capsule/charts/capsule/values.yaml

# Default values for capsule.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# Secret Options
tls:
  # -- Start the Capsule controller that injects the CA into mutating and validating webhooks, and CRD as well.
  enableController: true
  # -- When cert-manager is disabled, Capsule will generate the TLS certificate for webhook and CRDs conversion.
  create: true
  # -- Override name of the Capsule TLS Secret name when externally managed.
  name: ""

# Manager Options
manager:

  # -- Set the controller deployment mode as `Deployment` or `DaemonSet`.
  kind: Deployment

  image:
    # -- Set the image repository of the capsule.
    repository: clastix/capsule
    # -- Set the image pull policy.
    pullPolicy: IfNotPresent
    # -- Overrides the image tag whose default is the chart appVersion.
    tag: ''

  # -- Configuration for `imagePullSecrets` so that you can use a private images registry.
  imagePullSecrets: []

  # -- Specifies if the container should be started in hostNetwork mode.
  #
  # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
  # CNI (such as calico), because control-plane managed by AWS cannot communicate
  # with pods' IP CIDR and admission webhooks are not working
  hostNetwork: false

  # Additional Capsule Controller Options
  options:
    # -- Set the log verbosity of the capsule with a value from 1 to 10
    logLevel: '4'
    # -- Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash
    forceTenantPrefix: false
    # -- Override the Capsule user groups
    capsuleUserGroups: ["capsule.clastix.io"]
    # -- If specified, disallows creation of namespaces matching the passed regexp
    protectedNamespaceRegex: ""
    # -- Specifies whether capsule webhooks certificates should be generated by capsule operator
    generateCertificates: true

  # -- Configure the liveness probe using Deployment probe spec
  livenessProbe:
    httpGet:
      path: /healthz
      port: 10080

  # -- Configure the readiness probe using Deployment probe spec
  readinessProbe:
    httpGet:
      path: /readyz
      port: 10080

  resources:
    limits:
      cpu: 200m
      memory: 128Mi
    requests:
      cpu: 200m
      memory: 128Mi

# -- Annotations to add to the capsule pod.
podAnnotations: {}
#  The following annotations guarantee scheduling for critical add-on pods
#  podAnnotations:
#    scheduler.alpha.kubernetes.io/critical-pod: ''

# -- Set the priority class name of the Capsule pod
priorityClassName: '' # system-cluster-critical

# -- Set the node selector for the Capsule pod
nodeSelector: {}
#  node-role.kubernetes.io/master: ""

# -- Set list of tolerations for the Capsule pod
tolerations: []
# - key: CriticalAddonsOnly
#   operator: Exists
# - effect: NoSchedule
#   key: node-role.kubernetes.io/master

# -- Set the replica count for capsule pod
replicaCount: 1

# -- Set affinity rules for the Capsule pod
affinity: {}

podSecurityPolicy:
  # -- Specify if a Pod Security Policy must be created
  enabled: false

jobs:
  image:
    # -- Set the image repository of the helm chart job
    repository: quay.io/clastix/kubectl
    # -- Set the image pull policy of the helm chart job
    pullPolicy: IfNotPresent
    # -- Set the image tag of the helm chart job
    tag: ""

# ServiceAccount
serviceAccount:
  # -- Specifies whether a service account should be created.
  create: true
  # -- Annotations to add to the service account.
  annotations: {}
  # -- The name of the service account to use. If not set and `serviceAccount.create=true`, a name is generated using the fullname template
  name: "capsule"

certManager:
  # -- Specifies whether capsule webhooks certificates should be generated using cert-manager
  generateCertificates: false

# -- Additional labels which will be added to all resources created by Capsule helm chart
customLabels: {}

# -- Additional annotations which will be added to all resources created by Capsule helm chart
customAnnotations: {}

# Webhooks configurations
webhooks:
  namespaceOwnerReference:
    failurePolicy: Fail
  cordoning:
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: capsule.clastix.io/tenant
          operator: Exists
  ingresses:
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: capsule.clastix.io/tenant
          operator: Exists
  namespaces:
    failurePolicy: Fail
  networkpolicies:
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: capsule.clastix.io/tenant
          operator: Exists
  pods:
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: capsule.clastix.io/tenant
          operator: Exists
  persistentvolumeclaims:
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: capsule.clastix.io/tenant
          operator: Exists
  tenants:
    failurePolicy: Fail
  services:
    failurePolicy: Fail
    namespaceSelector:
      matchExpressions:
        - key: capsule.clastix.io/tenant
          operator: Exists
  nodes:
    failurePolicy: Fail

# -- Timeout in seconds for mutating webhooks
mutatingWebhooksTimeoutSeconds: 30
# -- Timeout in seconds for validating webhooks
validatingWebhooksTimeoutSeconds: 30

# ServiceMonitor
serviceMonitor:
  # -- Enable ServiceMonitor
  enabled: false
  # -- Install the ServiceMonitor into a different Namespace, as the monitoring stack one (default: the release one)
  namespace: ''
  # -- Assign additional labels according to Prometheus' serviceMonitorSelector matching labels
  labels: {}
  # -- Assign additional Annotations
  annotations: {}
  # -- Change matching labels
  matchLabels: {}
  # -- Set targetLabels for the serviceMonitor
  targetLabels: []
  serviceAccount:
    # -- ServiceAccount for Metrics RBAC
    name: capsule
    # -- ServiceAccount Namespace for Metrics RBAC
    namespace: capsule-system
  endpoint:
    # -- Set the scrape interval for the endpoint of the serviceMonitor
    interval: "15s"
    # -- Set the scrape timeout for the endpoint of the serviceMonitor
    scrapeTimeout: ""
    # -- Set metricRelabelings for the endpoint of the serviceMonitor
    metricRelabelings: []
    # -- Set relabelings for the endpoint of the serviceMonitor
    relabelings: []