Runtime Provisioner 0.8.0 Helm Readme

# Default values for runtime-provisioner.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

global:
  # -- The domain of the Kubernetes cluster. The vast majority of Kubernetes clusters use the default value.
  clusterDomain: "cluster.local"

  # -- Globally override the registry to pull images from.
  imageRegistry: ""
  # -- Globally override the list of ImagePullSecrets provided.
  imagePullSecrets: []

# -- Override the app name generated by the chart.
nameOverride: ""
# -- Override the fully qualified app name generated by the chart.
fullnameOverride: ""

# -- Number of pods to deploy.
replicaCount: 1

image:
  # -- Registry to pull the image from.
  registry: "registry.axual.io"
  # -- Name of the image being deployed.
  repository: "axual/runtime-provisioner"
  # -- Override the image tag whose default is the chart `appVersion`.
  tag: ""
  # -- One of `Always`, `IfNotPresent`, or `Never`.
  pullPolicy: "IfNotPresent"


# -- Environment variables to define for the container.
# See the Kubernetes documentation on [Environment Variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/).
env:
  - name: REGISTRY_URL
    value: "registry.axual.io/opensource/charts"
  - name: CHART_NAME
    value: "ksml"
  - name: CHART_VERSION
    value: "1.3.2"
  - name: NAMESPACE
    value: "default"

# -- Caps how many log streams run at once, across KSML and Kafka Connect together. It counts pod
# streams, not requests, because one Kafka Connect request opens one stream per worker pod. Over the
# cap the endpoint answers 503. Set to 0 for no limit.
maxConcurrentLogStreams: 200

# -- Kafka Connect log streaming. Worker pod logs are read and merged into one stream, finding pods
# by the axual.io/tenant, axual.io/instance and axual.io/connect-cluster labels.
connect:
  # -- Creates the read-only Role and RoleBinding for the namespaces below. It does not switch the
  # endpoint on or off: `/kafkaconnect/logs` is served whenever the provisioner runs against
  # Kubernetes. Without the permission it answers 404, because it finds no pods.
  enabled: false
  # -- Namespaces to search for Kafka Connect worker pods. With `connect.enabled`, a Role and
  # RoleBinding for read-only access to pods and pod logs is created in each. Connect clusters are
  # usually in another namespace, so leaving this empty finds nothing. Readiness checks these same
  # namespaces, so name only ones the service account may read.
  namespaces: []
  # -- Overrides the worker container to read logs from. Only needed for a pod with several
  # containers where none matches the strimzi.io/name label.
  containerName: ""
  # -- Raw lines read per worker pod when a request filters by connector, as a percentage of the lines
  # asked for. Kubernetes cannot filter log content, so reading only as many lines as were asked for
  # returns almost nothing when the wanted connector is a small share of the traffic. At 2000, a request
  # for 100 lines reads 2000 raw ones. Raise it for a quiet connector on a chatty cluster, lower it if
  # reads feel slow. 100 disables the widening, and anything below 100 is clamped to 100 rather than
  # falling back to the default, so lowering it never reads more. Leaving it unset uses the default. A
  # request without a filter ignores this and reads exactly the requested count per pod.
  filterWindowPercent: 2000
  # -- Ceiling on that window, in lines. Because tailLines is capped at 1000, this only binds once
  # filterWindowPercent is above 5000: at the default 2000 the widest window is already 20000. Reading
  # wide is cheap, since non-matching lines are dropped as they are read, so memory follows the answer
  # and not the window. See the provisioner README section "Filtering and the read window".
  filterWindowMaxLines: 50000
  # -- Most a whole-log download may copy in total, across every worker, in bytes. A safety net rather
  # than a feature limit: the container runtime replaces a worker's log file once it fills, usually at
  # 10 to 20 MB, and only the current file can be read, so a real download stops well before this. It
  # exists for a cluster configured with a much larger rotation size, where one worker could otherwise
  # send hundreds of MB to a browser. Hitting it still produces a valid file, whose last line says it
  # was truncated. Zero or less falls back to the default 67108864, which is 64 MiB.
  downloadCapBytes: 67108864

# -- Custom values to pass to the KSML Helm charts.
# Can be used to set resources, securityContext and any other customization needed for KSML pod started by the provisioner.
customValues: {}

# -- List of ImagePullSecrets to apply to the service account. If the service account is disabled, it will be applied to the pod instead.
imagePullSecrets: []

serviceAccount:
  # -- Specifies whether a service account should be created
  create: true
  # -- Annotations to add to the service account
  annotations: {}
  # -- The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template.
  name: ""

# -- Creates `role` and `rolebinding` to allow provisioning K8s resources related to KSML
rbac:
  # -- Set false to disable creation of `role` and `rolebinding`
  create: true
  # -- Set the namespace where `role` and `rolebinding` are created. KSML apps will be deployable in this namespace only.
  # namespace: default

# -- Extra annotations to add to the Pods.
podAnnotations: {}

# -- Pod-level security attributes and common container settings.
podSecurityContext: {}
#   fsGroup: 2000

livenessProbe:
  # -- Minimum consecutive failures for the probe to be considered failed after having succeeded.
  # A failed livenessProbe will cause the container to be restarted.
  failureThreshold: 3
  # -- Number of seconds after the container has started before liveness probes are initiated.
  initialDelaySeconds: 10
  # -- How often (in seconds) to perform the probe.
  periodSeconds: 10
  # -- Minimum consecutive successes for the probe to be considered successful after having failed.
  successThreshold: 1
  # -- Number of seconds after which the probe times out.
  timeoutSeconds: 1

readinessProbe:
  # -- Minimum consecutive failures for the probe to be considered failed after having succeeded.
  # A failed readinessProbe will cause the container to move to the `NotReady` state.
  failureThreshold: 3
  # -- Number of seconds after the container has started before readiness probes are initiated.
  initialDelaySeconds: 0
  # -- How often (in seconds) to perform the probe.
  periodSeconds: 10
  # -- Minimum consecutive successes for the probe to be considered successful after having failed.
  successThreshold: 1
  # -- Number of seconds after which the probe times out.
  # Readiness asks the Kubernetes API whether it can still list pods, so it needs longer than a port
  # check. It must stay above the service's own 3 second limit, or the probe gives up first.
  timeoutSeconds: 5

# -- Defines the security options the container should be run with.
# If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
# @default -- See `values.yaml` file.
securityContext: {}

# -- Additional init containers, e.g. for configuring java-security
extraInitContainers: ""

# -- Add additional volumes, e.g. for java-security
extraVolumes: ""

# -- Add additional volumes mounts, e.g. for java-security
extraVolumeMounts: ""

# -- Additional sidecar containers, e.g. for a database proxy, such as Google's cloudsql-proxy
extraContainers: ""

service:
  # -- Determines how the Service is exposed.
  type: ClusterIP
  # -- The port that will be exposed by the service.
  # Note: this is independent of the ports opened on the container.
  port: 80

ingress:
  # -- Enable creation of the Ingress resource to expose this service.
  enabled: false
  # -- The name of the IngressClass cluster resource.
  # The associated IngressClass defines which controller will implement the resource.
  className: ""
  # -- Annotations to add to the Ingress resource.
  annotations: {}
  hosts:
    - # -- The fully qualified domain name of a network host.
      host: "chart-example.local"
      paths:
        - # -- Matched against the path of an incoming request. The service serves from the root, so any other value needs the controller to rewrite the path before it reaches the pod.
          path: "/"
          # -- Determines the interpretation of the Path matching.
          # Can be one of the following values: `Exact`, `Prefix`, `ImplementationSpecific`.
          pathType: "ImplementationSpecific"
  # -- TLS configuration for this Ingress.
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

route:
  # -- Enable creation of an OpenShift Route resource to expose this service.
  enabled: false
  # -- Annotations to add to the Route.
  annotations: {}
  # -- Labels to add to the route.
  labels: {}
  # -- An alias/DNS that points to the service. Optional. If not specified, a route name will typically be automatically chosen.
  host: ""
  # -- Subdomain is a DNS subdomain requested within the ingress controller’s domain (as a subdomain). If host is set this field is ignored.
  subdomain: ""
  # -- Path that the router watches for. The service serves from the root and the router does not
  # strip this prefix, so any other value drops every request. Ignored when `tls.termination` is
  # `passthrough`, where the Route carries the path no further than the pod.
  path: "/"
  tls:
    # -- The Certificate Authority certificate contents.
    caCertificate: ""
    # -- Certificate contents. This should be a single serving certificate, not a certificate chain. Do not include a CA certificate.
    certificate: ""
    # -- Key file contents.
    key: ""
    # -- Indicates termination type. One of: `edge`, `passthrough`, or `reencrypt`.
    termination: "passthrough"
    # -- The CA certificate of the final destination.
    # When using reencrypt termination, this file should be provided
    # in order to have routers use it for health checks on the secure connection.
    destinationCACertificate: ""

# -- The [resource requirements](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for this container.
# Empty by default, so the chart installs on a small cluster. A batch log read is the heaviest work
# this service does, so on a busy platform start from:
#   requests:
#     cpu: 50m
#     memory: 128Mi
#   limits:
#     memory: 512Mi
resources: {}

autoscaling:
  # -- Enables the creation of a HorizontalPodAutoscaler.
  enabled: false
  # -- Lower limit for the number of replicas to which the autoscaler can scale down.
  minReplicas: 1
  # -- Upper limit for the number of replicas to which the autoscaler can scale up. Cannot be less that minReplicas.
  maxReplicas: 10
  # -- Percentage of CPU utilization that the autoscaler will try to meet.
  targetCPUUtilizationPercentage: 80
  # -- (int) Percentage of memory utilization that the autoscaler will try to meet.
  targetMemoryUtilizationPercentage: 80

podDisruptionBudget:
  # -- Enables creation of the PodDisruptionBudget. Ignored if replicaCount is 1.
  enabled: true
  # -- (int) An eviction is allowed if at most "maxUnavailable" pods are unavailable after eviction. Mutually exclusive with minAvailable.
  maxUnavailable: 1
  # -- (int) An eviction is allowed if at least "minAvailable" pods will still be available after the eviction. Mutually exclusive with maxUnavailable.
#  minAvailable: 1

# -- Assigns a PriorityClass to the Pod. See Kubernetes documentation on [Pod Priority and Preemption](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/).
priorityClass: ""

# -- Optional list of hosts and IPs that will be injected into the pod's hosts file.
hostAliases: []

# -- Selector which must match a node's labels for the pod to be scheduled on that node.
nodeSelector: {}

# -- The tolerations on this pod. See the Kubernetes documentation on [Taints and Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/).
tolerations: []

# -- The pod's scheduling constraints. See the Kubernetes documentation on [Affinity and Anti-affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity).
affinity: {}

# -- Describes how a group of pods ought to spread across topology domains. See the Kubernetes documentation on [Pod Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/).
topologySpreadConstraints: []

serviceMonitor:
  # -- Enables creation of Prometheus Operator [ServiceMonitor](https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.ServiceMonitor).
  enabled: true
  # -- Interval at which metrics should be scraped.
  interval: 15s
  # -- Timeout after which the scrape is ended.
  scrapeTimeout: 10s
  # -- Additional labels for the ServiceMonitor
  labels: {}

prometheusRule:
  # -- Enables creation of Prometheus Operator [PrometheusRule](https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PrometheusRule).
  enabled: true
  # -- Determines how often rules in the group are evaluated.
  interval: ""
  # -- Additional labels for the PrometheusRule
  labels: {}
  defaultRule:
    # -- Customize the labels to the default prometheusRule
    labels:
      severity: medium
      target: business
  # -- A list alerting or recording rules to include on top of the defaults. These fields are templated.
  extraRules:
    []
    # - alert: MyAlertName
    #   annotations:
    #     summary: Summary of my alert
    #     description: Longer description of my alert that goes into a bit more detail
    #   expr: up{service="{{ include "runtime-provisioner.fullname" . }}"} == 0
    #   for: 5m
    #   labels:
    #     severity: medium
    #     target: business