add external-secrets
This commit is contained in:
553
system-apps/external-secrets/chart/values.yaml
Normal file
553
system-apps/external-secrets/chart/values.yaml
Normal file
@@ -0,0 +1,553 @@
|
||||
global:
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
topologySpreadConstraints: []
|
||||
affinity: {}
|
||||
compatibility:
|
||||
openshift:
|
||||
# -- Manages the securityContext properties to make them compatible with OpenShift.
|
||||
# Possible values:
|
||||
# auto - Apply configurations if it is detected that OpenShift is the target platform.
|
||||
# force - Always apply configurations.
|
||||
# disabled - No modification applied.
|
||||
adaptSecurityContext: auto
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
bitwarden-sdk-server:
|
||||
enabled: false
|
||||
|
||||
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
image:
|
||||
repository: oci.external-secrets.io/external-secrets/external-secrets
|
||||
pullPolicy: IfNotPresent
|
||||
# -- The image tag to use. The default is the chart appVersion.
|
||||
tag: ""
|
||||
# -- The flavour of tag you want to use
|
||||
# There are different image flavours available, like distroless and ubi.
|
||||
# Please see GitHub release notes for image tags for these flavors.
|
||||
# By default, the distroless image is used.
|
||||
flavour: ""
|
||||
|
||||
# -- If set, install and upgrade CRDs through helm chart.
|
||||
installCRDs: true
|
||||
|
||||
crds:
|
||||
# -- If true, create CRDs for Cluster External Secret.
|
||||
createClusterExternalSecret: true
|
||||
# -- If true, create CRDs for Cluster Secret Store.
|
||||
createClusterSecretStore: true
|
||||
# -- If true, create CRDs for Cluster Generator.
|
||||
createClusterGenerator: true
|
||||
# -- If true, create CRDs for Push Secret.
|
||||
createPushSecret: true
|
||||
annotations: {}
|
||||
conversion:
|
||||
# -- If webhook is set to false this also needs to be set to false otherwise the kubeapi will be hammered because the conversion is looking for a webhook endpoint.
|
||||
enabled: true
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
namespaceOverride: ""
|
||||
|
||||
# -- Additional labels added to all helm chart resources.
|
||||
commonLabels: {}
|
||||
|
||||
# -- If true, external-secrets will perform leader election between instances to ensure no more
|
||||
# than one instance of external-secrets operates at a time.
|
||||
leaderElect: false
|
||||
|
||||
# -- If set external secrets will filter matching
|
||||
# Secret Stores with the appropriate controller values.
|
||||
controllerClass: ""
|
||||
|
||||
# -- If true external secrets will use recommended kubernetes
|
||||
# annotations as prometheus metric labels.
|
||||
extendedMetricLabels: false
|
||||
|
||||
# -- If set external secrets are only reconciled in the
|
||||
# provided namespace
|
||||
scopedNamespace: ""
|
||||
|
||||
# -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace
|
||||
# and implicitly disable cluster stores and cluster external secrets
|
||||
scopedRBAC: false
|
||||
|
||||
# -- if true, the operator will process cluster external secret. Else, it will ignore them.
|
||||
processClusterExternalSecret: true
|
||||
|
||||
# -- if true, the operator will process cluster store. Else, it will ignore them.
|
||||
processClusterStore: true
|
||||
|
||||
# -- if true, the operator will process push secret. Else, it will ignore them.
|
||||
processPushSecret: true
|
||||
|
||||
# -- Specifies whether an external secret operator deployment be created.
|
||||
createOperator: true
|
||||
|
||||
# -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at
|
||||
# a time.
|
||||
concurrent: 1
|
||||
# -- Specifices Log Params to the External Secrets Operator
|
||||
log:
|
||||
level: info
|
||||
timeEncoding: epoch
|
||||
service:
|
||||
# -- Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)
|
||||
ipFamilyPolicy: ""
|
||||
# -- Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
|
||||
ipFamilies: []
|
||||
|
||||
serviceAccount:
|
||||
# -- Specifies whether a service account should be created.
|
||||
create: true
|
||||
# -- Automounts the service account token in all containers of the pod
|
||||
automount: true
|
||||
# -- Annotations to add to the service account.
|
||||
annotations: {}
|
||||
# -- Extra Labels to add to the service account.
|
||||
extraLabels: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template.
|
||||
name: ""
|
||||
|
||||
rbac:
|
||||
# -- Specifies whether role and rolebinding resources should be created.
|
||||
create: true
|
||||
|
||||
servicebindings:
|
||||
# -- Specifies whether a clusterrole to give servicebindings read access should be created.
|
||||
create: true
|
||||
|
||||
## -- Extra environment variables to add to container.
|
||||
extraEnv: []
|
||||
|
||||
## -- Map of extra arguments to pass to container.
|
||||
extraArgs: {}
|
||||
|
||||
## -- Extra volumes to pass to pod.
|
||||
extraVolumes: []
|
||||
|
||||
## -- Extra Kubernetes objects to deploy with the helm chart
|
||||
extraObjects: []
|
||||
|
||||
## -- Extra volumes to mount to the container.
|
||||
extraVolumeMounts: []
|
||||
|
||||
## -- Extra containers to add to the pod.
|
||||
extraContainers: []
|
||||
|
||||
# -- Annotations to add to Deployment
|
||||
deploymentAnnotations: {}
|
||||
|
||||
# -- Annotations to add to Pod
|
||||
podAnnotations: {}
|
||||
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
enabled: true
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 32Mi
|
||||
|
||||
serviceMonitor:
|
||||
# -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics
|
||||
enabled: false
|
||||
|
||||
# -- namespace where you want to install ServiceMonitors
|
||||
namespace: ""
|
||||
|
||||
# -- Additional labels
|
||||
additionalLabels: {}
|
||||
|
||||
# -- Interval to scrape metrics
|
||||
interval: 30s
|
||||
|
||||
# -- Timeout if metrics can't be retrieved in given time interval
|
||||
scrapeTimeout: 25s
|
||||
|
||||
# -- Let prometheus add an exported_ prefix to conflicting labels
|
||||
honorLabels: false
|
||||
|
||||
# -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs)
|
||||
metricRelabelings: []
|
||||
# - action: replace
|
||||
# regex: (.*)
|
||||
# replacement: $1
|
||||
# sourceLabels:
|
||||
# - exported_namespace
|
||||
# targetLabel: namespace
|
||||
|
||||
# -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config)
|
||||
relabelings: []
|
||||
# - sourceLabels: [__meta_kubernetes_pod_node_name]
|
||||
# separator: ;
|
||||
# regex: ^(.*)$
|
||||
# targetLabel: nodename
|
||||
# replacement: $1
|
||||
# action: replace
|
||||
|
||||
metrics:
|
||||
|
||||
listen:
|
||||
port: 8080
|
||||
|
||||
service:
|
||||
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
|
||||
enabled: false
|
||||
|
||||
# -- Metrics service port to scrape
|
||||
port: 8080
|
||||
|
||||
# -- Additional service annotations
|
||||
annotations: {}
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
# -- Pod priority class name.
|
||||
priorityClassName: ""
|
||||
|
||||
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
minAvailable: 1
|
||||
# maxUnavailable: 1
|
||||
|
||||
# -- Run the controller on the host network
|
||||
hostNetwork: false
|
||||
|
||||
webhook:
|
||||
# -- Specifies whether a webhook deployment be created.
|
||||
create: true
|
||||
# -- Specifices the time to check if the cert is valid
|
||||
certCheckInterval: "5m"
|
||||
# -- Specifices the lookaheadInterval for certificate validity
|
||||
lookaheadInterval: ""
|
||||
replicaCount: 1
|
||||
# -- Specifices Log Params to the Webhook
|
||||
log:
|
||||
level: info
|
||||
timeEncoding: epoch
|
||||
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
certDir: /tmp/certs
|
||||
# -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore
|
||||
failurePolicy: Fail
|
||||
# -- Specifies if webhook pod should use hostNetwork or not.
|
||||
hostNetwork: false
|
||||
image:
|
||||
repository: oci.external-secrets.io/external-secrets/external-secrets
|
||||
pullPolicy: IfNotPresent
|
||||
# -- The image tag to use. The default is the chart appVersion.
|
||||
tag: ""
|
||||
# -- The flavour of tag you want to use
|
||||
flavour: ""
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
# -- The port the webhook will listen to
|
||||
port: 10250
|
||||
rbac:
|
||||
# -- Specifies whether role and rolebinding resources should be created.
|
||||
create: true
|
||||
serviceAccount:
|
||||
# -- Specifies whether a service account should be created.
|
||||
create: true
|
||||
# -- Automounts the service account token in all containers of the pod
|
||||
automount: true
|
||||
# -- Annotations to add to the service account.
|
||||
annotations: {}
|
||||
# -- Extra Labels to add to the service account.
|
||||
extraLabels: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template.
|
||||
name: ""
|
||||
nodeSelector: {}
|
||||
|
||||
certManager:
|
||||
# -- Enabling cert-manager support will disable the built in secret and
|
||||
# switch to using cert-manager (installed separately) to automatically issue
|
||||
# and renew the webhook certificate. This chart does not install
|
||||
# cert-manager for you, See https://cert-manager.io/docs/
|
||||
enabled: false
|
||||
# -- Automatically add the cert-manager.io/inject-ca-from annotation to the
|
||||
# webhooks and CRDs. As long as you have the cert-manager CA Injector
|
||||
# enabled, this will automatically setup your webhook's CA to the one used
|
||||
# by cert-manager. See https://cert-manager.io/docs/concepts/ca-injector
|
||||
addInjectorAnnotations: true
|
||||
cert:
|
||||
# -- Create a certificate resource within this chart. See
|
||||
# https://cert-manager.io/docs/usage/certificate/
|
||||
create: true
|
||||
# -- For the Certificate created by this chart, setup the issuer. See
|
||||
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.IssuerSpec
|
||||
issuerRef:
|
||||
group: cert-manager.io
|
||||
kind: "Issuer"
|
||||
name: "my-issuer"
|
||||
# -- Set the requested duration (i.e. lifetime) of the Certificate. See
|
||||
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
|
||||
# One year by default.
|
||||
duration: "8760h"
|
||||
# -- Set the revisionHistoryLimit on the Certificate. See
|
||||
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
|
||||
# Defaults to nil.
|
||||
revisionHistoryLimit: ""
|
||||
# -- How long before the currently issued certificate’s expiry
|
||||
# cert-manager should renew the certificate. See
|
||||
# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
|
||||
# Note that renewBefore should be greater than .webhook.lookaheadInterval
|
||||
# since the webhook will check this far in advance that the certificate is
|
||||
# valid.
|
||||
renewBefore: ""
|
||||
# -- Add extra annotations to the Certificate resource.
|
||||
annotations: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
# -- Pod priority class name.
|
||||
priorityClassName: ""
|
||||
|
||||
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
minAvailable: 1
|
||||
# maxUnavailable: 1
|
||||
|
||||
metrics:
|
||||
|
||||
listen:
|
||||
port: 8080
|
||||
|
||||
service:
|
||||
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
|
||||
enabled: false
|
||||
|
||||
# -- Metrics service port to scrape
|
||||
port: 8080
|
||||
|
||||
# -- Additional service annotations
|
||||
annotations: {}
|
||||
|
||||
|
||||
readinessProbe:
|
||||
# -- Address for readiness probe
|
||||
address: ""
|
||||
# -- ReadinessProbe port for kubelet
|
||||
port: 8081
|
||||
|
||||
|
||||
## -- Extra environment variables to add to container.
|
||||
extraEnv: []
|
||||
|
||||
## -- Map of extra arguments to pass to container.
|
||||
extraArgs: {}
|
||||
|
||||
## -- Extra volumes to pass to pod.
|
||||
extraVolumes: []
|
||||
|
||||
## -- Extra volumes to mount to the container.
|
||||
extraVolumeMounts: []
|
||||
|
||||
# -- Annotations to add to Secret
|
||||
secretAnnotations: {}
|
||||
|
||||
# -- Annotations to add to Deployment
|
||||
deploymentAnnotations: {}
|
||||
|
||||
# -- Annotations to add to Pod
|
||||
podAnnotations: {}
|
||||
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
enabled: true
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 32Mi
|
||||
|
||||
# -- Manage the service through which the webhook is reached.
|
||||
service:
|
||||
# -- Whether the service object should be enabled or not (it is expected to exist).
|
||||
enabled: true
|
||||
# -- Custom annotations for the webhook service.
|
||||
annotations: {}
|
||||
# -- Custom labels for the webhook service.
|
||||
labels: {}
|
||||
# -- The service type of the webhook service.
|
||||
type: ClusterIP
|
||||
# -- If the webhook service type is LoadBalancer, you can assign a specific load balancer IP here.
|
||||
# Check the documentation of your load balancer provider to see if/how this should be used.
|
||||
loadBalancerIP: ""
|
||||
|
||||
certController:
|
||||
# -- Specifies whether a certificate controller deployment be created.
|
||||
create: true
|
||||
requeueInterval: "5m"
|
||||
replicaCount: 1
|
||||
# -- Specifices Log Params to the Certificate Controller
|
||||
log:
|
||||
level: info
|
||||
timeEncoding: epoch
|
||||
# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
image:
|
||||
repository: oci.external-secrets.io/external-secrets/external-secrets
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
flavour: ""
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
rbac:
|
||||
# -- Specifies whether role and rolebinding resources should be created.
|
||||
create: true
|
||||
serviceAccount:
|
||||
# -- Specifies whether a service account should be created.
|
||||
create: true
|
||||
# -- Automounts the service account token in all containers of the pod
|
||||
automount: true
|
||||
# -- Annotations to add to the service account.
|
||||
annotations: {}
|
||||
# -- Extra Labels to add to the service account.
|
||||
extraLabels: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template.
|
||||
name: ""
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
# -- Run the certController on the host network
|
||||
hostNetwork: false
|
||||
|
||||
# -- Pod priority class name.
|
||||
priorityClassName: ""
|
||||
|
||||
# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
minAvailable: 1
|
||||
# maxUnavailable: 1
|
||||
|
||||
metrics:
|
||||
|
||||
listen:
|
||||
port: 8080
|
||||
|
||||
service:
|
||||
# -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
|
||||
enabled: false
|
||||
|
||||
# -- Metrics service port to scrape
|
||||
port: 8080
|
||||
|
||||
# -- Additional service annotations
|
||||
annotations: {}
|
||||
|
||||
readinessProbe:
|
||||
# -- Address for readiness probe
|
||||
address: ""
|
||||
# -- ReadinessProbe port for kubelet
|
||||
port: 8081
|
||||
|
||||
## -- Extra environment variables to add to container.
|
||||
extraEnv: []
|
||||
|
||||
## -- Map of extra arguments to pass to container.
|
||||
extraArgs: {}
|
||||
|
||||
|
||||
## -- Extra volumes to pass to pod.
|
||||
extraVolumes: []
|
||||
|
||||
## -- Extra volumes to mount to the container.
|
||||
extraVolumeMounts: []
|
||||
|
||||
# -- Annotations to add to Deployment
|
||||
deploymentAnnotations: {}
|
||||
|
||||
# -- Annotations to add to Pod
|
||||
podAnnotations: {}
|
||||
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
enabled: true
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 32Mi
|
||||
|
||||
# -- Specifies `dnsPolicy` to deployment
|
||||
dnsPolicy: ClusterFirst
|
||||
|
||||
# -- Specifies `dnsOptions` to deployment
|
||||
dnsConfig: {}
|
||||
|
||||
# -- Any extra pod spec on the deployment
|
||||
podSpecExtra: {}
|
||||
Reference in New Issue
Block a user