extraArgs: {}

agent:
  ## If false, agent will not be installed
  ##
  enabled: true

  ## agent container name
  ##
  name: agent

  image:
    repository: quay.io/uswitch/kiam
    tag: v2.8
    pullPolicy: IfNotPresent

  ## Logging settings
  ##
  log:
    jsonOutput: true
    level: info
  ## Host networking settings
  ##
  host:
    iptables: false
    port: 8181
    interface: cali+
  ## Prometheus metrics
  ##
  prometheus:
    scrape: true
    port: 9620
    syncInterval: 5s
  ## Annotations to be added to pods
  ##
  podAnnotations: {}
  ## Labels to be added to pods
  ##
  podLabels: {}
  ## Strategy for DaemonSet updates (requires Kubernetes 1.6+)
  ## Ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/
  ##
  updateStrategy: OnDelete
  ## Pod DNS policy
  ## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-policy
  ##
  dnsPolicy: ClusterFirstWithHostNet
  ## Node labels for pod assignment
  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
  ##
  nodeSelector: {}
    # kubernetes.io/role: node
  ## Pod tolerations
  ## Ref https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []
  ## Agent container resources
  ## Ref https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
  ##
  resources: {}
  ## Additional container arguments
  ##
  extraArgs: {}
  ## Additional container environment variables
  ##
  extraEnv: {}

  ## Additional container hostPath mounts
  ##
  extraHostPathMounts: []
    # - name: ssl-certs
    #   mountPath: /etc/ssl/certs
    ## Running on Amazon Linux or RHEL distros:
    #   hostPath: /etc/pki/ca-trust/extracted/pem
    ## else:
    #   hostPath: /usr/share/ca-certificates
    #   readOnly: true

  ## Timeout when creating the kiam gateway
  ##
  gatewayTimeoutCreation: 50ms

  ## Base64-encoded PEM values for agent's CA certificate(s), certificate and private key
  ##
  tlsFiles:
    ca:
    cert:
    key:

server:
  ## If false, server will not be installed
  ##
  enabled: true

  ## server container name
  ##
  name: server

  image:
    repository: quay.io/uswitch/kiam
    tag: v2.8
    pullPolicy: IfNotPresent

  ## Logging settings
  ##
  log:
    jsonOutput: true
    level: info
  ## Prometheus metrics
  ##
  prometheus:
    scrape: true
    port: 9620
    syncInterval: 5s
  ## Annotations to be added to pods
  ##
  podAnnotations: {}
  ## Strategy for DaemonSet updates (requires Kubernetes 1.6+)
  ## Ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/
  ##
  updateStrategy: OnDelete
  ## Node labels for pod assignment
  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
  ##
  nodeSelector: {}
    # kubernetes.io/role: master
  ## Pod tolerations
  ## Ref https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  ##
  tolerations: []
  ## Server container resources
  ## Ref https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
  ##
  resources: {}
  ## Additional container arguments
  ##
  extraArgs: {}
  ## Additional container environment variables
  ##
  extraEnv: {}

  ## Additional container hostPath mounts
  ##
  extraHostPathMounts: []
    # - name: ssl-certs
    #   mountPath: /etc/ssl/certs
    ## Running on Amazon Linux or RHEL distros:
    #   hostPath: /etc/pki/ca-trust/extracted/pem
    ## else:
    #   hostPath: /usr/share/ca-certificates
    #   readOnly: true

  service:
    port: 443
    targetPort: 443

  ## Timeout when creating the kiam gateway
  ##
  gatewayTimeoutCreation: 50ms

  ## Base64-encoded PEM values for server's CA certificate(s), certificate and private key
  ##
  tlsFiles:
    ca:
    cert:
    key:

  ## Base ARN for IAM roles
  ## If not specified use EC2 metadata service to detect ARN prefix
  ##
  roleBaseArn: null
  ## Pod cache settings
  ##
  cache:
    syncInterval: 1m
  ## IAM role for the server to assume
  ##
  assumeRoleArn: null
  ## Session duration for STS tokens
  ##
  sessionDuration: 15m
  ## Use hostNetwork for server
  ## Set this to true when running the servers on the same nodes as the agents
  useHostNetwork: false

rbac:
  # Specifies whether RBAC resources should be created
  create: true

serviceAccounts:
  agent:
    create: true
    name:
  server:
    create: true
    name:
