/
values.yaml
1170 lines (1121 loc) · 49.4 KB
/
values.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Default values for StackStorm HA cluster
# This is a YAML-formatted file.
##
## Docker image settings, applied to all StackStorm pods
##
image:
# utility image to use as sidecar for running startup scripts
# allows you to override the registry namespace as well if you are using a private registry
# ie
# utilityImage: "myprivateregsistry.local/ext.docker.io/library/busybox:1.28"
utilityImage: ""
# Image pull policy
pullPolicy: IfNotPresent
# st2 image repository. Set this to override the default ("stackstorm").
# Applies to all st2 containers except st2packs (which has its own setting).
# This also does not impact dependencies such as mongo or redis, which have
# their own helm chart settings.
repository: ""
# st2 image tag - defaults to AppVersion.
# Note that Helm templating is supported in this block!
tag: "{{ .Chart.AppVersion }}"
# Image pull secret.
# May be required for public docker hub due to rate limiting or any private repository.
# See: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
#pullSecret: "your-pull-secret"
# Image entry point for st2* deployments (except st2web and st2chatops).
# This chart replaces the entrypoint (command+args) baked into the docker images.
# If you are have installed a custom init process (like dumb-init, pid1, tini or similar),
# in the docker image(s) you are using, you can add that entrypoint here.
entrypoint: []
# For example you could add dumb-init like this (dumb-init must be present in the image).
#- "/usr/bin/dumb-init"
#- "--"
##
## local cluster domain suffix to enable fqdn lookups for redis, mongo
## kube-dns defaults to cluster.local and allows override with --domain
## core-dns has no default but allows config in k8 configmap
## https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/#configuration-of-stub-domain-and-upstream-nameserver-using-coredns
##
clusterDomain: cluster.local
##
## Service Account
##
serviceAccount:
# Whether the Chart should create the service account or not
create: true
# Used to define service account annotations
serviceAccountAnnotations: {}
# Used to override service account name
serviceAccountName:
# Used to define any custom labels required
#serviceAccountLabels: {}
# Fallback image pull secret.
# If a pod does not have pull secrets, k8s will use the service account's pull secrets.
# See: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#serviceaccount-admission-controller
#pullSecret: "your-pull-secret"
##
## StackStorm shared variables
##
st2:
# Username, used to login to StackStorm system
username: st2admin
# Password, used to login to StackStorm system
# If set, st2.password always overrides any existing password.
# If not set, the password is auto-generated on install and preserved across upgrades.
# Disabled if st2.existingAuthSecret is set
#password: Ch@ngeMe
# Name of existing ST2 Auth secret, disables creation of this secret
# existingAuthSecret: ""
# Name of existing ST2 datastore secret, disables creation of this secret
# existingDatastoreSecret: ""
# ST2 crypto key for the K/V datastore.
# See https://docs.stackstorm.com/datastore.html#securing-secrets-admin-only for more info.
# If set, st2.datastore_crypto_key always overrides any existing datastore_crypto_key.
# If not set, the datastore_crypto_key is auto-generated on install and preserved across upgrades.
# If you want to disable datastore encryption, set "datastore_crypto_key: disable".
#datastore_crypto_key: >-
# {"hmacKey": {"hmacKeyString": "", "size": 256}, "size": 256, "aesKeyString": "", "mode": "CBC"}
# SSH private key for the 'stanley' system user ('system_user.ssh_key_file' in st2.conf)
# If set, st2.ssh_key always overrides any existing ssh_key.
# If not set, the ssh_key is auto-generated on install and preserved across upgrades.
#ssh_key: |-
# -----BEGIN RSA PRIVATE KEY-----
# ...
# -----END RSA PRIVATE KEY-----
# Custom StackStorm config (st2.user.conf) which will apply settings on top of default st2.conf
# Note that Helm templating is supported in this block!
config: |
[api]
allow_origin = '*'
# fixes no replicaset found bug;
[database]
# Connection and server selection timeout (in ms).
connection_timeout = 5000
#Override Definitions can be added here.
#https://docs.stackstorm.com/latest/packs.html#overriding-pack-defaults
overrides: {}
# overrides:
# _global.yaml: |
# ---
# rules:
# defaults:
# enabled: true
# packA.yaml: |
# ---
# rules:
# rule.name:
# enabled: false
# Custom StackStorm config (st2.secrets.conf) which will be created from the key 'st2.secrets.conf' within this secret.
# If this is defined, '--config-file=/etc/st2/st2.secrets.conf' will be added to the end of the command line arguments
# for all pods, superseding all other configuration values.
# This secret must be populated outside of this chart.
# existingConfigSecret: stackstorm-config-secret
# This mirrors the [system_user] section of st2.conf, but makes the values available for helm templating.
# If you change the user, you must provide a customized st2actionrunner image that includes your user.
system_user:
user: stanley
# templating is allowed for this key
ssh_key_file: "/home/{{ .Values.st2.system_user.user }}/.ssh/stanley_rsa"
# Custom pack configs and image settings.
#
# By default, system packs are available. By default, however, `st2 pack install` cannot be run in the k8s cluster,
# so you will need to bake additional packs into an 'st2packs' image. Please see github.com/stackstorm/stackstorm-k8s/README.md
# for details on how to build this image.
# To change this default, and use persistent/shared/writable storage that is available in your cluster, you need to
# enable st2.packs.volumes below, adding volume definitions customized for use your cluster's storage provider.
packs:
# Custom StackStorm pack configs. Each record creates a file in '/opt/stackstorm/configs/'
# https://docs.stackstorm.com/reference/pack_configs.html#configuration-file
# NOTE: This takes precedence over the contents of st2.packs.volumes.configs (if defined) on helm upgrade.
configs:
core.yaml: |
---
# example core pack config yaml
# Custom packs images settings.
#
# For each given st2packs container you can define repository, name, tag and pullPolicy for this image below.
# Multiple pack images can help when dealing with frequent updates by only rebuilding smaller images for desired packs
# E.g. having all desired StackStorm-Exchange packs in one image and several custom packs in additional images
images: []
#- repository: index.docker.io/stackstorm
# name: st2packs
# tag: example
# pullPolicy: IfNotPresent
# Optional name of the imagePullSecret if your custom packs image is hosted by a private Docker registry
# pullSecret: st2packs-auth
# Optional .securityContext override for container
# securityContext:
# Custom packs volumes definitions.
#
# Use this to have StackStorm use persistent/shared/writable storage configured previously in your cluster.
# The choice of storage solution is cluster-dependent (it changes besed on where the cluster is hosted
# and which storage solutions are available in your cluster).
#
# WARNING: These volumes must use ReadWriteMany (RWX) access mode so StackStorm
# can dynamically install packs from any of the st2actionrunner pods and have those
# file changes available in all of the other StackStorm pods.
# see: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
#
# To use this, set enabled to true, and add cluster-specific volume definitions for at least packs and virtualenvs below.
# Please consult the documentation for your cluster's storage solution.
# Some generic examples are listed under st2.packs.volumes.packs below.
volumes:
enabled: false
packs: {}
# mounted to /opt/stackstorm/packs
# packs volume definition is required if st2.packs.volumes is enabled
# example using persistentVolumeClaim:
#persistentVolumeClaim:
# claimName: pvc-st2-packs
# example using NFS:
#nfs:
# server: "10.12.34.56"
# path: /var/nfsshare/packs
# example using a flexVolume + rook-ceph
#flexVolume:
# driver: ceph.rook.io/rook
# fsType: ceph
# options:
# fsName: fs1
# clusterNamespace: rook-ceph
# path: /st2/packs
virtualenvs: {}
# mounted to /opt/stackstorm/virtualenvs
# virtualenvs volume definition is required if st2.packs.volumes is enabled
# see the examples under st2.packs.volumes.packs
configs: {}
# mounted to /opt/stackstorm/configs
# configs volume definition is optional, but only used if st2.packs.volumes is enabled
# Anything in `st2.packs.configs` will be added to this volume automatically on helm install/upgrade.
# see the examples under st2.packs.volumes.packs
# https://docs.stackstorm.com/reference/ha.html#st2sensorcontainer
# It is possible to run st2sensorcontainer(s) in one of these modes:
# (1) run all sensors in one pod (1 deployment with 1 pod, the default); or
# (2) run multiple sensors per pod (2+ deployments with 1 pod each) using hash range partitions; or
# (3) run one sensor per pod using st2.packs.sensors (here).
# Each sensor node needs to be provided with proper partition information to share work with other sensor
# nodes so that the same sensor does not run on different nodes.
# By default, this is empty and st2sensorcontainer.deployments (below) is 1 so that there is one pod to run all sensors.
sensors: []
# This is a list of sensor pods (stackstorm/sensor-mode=one-sensor-per-pod).
# Each entry should have `name` (the pod name) and `ref` (which sensor to run in the pod).
# Each entry can also include other pod settings (annotations, image, resources, etc).
# These optional pod settings default to the values in st2sensorcontainer,
# note: postStartScript is not valid in st2.packs.sensors. Use st2sensorcontainer.postStartScript instead.
#
# This example only defines name and ref, accepting all defaults in st2sensorcontainer:
# - name: some-sensor-node
# ref: some_pack.some_sensor
#
# This example also uses a custom image tag:
# - name: another-sensor-node
# ref: some_pack.another_sensor
# image:
# tag: 3.5.0-another_sensor-r1
# Import data into StackStorm's Key/Value datastore (https://docs.stackstorm.com/datastore.html)
keyvalue:
#- name: st2_version
# scope: st2kv.system
# secret: false
# encrypted: false
# value: "2.9"
#- name: release_name
# scope: st2kv.system
# secret: false
# encrypted: false
# # Note that Helm templating is supported in this block!
# value: "{{ .Release.Name }}"
# Import a list of ST2 API Keys (https://docs.stackstorm.com/authentication.html#api-key-migration)
apikeys:
#- created_at: '2018-12-15T00:21:48.507388Z'
# enabled: true
# id: 5c14491c6cb8de1a9207e3a2
# key_hash: 56928c2d9637ce44338e9564d4b939df8b258410db23b5a80f8ad69d58e648b574f35f9293c3a76bde263738be9aa8379a81553cd55513ad672540b7b0ec0cac
# metadata: {"comment": "Example unsecure ST2 API key from K8s HA Helm values.yaml"}
# uid: api_key:56928c2d9637ce44338e9564d4b939df8b258410db23b5a80f8ad69d58e648b574f35f9293c3a76bde263738be9aa8379a81553cd55513ad672540b7b0ec0cac
# user: st2admin
# StackStorm Role Based Access Control settings (https://docs.stackstorm.com/rbac.html)
rbac:
enabled: false
# Custom StackStorm RBAC roles, shipped in '/opt/stackstorm/rbac/roles/'
# See https://docs.stackstorm.com/rbac.html#defining-roles-and-permission-grants
roles:
# TIP: set files to an empty string to remove them (sample.yaml: "")
sample.yaml: |
# sample RBAC role file, see https://docs.stackstorm.com/rbac.html#defining-roles-and-permission-grants
---
name: "sample"
description: "Example Role which contains no permission grants and serves for demonstration purposes"
# Custom StackStorm RBAC role assignments, shipped in '/opt/stackstorm/rbac/assignments/'
# See: https://docs.stackstorm.com/rbac.html#defining-user-role-assignments
assignments:
# TIP: set files to an empty string to remove them (st2admin.yaml: "")
st2admin.yaml: |
---
username: st2admin
roles:
- system_admin
stanley.yaml: |
---
username: stanley
roles:
- admin
# StackStorm RBAC LDAP groups-to-roles mapping rules, shipped in '/opt/stackstorm/rbac/mappings/'
# See RBAC Roles Based on LDAP Groups: https://docs.stackstorm.com/rbac.html#automatically-granting-roles-based-on-ldap-group-membership
mappings:
#stormers.yaml: |
# ---
# group: "CN=stormers,OU=groups,DC=stackstorm,DC=net"
# description: "Automatically grant admin role to all stormers group members."
# roles:
# - "admin"
##
## Default SecurityContext for pods and containers.
## Overrides available for st2web, st2actionrunner, st2sensorcontainer, st2client pods, and custom packs images.
##
podSecurityContext: {}
securityContext: {}
##
## StackStorm HA Ingress
##
ingress:
# As recommended, ingress is disabled by default.
enabled: false
# Annotations are used to configure the ingress controller
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# Map hosts to paths
hosts: []
# - host: hostname.domain.tld
# # Map paths to services
# paths:
# - path: /
# serviceName: service
# servicePort: port
# Secure the Ingress by specifying a secret that contains a TLS private key and certificate
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.test
# ingressClassName: nginx-ingress
##
## NOTE: there used to be a secrets.st2 section here. These values have moved into st2.* above. Please update your values.
##
##
## StackStorm HA Cluster pod settings for each individual service/component.
##
# Many st2web instances, placed behind a load balancer that serve web app and proxify requests to st2auth, st2api, st2stream.
st2web:
# Minimum 2 replicas are recommended to run st2web in HA mode
replicas: 2
# Tested resource consumption based on multiple requests to st2web within nginx
# Please adjust based on your conscious choice
resources:
requests:
memory: "25Mi"
cpu: "50m"
limits:
memory: "100Mi"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# TODO: Add Ingress setting as a way to expose service to public (#6).
# ingress:
service:
# type can be one of "ClusterIP", "NodePort", "LoadBalancer" or "ExternalName"
type: "NodePort"
# The hostname associated with st2web service (externalName, added to external DNS, etc.)
hostname: ""
# For more information regarding annotations, see
# https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
annotations: {}
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
## st2web serves HTTP (port 80) so that SSL termination can be managed
## using kubernetes-native features like LoadBalancer or Ingress Controllers.
## To configure st2web to directly serve HTTPS (port 443) instead of HTTP,
## provide ssl certs via extra_volumes, and add the ST2WEB_HTTPS env var here:
# ST2WEB_HTTPS: 1
serviceAccount:
attach: false
# override the default .podSecurityContext or .securityContext here
podSecurityContext: {}
securityContext: {} # NB: nginx requires some capabilities, drop ALL will cause issues.
# mount extra volumes on the st2web pod(s) (primarily useful for k8s-provisioned secrets)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# User-defined st2web config with custom settings to replace default config.js
# See https://github.com/StackStorm/st2web#connecting-to-st2-server for more info
# config: |
# // see https://github.com/StackStorm/st2web/blob/master/config.js
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
preStopSleep: "10"
# https://docs.stackstorm.com/reference/ha.html#st2auth
# Multiple st2auth processes can be behind a load balancer in an active-active configuration.
st2auth:
replicas: 2
resources:
requests:
memory: "85Mi"
cpu: "50m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
service:
# type can be one of "ClusterIP", "NodePort", "LoadBalancer" or "ExternalName"
type: "ClusterIP"
# The hostname associated with st2auth service (externalName, added to external DNS, etc.)
hostname: ""
# For more information regarding annotations, see
# https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
annotations: {}
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
preStopSleep: "10"
# mount extra volumes on the st2auth pod(s) (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# https://docs.stackstorm.com/reference/ha.html#st2api
# Multiple st2api process can be behind a load balancer in an active-active configuration.
st2api:
replicas: 2
resources:
requests:
memory: "150Mi"
cpu: "25m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
service:
# type can be one of "ClusterIP", "NodePort", "LoadBalancer" or "ExternalName"
type: "ClusterIP"
# The hostname associated with st2api service (externalName, added to external DNS, etc.)
hostname: ""
# For more information regarding annotations, see
# https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
annotations: {}
# HTTP_PROXY: http://proxy:1234
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
preStopSleep: "10"
# mount extra volumes on the st2api pod(s) (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# https://docs.stackstorm.com/reference/ha.html#st2stream
# Multiple st2stream process can be behind a load balancer in an active-active configuration.
st2stream:
replicas: 2
resources:
requests:
memory: "100Mi"
cpu: "50m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
service:
# type can be one of "ClusterIP", "NodePort", "LoadBalancer" or "ExternalName"
type: "ClusterIP"
# The hostname associated with st2api service (externalName, added to external DNS, etc.)
hostname: ""
# For more information regarding annotations, see
# https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
annotations: {}
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
preStopSleep: "10"
# mount extra volumes on the st2stream pod(s) (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# https://docs.stackstorm.com/reference/ha.html#st2rulesengine
# Multiple st2rulesengine processes can run in active-active with only connections to MongoDB and RabbitMQ. All these will share the TriggerInstance load and naturally pick up more work if one or more of the processes becomes unavailable.
st2rulesengine:
replicas: 2
resources:
requests:
memory: "75Mi"
cpu: "25m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2rulesengine pod(s) (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# https://docs.stackstorm.com/reference/ha.html#st2timersengine
# Only single replica is created via K8s Deployment as timersengine can't work in active-active mode at the moment and it relies on K8s failover/reschedule capabilities to address cases of process failure.
st2timersengine:
resources:
requests:
memory: "75Mi"
cpu: "10m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2timersengine pod (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# https://docs.stackstorm.com/reference/ha.html#st2workflowengine
# Multiple st2workflowengine processes can run in active-active mode and will share the load and pick up more work if one or more of the processes become available.
st2workflowengine:
# k8 pod timeout. set this to a few seconds longer than st2 config workflow_engine.exit_still_active_check
terminationGracePeriodSeconds: 300
replicas: 2
resources:
requests:
memory: "200Mi"
cpu: "100m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2workflowengine pod(s) (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# https://docs.stackstorm.com/reference/ha.html#st2scheduler
# TODO: Description TBD
st2scheduler:
replicas: 2
resources:
requests:
memory: "75Mi"
cpu: "50m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2scheduler pod(s) (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# https://docs.stackstorm.com/reference/ha.html#st2notifier
# st2notifier runs in active-active mode and requires for that coordination backend like Redis or Zookeeper
st2notifier:
replicas: 2
resources:
requests:
memory: "75Mi"
cpu: "50m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2notifier pod(s) (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# https://docs.stackstorm.com/reference/ha.html#st2actionrunner
# Multiple st2actionrunner processes can run in active-active with only connections to MongoDB and RabbitMQ. Work gets naturally
# distributed across runners via RabbitMQ. Adding more st2actionrunner processes increases the ability of StackStorm to execute actions.
st2actionrunner:
# k8 pod timeout. set this to a few seconds longer than st2 config actionrunner.exit_still_active_check and set
# actionrunner.graceful_shutdown = True
terminationGracePeriodSeconds: 300
replicas: 5
resources:
requests:
memory: "200Mi"
cpu: "75m"
# Override default image settings
image: {}
# Uncomment the following block to use your own at2actionrunner docker image
#repository: your-remote-docker-registry.io
#name: st2actionrunner
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
#pullPolicy: Always
# Optional name of the imagePullSecret if your custom action runner image is hosted by a private Docker registry behind the auth
#pullSecret: st2actionrunner-auth
annotations: {}
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
# Allow the injection of hostAliases (https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/#adding-additional-entries-with-hostaliases)
# records in the st2actionrunner containers to handle edge case in DNS accessibility/topology
hostAliases: []
# - hostnames:
# - foo
# ip: 1.1.1.1
# - hostnames:
# - bar
# ip: 8.8.8.8
env: {}
# HTTP_PROXY: http://proxy:1234
## These named secrets (managed outside this chart) will be added to envFrom.
envFromSecrets: []
serviceAccount:
attach: false
# override the default .podSecurityContext or .securityContext here
podSecurityContext: {}
securityContext: {} # also applies to init or jobs containers that copy/modify files
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2actionrunner pods (primarily useful for k8s-provisioned secrets)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# For example, if some actions in the fictional acme pack
# needed some file-based client-side certificates:
# - name: st2-encryption-key-vol
# mount:
# mountPath: "{{ .Values.acme.ssl_certs_dir }}"
# readOnly: true
# volume:
# secret:
# secretName: "{{ .Release.Name }}-st2-acme-pack-certs"
# items:
# - key: ssl_certificate
# path: acme.crt
# - key: ssl_certificate_key
# path: acme.key
#
# An example that adds a global ansible.cfg file for the ansible pack.
# - name: global-ansible-config
# mount:
# mountPath: /etc/ansible/ansible.cfg
# subPath: ansible.cfg
# volume:
# configMap:
# name: "{{ .Release.Name }}-st2-ansible-config"
#
# An example that loads logging conf from a custom config map
# - name: custom-logging-conf
# mount:
# mountPath: /etc/st2/logging.docker.conf
# subPath: logging.actionrunner.conf
# volume:
# configMap:
# name: "{{ .Release.Name }}-st2-logging-conf"
# https://docs.stackstorm.com/reference/ha.html#st2sensorcontainer
# It is possible to run st2sensorcontainer(s) in one of these modes:
# (1) run all sensors in one pod (1 deployment with 1 pod, the default); or
# (2) run multiple sensor per pod (2+ deployments with 1 pod each) using hash range partitions; or
# (3) run one sensor per pod using st2.packs.sensors (see above).
# To use the deployments (modes 1 and 2 in this list), st2.packs.sensors must be empty.
# For one-sensor-per-pod, define defaults here and add config for each sensor to st2.packs.sensors (above).
st2sensorcontainer:
# "deployments" is analogous to "replicas" for other services. Each deployment has 1 replica.
# The deployments count cannot be greater than 1 unless st2.packs.sensors is empty.
# If deployments is 1 (the default), then StackStorm puts all sensors in one pod.
# If deployments is 2+, StackStorm is configured to use sensor hash ranges to ensure that
# each sensor runs on only one pod. Each hash range is assigned to a separate
# deployment to ease maintenance of the sensor deployments and pods.
# See: https://docs.stackstorm.com/reference/sensor_partitioning.html#hash
deployments: 1
# values below this point are also used as defaults in st2.packs.sensors (if used)
resources:
requests:
memory: "100Mi"
cpu: "50m"
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
livenessProbe: {}
readinessProbe: {}
annotations: {}
# Additional advanced settings to control pod/deployment placement
affinity: {}
nodeSelector: {}
tolerations: []
env: {}
# HTTP_PROXY: http://proxy:1234
## These named secrets (managed outside this chart) will be added to envFrom.
envFromSecrets: []
serviceAccount:
attach: false
# override the default .podSecurityContext or .securityContext here
podSecurityContext: {}
securityContext: {}
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2sensorcontainer pod(s) (primarily useful for k8s-provisioned secrets)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# The st2client deployment/pod simplifies ad-hoc administration.
# st2client is a special purpose actionrunner pod, but you can customize it separately
st2client:
# st2client config (~/.st2/config) template.
# see: https://docs.stackstorm.com/reference/cli.html#configuration-file
# You can access env variables here because this is used in a bash heredoc.
# For example, you could use a var injected with envFromSecrets.
# Note that Helm templating is supported in this block!
st2clientConfig: |
[credentials]
username = ${ST2_AUTH_USERNAME}
password = ${ST2_AUTH_PASSWORD}
env: {}
# HTTP_PROXY: http://proxy:1234
## These named secrets (managed outside this chart) will be added to envFrom.
envFromSecrets: []
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# override the default .podSecurityContext or .securityContext here
podSecurityContext: {}
securityContext: {}
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2client pod (primarily useful for k8s-provisioned secrets)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
resources:
requests:
memory: "5Mi"
cpu: "5m"
# https://docs.stackstorm.com/reference/ha.html#st2garbagecollector
# Optional service that cleans up old executions and other operations data based on setup configurations.
# By default this process only cleans action output and needs to be setup in st2.conf to perform any other work.
st2garbagecollector:
# Having 1 st2garbagecollector unique replica is enough for periodic task like st2 history garbage collection
replicas: 1
resources:
requests:
memory: "80Mi"
cpu: "10m"
annotations: {}
# Override default image settings (for now, only tag can be overridden)
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
# mount extra volumes on the st2garbagecollector pod(s) (primarily useful for custom logging conf)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
##
## StackStorm ChatOps (https://docs.stackstorm.com/chatops/index.html)
## As hubot can't be HA scaled properly, we deploy only single replica of st2chatops
##
st2chatops:
# Enable st2chatops (default: false)
enabled: false
# Custom hubot adapter ENV variables to pass through which will override st2chatops.env defaults.
# These env vars get stored in a k8s secret loaded using envFrom.
# See https://github.com/StackStorm/st2chatops/blob/master/st2chatops.env
# for the full list of supported adapters and example ENV variables.
# Note that Helm templating is supported for env values in this block!
env:
HUBOT_ADAPTER: slack
HUBOT_SLACK_TOKEN: xoxb-CHANGE-ME-PLEASE
# If ST2_API_KEY is defined, then ST2_AUTH_USERNAME/PASSWORD will not be exposed to st2chatops.
# Please make sure that the key in ST2_API_KEY gets added to st2.apikeys above so that chatops can use this key.
#ST2_API_KEY: 12345
# Set custom generated st2chatops Docker image source
# Otherwise default https://hub.docker.com/r/stackstorm/st2chatops is used
image: {}
#repository: stackstorm
#name: st2chatops
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
#pullPolicy: IfNotPresent
# Tested requested resource consumption for st2chatops & hubot in normal mode
# Please adjust based on your conscious choice
resources:
requests:
memory: "50Mi"
cpu: "5m"
annotations: {}
# Advanced use-cases only. If defined, this hubot-scripts volume gets mounted to: /opt/stackstorm/chatops/scripts
# This volume (using any k8s storage solution, including configmap) allows for hubot customization.
# Most installations should not use this.
# For details on writing .js or .coffeescript hubot extensions, see: https://hubot.github.com/docs/scripting/
hubotScriptsVolume: {}
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
serviceAccount:
attach: false
# postStartScript is optional. It has the contents of a bash script.
# k8s will run the script in the st2 container in parallel with the ENTRYPOINT.
# The pod will not be marked as "running" until this script completes successfully.
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
postStartScript: ""
##
## Various batch jobs (apply-rbac-definitions, apikey-load, key-load, register-content)
##
jobs:
# st2client config (~/.st2/config) template for jobs that need it.
# see: https://docs.stackstorm.com/reference/cli.html#configuration-file
# You can access env variables here because this is used in a bash heredoc.
# For example, you could use a var injected with envFromSecrets.
# Note that Helm templating is supported in this block!
st2clientConfig: |
[credentials]
username = ${ST2_AUTH_USERNAME}
password = ${ST2_AUTH_PASSWORD}
annotations: {}
# Override default image settings (for now, only tag can be overridden)
# The Jobs use the st2actionrunner image
image: {}
## Note that Helm templating is supported in this block!
#tag: "{{ .Values.image.tag }}"
# If defined, this preRegisterContentCommand runs in an initContainer on the st2-register-content Job.
# The initContainer also uses the st2actionrunner image but runs this command instead of its entrypoint.
preRegisterContentCommand: []
# For example, to disable aliases in the "packs" system pack before content is registered:
# - "/bin/bash"
# - "-c"
# - |
# sed -i -e 's/^\(\s*\)enabled: true/\1enabled: false/' /opt/stackstorm/packs/packs/aliases/*.yaml
# for alias in /opt/stackstorm/packs/packs/aliases/*.yaml; do
# grep -q 'enabled:' ${alias} || sed -i -e 's/^\(\s*\)name:\(.*\)$/\1name: \2\n\1enabled: false/m' ${alias}
# done
# Additional advanced settings to control pod/deployment placement
nodeSelector: {}
tolerations: []
affinity: {}
env: {}
# HTTP_PROXY: http://proxy:1234
## These named secrets (managed outside this chart) will be added to envFrom.
envFromSecrets: []
# mount extra volumes on the jobs pods (primarily useful for k8s-provisioned secrets)
## Note that Helm templating is supported in 'mount' and 'volume'
extra_volumes: []
# see examples under st2actionrunner.extra_volumes
#
# Advanced controls to skip creating jobs.
# This is useful in targeted upgrades with `--set`. Do not set this in values files.
# Possible jobs include: apply_rbac_definitions, apikey_load, key_load, register_content
# For example, if an upgrade only touches RBAC config, use this to disable other jobs:
# helm upgrade ... --set 'jobs.skip={apikey_load,key_load,register_content}'
skip: []
#
# Advanced: Add extra Helm hook Jobs
# These hook jobs will use the same settings (eg image, annotations, pod placement) as the other jobs.
# They will have st2 cli configured, st2.conf files, and packs volumes mounted.
# See available hooks list: https://helm.sh/docs/topics/charts_hooks/#the-available-hooks
extra_hooks: []
# Each item in extra_hooks must define a 'name' and the "helm.sh/hook" value in 'hook'.
# Note that Helm templating is supported in the 'command' block!
#
# - name: init-workflow # required name
# hook: post-install # required "helm.sh/hook"
# hook_weight: 10 # optional hook_weight (defaults to 10)
# resources: {} # optional definition of resources to request
# podSecurityContext: {} # optional definition of pod securityContext override
# securityContext: {} # optional definition of container securityContext override
# command: # required command to run
# - st2