespaceOverride only
        ## To scrape all, use the following:
        ## namespaceSelector:
        ##   any: true
        scrapeInterval: 30s
        # honorLabels: true
        targetLabels: []
        relabelings: []
        metricRelabelings: []
      prometheusRule:
        enabled: false
        additionalLabels: {}
        # namespace: ""
        rules: []
        # # These are just examples rules, please adapt them to your needs
        # - alert: NGINXConfigFailed
        #   expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0
        #   for: 1s
        #   labels:
        #     severity: critical
        #   annotations:
        #     description: bad ingress config - nginx config test failed
        #     summary: uninstall the latest ingress changes to allow config reloads to resume
        # # By default a fake self-signed certificate is generated as default and
        # # it is fine if it expires. If `--default-ssl-certificate` flag is used
        # # and a valid certificate passed please do not filter for `host` label!
        # # (i.e. delete `{host!="_"}` so also the default SSL certificate is
        # # checked for expiration)
        # - alert: NGINXCertificateExpiry
        #   expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!="_"}) by (host) - time()) < 604800
        #   for: 1s
        #   labels:
        #     severity: critical
        #   annotations:
        #     description: ssl certificate(s) will expire in less then a week
        #     summary: renew expiring certificates to avoid downtime
        # - alert: NGINXTooMany500s
        #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
        #   for: 1m
        #   labels:
        #     severity: warning
        #   annotations:
        #     description: Too many 5XXs
        #     summary: More than 5% of all requests returned 5XX, this requires your attention
        # - alert: NGINXTooMany400s
        #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
        #   for: 1m
        #   labels:
        #     severity: warning
        #   annotations:
        #     description: Too many 4XXs
        #     summary: More than 5% of all requests returned 4XX, this requires your attention
    # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:
    # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds
    # to 300, allowing the draining of connections up to five minutes.
    # If the active connections end before that, the pod will terminate gracefully at that time.
    # To effectively take advantage of this feature, the Configmap feature
    # worker-shutdown-timeout new value is 240s instead of 10s.
    ##
    lifecycle:
      preStop:
        exec:
          command:
            - /wait-shutdown
    priorityClassName: ""
  # -- Rollback limit
  ## @param revisionHistoryLimit Number of old history to retain to allow rollback
  ## @skip revisionHistoryLimit
  revisionHistoryLimit: 10
  ## Default 404 backend
  ## @param defaultBackend Default backend for handling requests that do not match any Ingress
  ## @skip defaultBackend
  defaultBackend:
    ##
    enabled: false
    name: defaultbackend
    image:
      registry: registry.k8s.io
      image: defaultbackend-amd64
      ## for backwards compatibility consider setting the full image url via the repository value below
      ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
      ## repository:
      tag: "1.5"
      pullPolicy: IfNotPresent
      runAsNonRoot: true
      # nobody user -> uid 65534
      runAsUser: 65534
      allowPrivilegeEscalation: false
      seccompProfile:
        type: RuntimeDefault
      readOnlyRootFilesystem: true
    # -- Use an existing PSP instead of creating one
    existingPsp: ""
    extraArgs: {}
    serviceAccount:
      create: true
      name: ""
      automountServiceAccountToken: true
    # -- Additional environment variables to set for defaultBackend pods
    extraEnvs: []
    port: 8080
    ## Readiness and liveness probes for default backend
    ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
    ##
    livenessProbe:
      failureThreshold: 3
      initialDelaySeconds: 30
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 5
    readinessProbe:
      failureThreshold: 6
      initialDelaySeconds: 0
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 5
    # -- The update strategy to apply to the Deployment or DaemonSet
    ##
    updateStrategy: {}
    #  rollingUpdate:
    #    maxUnavailable: 1
    #  type: RollingUpdate
    # -- `minReadySeconds` to avoid killing pods before we are ready
    ##
    minReadySeconds: 0
    # -- Node tolerations for server scheduling to nodes with taints
    ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
    ##
    tolerations: []
    #  - key: "key"
    #    operator: "Equal|Exists"
    #    value: "value"
    #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
    affinity: {}
    # -- Security context for default backend pods
    podSecurityContext: {}
    # -- Security context for default backend containers
    containerSecurityContext: {}
    # -- Labels to add to the pod container metadata
    podLabels: {}
    #  key: value
    # -- Node labels for default backend pod assignment
    ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
    ##
    nodeSelector:
      kubernetes.io/os: linux
    # -- Annotations to be added to default backend pods
    ##
    podAnnotations: {}
    replicaCount: 1
    minAvailable: 1
    resources: {}
    # limits:
    #   cpu: 10m
    #   memory: 20Mi
    # requests:
    #   cpu: 10m
    #   memory: 20Mi
    extraVolumeMounts: []
    ## Additional volumeMounts to the default backend container.
    #  - name: copy-portal-skins
    #   mountPath: /var/lib/lemonldap-ng/portal/skins
    extraVolumes: []
    ## Additional volumes to the default backend pod.
    #  - name: copy-portal-skins
    #    emptyDir: {}
    extraConfigMaps: []
    ## Additional configmaps to the default backend pod.
    #  - name: my-extra-configmap-1
    #    labels:
    #      type: config-1
    #    data:
    #      extra_file_1.html: |
    #        <!-- Extra HTML content for ConfigMap 1 -->
    #  - name: my-extra-configmap-2
    #    labels:
    #      type: config-2
    #    data:
    #      extra_file_2.html: |
    #        <!-- Extra HTML content for ConfigMap 2 -->
    autoscaling:
      annotations: {}
      enabled: false
      minReplicas: 1
      maxReplicas: 2
      targetCPUUtilizationPercentage: 50
      targetMemoryUtilizationPercentage: 50
    # NetworkPolicy for default backend component.
    networkPolicy:
      # -- Enable 'networkPolicy' or not
      enabled: false
    service:
      annotations: {}
      # clusterIP: ""
      # -- List of IP addresses at which the default backend service is available
      ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
      ##
      externalIPs: []
      # loadBalancerIP: ""
      loadBalancerSourceRanges: []
      servicePort: 80
      type: ClusterIP
    priorityClassName: ""
    # -- Labels to be added to the default backend resources
    labels: {}
  ## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
  ## @param rbac Create and use RBAC resources
  ## @skip rbac
  rbac:
    create: true
    scope: false
  ## If true, create & use Pod Security Policy resources
  ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
  ## @param podSecurityPolicy Create and use Pod Security Policy resources
  ## @skip podSecurityPolicy
  podSecurityPolicy:
    enabled: false
  ## @param serviceAccount Create and use service account resources
  ## @skip serviceAccount
  serviceAccount:
    create: true
    name: ""
    automountServiceAccountToken: true
    # -- Annotations for the controller service account
    annotations: {}
  # -- Optional array of imagePullSecrets containing private registry credentials
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  ## @param imagePullSecrets Image pull secrets
  ## @skip imagePullSecrets
  imagePullSecrets: []
  # - name: secretName
  # -- TCP service key-value pairs
  ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
  ##
  ## @param tcp Expose services over TCP
  ## @skip tcp
  tcp: {}
  #  "8080": "default/example-tcp-svc:9000"
  # -- UDP service key-value pairs
  ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
  ##
  ## @param udp Expose services over UDP
  ## @skip udp
  udp: {}
  #  "53": "kube-system/kube-dns:53"
  # -- Prefix for TCP and UDP ports names in ingress controller service
  ## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
  ## @param portNamePrefix Prefix for TCP and UDP ports names in ingress controller service
  ## @skip portNamePrefix
  portNamePrefix: ""
  # -- (string) A base64-encoded Diffie-Hellman parameter.
  # This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
  ## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
  ## @param dhParam A base64-encoded Diffie-Hellman parameter
  ## @skip dhParam
  dhParam: ""
