values.yaml

# -- If set to true, local DNS mapping is added to pods.
local: false
# -- Enables/disables Gatekeeper.
secured_gatekeepers: true
# -- The root domain.
domain: ${{DOMAIN}}
# -- The K8s namespace.
namespace: ch
# -- Name of mainapp, routes incoming traffic of root `domaim` to this app.
mainapp: samples
registry:
  # -- The docker registry.
  name: "localhost:5000"
  # -- Optional secret used for pulling from docker registry.
  secret:
    # -- Secret name used for pulling from docker registry.
    name: null
    # -- Value of the secret used for pulling from docker registry in json encoded format.
    value: null
# -- Docker tag used to pull images.
tag: latest
# -- List of applications.
# @default -- Will be filled automatically.
apps: {}
env:
  # -- Cloud Harness version
  - name: CH_VERSION
    value: 2.5.0
privenv:
  # -- Defines a secret as private environment variable that is injected in containers.
  - name: CH_SECRET
    value: In God we trust; all others must bring data. ― W. Edwards Deming
ingress:
  # -- Flag to enable/disalbe ingress controller.
  enabled: true
  # -- K8s Name of ingress.
  name: cloudharness-ingress
  # -- The ingress class to use (e.g. "nginx", "traefik").
  ingressClass: nginx
  # -- Additional custom annotations to add to the Ingress resource.
  annotations: {}
  # -- Enables/disables SSL redirect.
  ssl_redirect: true
  letsencrypt:
    # -- Whether to provision a cert-manager ACME Issuer for Let's Encrypt. Set to
    # false to use externally provided TLS certificates (e.g. ACM/ALB, commercial
    # wildcard, internal CA, air-gapped) — the per-app `tls-secret-<name>` Secrets
    # must then exist in the namespace.
    enabled: true
    # -- Email for letsencrypt.
    email: cloudharness@metacell.us
    # -- Name of the Secret cert-manager uses to store the ACME account private key.
    privateKeySecretName: tls-secret-issuer
    # -- ACME solvers passed through to the cert-manager Issuer. If empty, defaults to
    # an http01 solver using `ingress.ingressClass`. Override with one or more dns01
    # solvers to obtain certificates for non-public domains. See `secrets` below to
    # declare any credential Secrets referenced by `*SecretRef` here.
    # Example (Cloudflare):
    #   solvers:
    #     - dns01:
    #         cloudflare:
    #           apiTokenSecretRef:
    #             name: cloudflare-api-token
    #             key: api-token
    solvers: []
    # -- Credential Secrets created in the namespace alongside the Issuer. Each entry
    # becomes a Kubernetes Secret named after the key, with the inner map rendered as
    # `stringData`. Reference these from `solvers` above. Leave empty if you create
    # provider credential secrets out-of-band (e.g. with sealed-secrets / external
    # secrets / `kubectl create secret`).
    # Example:
    #   secrets:
    #     cloudflare-api-token:
    #       api-token: ${CLOUDFLARE_API_TOKEN}
    secrets: {}
  # -- BYO TLS certificates (used when `letsencrypt.enabled` is false, or for local
  # deployments). Two paths, used together:
  #   1. File-based shared cert: drop PEM at `resources/certs/tls.crt|key` and it is
  #      applied to every app that needs TLS.
  #   2. Per-app overrides: `tls.certs.<appName>.{crt,key}` (PEM strings) materialize
  #      a `tls-secret-<appName>` of type `kubernetes.io/tls` and override the
  #      file-based shared cert for that app.
  # Use `${VAR}` interpolation to keep raw PEM out of committed values files.
  tls:
    # -- Map of `<appName>` to `{crt, key}` PEM strings.
    # Example:
    #   certs:
    #     myapp:
    #       crt: ${MYAPP_TLS_CRT}
    #       key: ${MYAPP_TLS_KEY}
    certs: {}
  # -- Default regex segment for routes (used in paths like '/(pattern)').
  path: "/"
  # -- The pathType for the Ingress path. Default is Prefix. For regex paths, set to ImplementationSpecific
  pathType: Prefix
# -- Deployment wide configuration of the secret managers referenced by `harness.secrets`.
# Each entry is keyed by manager name and holds the settings shared by all the secrets
# handled by that manager. Settings can be overridden secret by secret. This is plain
# configuration and is exposed in the allvalues config map: never put credentials here.
# @default -- Empty, no secret manager configured.
secretmanagers: {}
  # onepassword:
  #   # -- Vault used when a secret only specifies the item name instead of the full item path.
  #   vault: my-vault
  # aws:
  #   # -- Name of the External Secrets Operator store pointing to AWS Secrets Manager.
  #   store: aws-secrets-manager
  #   # -- SecretStore or ClusterSecretStore.
  #   storeKind: ClusterSecretStore
  #   # -- How often the value is refreshed from AWS.
  #   refreshInterval: 1h
backup:
  # -- Flag to enable/disable backups.
  active: false
  # -- Number of days to keep backups.
  keep_days: "7"
  # -- Number of weeks to keep backups.
  keep_weeks: "4"
  # -- Number of months to keep backups.
  keep_months: "6"
  # -- Schedule as cronjob expression.
  schedule: "*/5 * * * *"
  # -- The file suffix added to backup files.
  suffix: ".gz"
  # -- The volume size for backups (all backups share the same volume)
  volumesize: "2Gi"
  # -- Target directory of backups, the mount point of the persistent volume.
  dir: "/backups"
  resources:
    requests:
      # -- K8s memory resource definition.
      memory: "32Mi"
      # -- K8s cpu resource definition.
      cpu: "25m"
    limits:
      # -- K8s memory resource definition.
      memory: "64Mi"
      # -- K8s cpu resource definition.
      cpu: "50m"
proxy:
  # -- Set to false to hide remote client headers. Will hide the client IPs in all logs
  forwardedHeaders: true
  timeout:
    # -- Timeout for proxy connections in seconds.
    send: 60
    # -- Timeout for proxy responses in seconds.
    read: 60
    keepalive: 60
  payload:
    # -- Maximum size of payload in MB
    max: 250
  gatekeeper:
    # -- Default gatekeeper image
    image: "quay.io/gogatekeeper/gatekeeper:4.6.0"
    # -- Default number of gatekeeper replicas
    replicas: 1
    secret: ""
    resources:
      requests:
        memory: "32Mi"
      limits:
        memory: "64Mi"