-
Notifications
You must be signed in to change notification settings - Fork 126
/
values.yaml
3181 lines (2935 loc) · 178 KB
/
values.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Default values for Camunda Helm chart.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
# The values file follows helm best practices https://helm.sh/docs/chart_best_practices/values/
#
# This means:
# * Variable names should begin with a lowercase letter, and words should be separated with camelcase.
# * Every defined property in values.yaml should be documented. The documentation string should begin with the name of the property that it describes, and then give at least a one-sentence description
#
# Furthermore, we try to apply the following pattern: # [VarName] [conjunction] [definition]
#
# VarName:
#
# * In the documentation the variable name is started with a big letter, similar to kubernetes resource documentation.
# * If the variable is part of a subsection/object we use a json path expression (to make it more clear where the variable belongs to).
# The root (chart name) is omitted (e.g. zeebe). This is useful for using --set in helm.
#
# Conjunction:
# * [defines] for mandatory configuration
# * [can be used] for optional configuration
# * [if true] for toggles
# * [configuration] for section/group of variables
##########################################
#####
# # # #### ##### ## #
# # # # # # # # #
# #### # # # ##### # # #
# # # # # # # ###### #
# # # # # # # # # #
##### ###### #### ##### # # ######
##########################################
# Global configuration for variables which can be accessed by all sub charts
## @section Global parameters
## @extra global
global:
## Multitenancy configuration.
## @extra global.multitenancy
multitenancy:
## @param global.multitenancy.enabled if true, then enable multitenancy in all applicable components.
enabled: false
## @param global.annotations Annotations can be used to define common annotations, which should be applied to all deployments
annotations: {}
labels:
## @param global.labels.app Name of the application
app: camunda-platform
# Image configuration to be used in each sub chart
# https://hub.docker.com/u/camunda
image:
## @param global.image.registry Can be used to set container image registry.
registry: ""
## @param global.image.tag defines the tag / version which should be used in the most of the apps.
# renovate: datasource=github-releases depName=camunda/camunda-platform
tag: 8.4.0
## @param global.image.pullPolicy defines the image pull policy which should be used https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
pullPolicy: IfNotPresent
## @param global.image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
pullSecrets: []
## Ingress configuration to configure the ingress resource
## @extra global.ingress
ingress:
## @param global.ingress.enabled if true, an ingress resource is deployed. Only useful if an ingress controller is available, like Ingress-NGINX.
enabled: false
## @param global.ingress.className Ingress.className defines the class or configuration of ingress which should be used by the controller
className: nginx
## @param global.ingress.annotations [object] defines the ingress related annotations, consumed mostly by the ingress controller
annotations:
ingress.kubernetes.io/rewrite-target: "/"
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
# Ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
## @param global.ingress.host If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
host: ""
## @extra global.ingress.tls configuration for tls on the ingress resource https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
tls:
## @param global.ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
enabled: false
## @param global.ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
secretName: camunda-platform
# Elasticsearch configuration which is shared between the sub charts
## @extra global.elasticsearch
elasticsearch:
## @param global.elasticsearch.disableExporter if true, disables the elastic exporter in zeebe
disableExporter: false
## @param global.elasticsearch.url can be used to configure the URL to access elasticsearch, if not set services fallback to host and port configuration
url:
## @param global.elasticsearch.protocol defines the elasticsearch access protocol, by default HTTP.
protocol: http
## @param global.elasticsearch.host Elasticsearch.host defines the elasticsearch host, ideally the service name inside the namespace
host: "{{ .Release.Name }}-elasticsearch"
## @param global.elasticsearch.port Elasticsearch.port defines the elasticsearch port, under which elasticsearch can be accessed
port: 9200
## @param global.elasticsearch.clusterName Elasticsearch.clusterName defines the cluster name which is used by Elasticsearch
clusterName: "elasticsearch"
## @param global.elasticsearch.prefix Elasticsearch.prefix defines the prefix which is used by the Zeebe Elasticsearch Exporter to create Elasticsearch indexes
prefix: zeebe-record
## @param global.zeebeClusterName ZeebeClusterName defines the cluster name for the Zeebe cluster. All Zeebe pods get this prefix in their name and the brokers uses that as cluster name.
zeebeClusterName: "{{ .Release.Name }}-zeebe"
## @param global.zeebePort defines the port which is used for the Zeebe Gateway. This port accepts the GRPC Client messages and forwards them to the Zeebe Brokers.
zeebePort: 26500
# Identity configuration to configure identity specifics on global level, which can be accessed by other sub-charts
identity:
# THIS IS A PRE ALPHA FEATURE, DO NOT USE IT.
## @skip global.identity.service
service:
## @skip global.identity.service.url
url:
keycloak:
# Identity.keycloak.internal if true, it will configure an extra service with type "ExternalName".
## @param global.identity.keycloak.internal It's useful for using existing Keycloak in another namespace with and access it with the combined Ingress.
internal: false
## @param global.identity.keycloak.url can be used incorporate with "identity.keycloak.enabled: false" to use your own Keycloak instead of the one comes with Camunda Helm chart.
url: {}
# Example to produce the following URL "https://keycloak.prod.svc.cluster.local:8443":
# url:
# protocol: "https"
# host: "keycloak.prod.svc.cluster.local"
# port: "8443"
# defines the endpoint of Keycloak which varies between Keycloak versions.
## @param global.identity.keycloak.contextPath In Keycloak v16.x.x it's hard-coded as '/auth', but in v19.x.x it's '/'.
contextPath: "/auth"
## @param global.identity.keycloak.realm defines Keycloak realm path used for Camunda.
realm: "/realms/camunda-platform"
## @param global.identity.keycloak.auth same as "identity.keycloak.auth" but it's used for existing Keycloak.
auth: {}
# identity.keycloak.auth.adminUser can be used to configure admin user to access existing Keycloak.
# adminUser: ""
# identity.keycloak.auth.existingSecret can be used to configure existing Secret object which has admin password
# to access existing Keycloak.
# existingSecret: ""
# identity.keycloak.auth.existingSecretKey can be used to configure the key inside existing Secret object
# which has admin password to access existing Keycloak.
# existingSecretKey: "admin-password"
## @extra global.identity.auth configuration, to configure identity authentication setup
auth:
## @param global.identity.auth.enabled if true, enables the identity authentication otherwise basic-auth will be used on all services.
enabled: true
## @param global.identity.auth.issuer defines the issuer name, which is used by the services to validate the JWT tokens.
issuer: ""
## @param global.identity.auth.issuerBackendUrl defines the issuer backend URL, which is used by the services to validate the JWT tokens in a container to container context.
issuerBackendUrl: ""
## @param global.identity.auth.tokenUrl defines the token URL, which is used by the services to request JWT tokens.
tokenUrl: ""
## @param global.identity.auth.jwksUrl defines the JWKS URL, which is used by the services to validate the JWT tokens.
jwksUrl: ""
## @param global.identity.auth.type defines the type of authentication which should be used. Defaults to Keycloak
type: "KEYCLOAK"
# defines the token issuer (Keycloak) URL, where the services can request JWT tokens.
# Should be publicly accessible, per default we assume a port-forward to Keycloak (18080) is created before login.
## @param global.identity.auth.publicIssuerUrl Can be overwritten if ingress is in use and an external IP is available.
publicIssuerUrl: "http://localhost:18080/auth/realms/camunda-platform"
## @extra global.identity.auth.connectors configuration to configure Connectors authentication specifics on global level, which can be accessed by other sub-charts
connectors:
## @param global.identity.auth.connectors.existingSecret can be used to use an own existing secret. If not set a random secret is generated.
# The existing secret should contain an `connectors-secret` field, which will be used as secret for the identity-Connectors communication.
existingSecret: ""
## @extra global.identity.auth.operate configuration to configure Operate authentication specifics on global level, which can be accessed by other sub-charts
operate:
## @param global.identity.auth.operate.clientId defines the client id, which is used by Operate in authentication flows.
clientId: operate
## @param global.identity.auth.operate.audience defines the audience, which is used by Operate.
audience: operate-api
## @param global.identity.auth.operate.existingSecret can be used to reference an existing secret. If not set, a random secret is generated.
# The existing secret should contain an `operate-secret` field, which will be used as secret for the identity-Operate communication.
existingSecret:
## @param global.identity.auth.operate.redirectUrl defines the redirect URL, which is used by Keycloak to access Operate.
# Should be publicly accessible, the default value works if a port-forward to Operate is created to 8081.
# Can be overwritten if ingress is in use and an external IP is available.
redirectUrl: "http://localhost:8081"
## @extra global.identity.auth.tasklist configuration to configure Tasklist authentication specifics on global level, which can be accessed by other sub-charts
tasklist:
## @param global.identity.auth.tasklist.clientId defines the client id, which is used by Tasklist in authentication flows.
clientId: tasklist
## @param global.identity.auth.tasklist.audience defines the audience, which is used by Tasklist.
audience: tasklist-api
## @param global.identity.auth.tasklist.existingSecret can be used to use an own existing secret. If not set a random secret is generated.
# The existing secret should contain an `tasklist-secret` field, which will be used as secret for the identity-Tasklist communication.
existingSecret:
## @param global.identity.auth.tasklist.redirectUrl defines the root (or redirect) URL, which is used by Keycloak to access Tasklist.
# Should be publicly accessible, the default value works if a port-forward to Tasklist is created to 8082.
# Can be overwritten if ingress is in use and an external IP is available.
redirectUrl: "http://localhost:8082"
## @extra global.identity.auth.optimize configuration to configure Optimize authentication specifics on global level, which can be accessed by other sub-charts
optimize:
## @param global.identity.auth.optimize.clientId defines the client id, which is used by Optimize in authentication flows.
clientId: optimize
## @param global.identity.auth.optimize.audience defines the audience, which is used by Optimize.
audience: optimize-api
## @param global.identity.auth.optimize.existingSecret can be used to use an own existing secret. If not set a random secret is generated.
# The existing secret should contain an `optimize-secret` field, which will be used as secret for the identity-Optimize communication.
existingSecret:
## @param global.identity.auth.optimize.redirectUrl defines the root (or redirect) URL, which is used by Keycloak to access Optimize.
# Should be publicly accessible, the default value works if a port-forward to Optimize is created to 8083.
# Can be overwritten if ingress is in use and an external IP is available.
redirectUrl: "http://localhost:8083"
## @extra global.identity.auth.webModeler configuration to configure Web Modeler authentication specifics on global level, which can be accessed by other sub-charts
webModeler:
## @param global.identity.auth.webModeler.clientId defines the client id, which is used by Web Modeler in authentication flows.
clientId: web-modeler
## @param global.identity.auth.webModeler.clientApiAudience defines the audience which is used by Web Modeler's client API.
clientApiAudience: web-modeler-api
## @param global.identity.auth.webModeler.publicApiAudience defines the audience which is used by Web Modeler's public API.
publicApiAudience: web-modeler-public-api
## @param global.identity.auth.webModeler.redirectUrl defines the root URL which is used by Keycloak to access Web Modeler.
# Should be publicly accessible, the default value works if a port-forward to Web Modeler is created to 8084.
# Can be overwritten if ingress is in use and an external IP is available.
redirectUrl: "http://localhost:8084"
## global.identity.auth.console configuration to configure Console authentication specifics on global level, which can be accessed by other sub-charts
console:
## @skip global.identity.auth.console.existingSecret can be used to use an own existing secret. If not set a random secret is generated.
# The existing secret should contain an `console-secret` field, which will be used as secret for the identity-console communication.
existingSecret:
## @skip global.identity.auth.console.redirectUrl defines the root URL which is used by Keycloak to access Web Modeler.
# Should be publicly accessible, the default value works if a port-forward to Web Modeler is created to 8080.
# Can be overwritten if ingress is in use and an external IP is available.
redirectUrl: "http://localhost:8080"
## @extra global.identity.auth.zeebe configuration to configure Zeebe authentication specifics on global level, which can be accessed by other sub-charts
zeebe:
## @param global.identity.auth.zeebe.clientId defines the client id, which is used by Zeebe in authentication flows.
clientId: zeebe
## @param global.identity.auth.zeebe.existingSecret can be used to use an own existing secret. If not set a random secret is generated.
# The existing secret should contain an `zeebe-secret` field, which will be used as secret for the Identity-Zeebe communication.
existingSecret: ""
## @param global.identity.auth.zeebe.audience defines the audience, which is used by Zeebe.
audience: zeebe-api
## @param global.identity.auth.zeebe.tokenScope defines the token scope, which is used by Zeebe.
tokenScope:
# Multiregion options for Zeebe
#
## WARNING: In order to get your multi-region setup covered by Camunda enterprise support you MUST get your configuration and run books reviewed by Camunda before going to production.
# This is necessary for us to be able to help you in case of outages, due to the complexity of operating multi-region setups and the dependencies to the underlying Kubernetes prerequisites.
# If you operate this in the wrong way you risk corruption and complete loss of all data especially in the dual-region case.
# If you can, consider three regions. Please, contact your customer success manager as soon as you start planning a multi-region setup.
# Camunda reserves the right to limit support if no review was done prior to launch or the review showed significant risks.
multiregion:
## @skip global.multiregion.regions number of regions that this Camunda Platform instance is stretched across
regions: 1
## @skip global.multiregion.regionId unique id of the region. Should start at 0 for easy computation. With 2 regions, you would have region 0 and 1.
regionId: 0
## @skip global.multiregion.installationType mode of installation for multi-region disaster recovery: normal, failOver, failBack
installationType: normal
###################################
#######
# ###### ###### ##### ######
# # # # # #
# ##### ##### ##### #####
# # # # # #
# # # # # #
####### ###### ###### ##### ######
###################################
## @section Zeebe Parameters
## @extra zeebe configuration for the Zeebe sub chart. Contains configuration for the Zeebe broker and related resources.
zeebe:
## @param zeebe.enabled if true, all zeebe related resources are deployed via the helm release
enabled: true
## @param zeebe.debug if true, extra info is printed.
debug: false
## @extra zeebe.image configuration to configure the zeebe image specifics
image:
## @param zeebe.image.registry can be used to set container image registry.
registry: ""
## @param zeebe.image.repository defines which image repository to use
repository: camunda/zeebe
## @param zeebe.image.tag can be set to overwrite the global tag, which should be used in that chart
tag:
## @param zeebe.image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
pullSecrets: []
## @param zeebe.sidecars can be used to attach extra containers to the zeebe deployment
sidecars: []
## @param zeebe.clusterSize defines the amount of brokers (=replicas), which are deployed via helm
clusterSize: "3"
## @param zeebe.partitionCount defines how many zeebe partitions are set up in the cluster
partitionCount: "3"
## @param zeebe.replicationFactor defines how each partition is replicated, the value defines the number of nodes
replicationFactor: "3"
## @extra zeebe.env can be used to set extra environment variables in each zeebe broker container
env:
## @param zeebe.env[0].name
## @param zeebe.env[0].value
## @param zeebe.env[1].name
## @param zeebe.env[1].value
## @param zeebe.env[2].name
## @param zeebe.env[2].value
- name: ZEEBE_BROKER_DATA_SNAPSHOTPERIOD
value: "5m"
- name: ZEEBE_BROKER_DATA_DISK_FREESPACE_REPLICATION
value: "2GB"
- name: ZEEBE_BROKER_DATA_DISK_FREESPACE_PROCESSING
value: "3GB"
## @extra zeebe.configMap configuration which will be applied to the mounted config map.
configMap:
## @param zeebe.configMap.defaultMode can be used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. see https://github.com/kubernetes/api/blob/master/core/v1/types.go#L1615-L1623
defaultMode: 0754
## @param zeebe.command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
command: []
## @param zeebe.logLevel defines the log level which is used by the zeebe brokers
logLevel: info
## @param zeebe.log4j2 can be used to overwrite the log4j2 configuration of the zeebe brokers
log4j2: ''
## @param zeebe.javaOpts can be used to set java options for the zeebe brokers
javaOpts: >-
-XX:+HeapDumpOnOutOfMemoryError
-XX:HeapDumpPath=/usr/local/zeebe/data
-XX:ErrorFile=/usr/local/zeebe/data/zeebe_error%p.log
-XX:+ExitOnOutOfMemoryError
## @extra zeebe.service configuration for the broker service
service:
## @param zeebe.service.annotations can be used to define annotations, which will be applied to the Zeebe service
annotations: {}
## @param zeebe.service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
type: ClusterIP
## @param zeebe.service.httpPort defines the port of the http endpoint, where for example metrics are provided
httpPort: 9600
## @param zeebe.service.httpName defines the name of the http endpoint, where for example metrics are provided
httpName: "http"
## @param zeebe.service.commandPort defines the port of the command api endpoint, where the broker commands are sent to
commandPort: 26501
## @param zeebe.service.commandName defines the name of the command api endpoint, where the broker commands are sent to
commandName: "command"
## @param zeebe.service.internalPort defines the port of the internal api endpoint, which is used for internal communication
internalPort: 26502
## @param zeebe.service.internalName defines the name of the internal api endpoint, which is used for internal communication
internalName: "internal"
## @param zeebe.service.extraPorts can be used to expose any other ports which are required. Can be useful for exporters
extraPorts: []
# - name: hazelcast
# protocol: TCP
# port: 5701
# targetPort: 5701
## @extra global.zeebe.ServiceAccount configuration for the service account where the broker pods are assigned to
serviceAccount:
## @param zeebe.serviceAccount.enabled if true, enables the broker service account
enabled: true
## @param zeebe.serviceAccount.name can be used to set the name of the broker service account
name: ""
## @param zeebe.serviceAccount.annotations can be used to set the annotations of the broker service account
annotations: {}
## @param zeebe.cpuThreadCount defines how many threads can be used for the processing on each broker pod
cpuThreadCount: "3"
## @param zeebe.ioThreadCount defines how many threads can be used for the exporting on each broker pod
ioThreadCount: "3"
## @extra zeebe.resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
## @extra zeebe.resources.requests
## @param zeebe.resources.requests.cpu
## @param zeebe.resources.requests.memory
## @param zeebe.resources.limits.cpu
## @param zeebe.resources.limits.memory
resources:
requests:
cpu: 800m
memory: 1200Mi
limits:
cpu: 960m
memory: 1920Mi
## @param zeebe.persistenceType defines the type of persistence which is used by Zeebe. Possible values are: disk, local and memory.
# disk - means a persistence volume claim is configured and used
# local - means the data is stored into the container, no volumeMount nor volume nor claim is configured
# memory - means zeebe uses a tmpfs for the data persistence, be aware that this takes the limits into account
persistenceType: disk
## @param zeebe.pvcSize defines the persistent volume claim size, which is used by each broker pod https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims
pvcSize: "32Gi"
## @param zeebe.pvcAccessModes can be used to configure the persistent volume claim access mode https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
pvcAccessModes: ["ReadWriteOnce"]
## @param zeebe.pvcStorageClassName can be used to set the storage class name which should be used by the persistent volume claim. It is recommended to use a storage class, which is backed with a SSD.
pvcStorageClassName: ''
## @param zeebe.extraVolumes can be used to define extra volumes for the broker pods, useful for additional exporters
extraVolumes: []
## @param zeebe.extraVolumeMounts can be used to mount extra volumes for the broker pods, useful for additional exporters
extraVolumeMounts: []
## @param zeebe.extraInitContainers (Deprecated - use `initContainers` instead) ExtraInitContainers can be used to set up extra init containers for the broker pods, useful for additional exporters
extraInitContainers: []
## @param zeebe.initContainers can be used to set up extra init containers for the broker pods, useful for additional exporters
initContainers: []
## @param zeebe.podAnnotations can be used to define extra broker pod annotations
podAnnotations: {}
## @param zeebe.podLabels can be used to define extra broker pod labels
podLabels: {}
## @extra zeebe.podDisruptionBudget configuration to configure a pod disruption budget for the broker pods https://kubernetes.io/docs/tasks/run-application/configure-pdb/
podDisruptionBudget:
## @param zeebe.podDisruptionBudget.enabled if true a pod disruption budget is defined for the brokers
enabled: false
## @param zeebe.podDisruptionBudget.minAvailable can be used to set how many pods should be available. Be aware that if minAvailable is set, maxUnavailable will not be set (they are mutually exclusive).
minAvailable:
## @param zeebe.podDisruptionBudget.maxUnavailable can be used to set how many pods should be at max. unavailable
maxUnavailable: 1
## @extra zeebe.podSecurityContext defines the security options the Zeebe broker pod should be run with
podSecurityContext:
## @param zeebe.podSecurityContext.runAsNonRoot run as non root
runAsNonRoot: true
## @param zeebe.podSecurityContext.fsGroup
fsGroup: 1000
# ContainerSecurityContext defines the security options the Zeebe broker container should be run with
containerSecurityContext:
## @param zeebe.containerSecurityContext.allowPrivilegeEscalation
allowPrivilegeEscalation: false
## @param zeebe.containerSecurityContext.privileged
privileged: false
## @param zeebe.containerSecurityContext.readOnlyRootFilesystem
readOnlyRootFilesystem: true
## @param zeebe.containerSecurityContext.runAsUser
runAsUser: 1000
## @extra zeebe.startupProbe configuration
startupProbe:
## @param zeebe.startupProbe.enabled if true, the startup probe is enabled in app container
enabled: false
## @param zeebe.startupProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param zeebe.startupProbe.probePath defines the startup probe route used on the app
probePath: /ready
## @param zeebe.startupProbe.initialDelaySeconds defines the number of seconds after the container has started before the probe is initiated.
initialDelaySeconds: 30
## @param zeebe.startupProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param zeebe.startupProbe.successThreshold defines how often it needs to be true to be marked as ready, after failure
successThreshold: 1
## @param zeebe.startupProbe.failureThreshold defines when the probe is considered as failed so the Pod will be marked Unready
failureThreshold: 5
## @param zeebe.startupProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## @extra zeebe.readinessProbe configuration
readinessProbe:
## @param zeebe.readinessProbe.enabled if true, the readiness probe is enabled in app container
enabled: true
## @param zeebe.readinessProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param zeebe.readinessProbe.probePath defines the readiness probe route used on the app
probePath: /ready
## @param zeebe.readinessProbe.initialDelaySeconds defines the number of seconds after the container has started before
# the probe is initiated.
initialDelaySeconds: 30
## @param zeebe.readinessProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param zeebe.readinessProbe.successThreshold defines how often it needs to be true to be marked as ready, after failure
successThreshold: 1
## @param zeebe.readinessProbe.failureThreshold defines when the probe is considered as failed so the Pod will be marked Unready
failureThreshold: 5
## @param zeebe.readinessProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## @extra zeebe.livenessProbe configuration
livenessProbe:
## @param zeebe.livenessProbe.enabled if true, the liveness probe is enabled in app container
enabled: false
## @param zeebe.livenessProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param zeebe.livenessProbe.probePath defines the liveness probe route used on the app
probePath: /health
## @param zeebe.livenessProbe.initialDelaySeconds defines the number of seconds after the container has started before
# the probe is initiated.
initialDelaySeconds: 30
## @param zeebe.livenessProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param zeebe.livenessProbe.successThreshold defines how often it needs to be true to be considered successful after having failed
successThreshold: 1
## @param zeebe.livenessProbe.failureThreshold defines when the probe is considered as failed so the container will be restarted
failureThreshold: 5
## @param zeebe.livenessProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## Metrics configuration
metrics:
## @param zeebe.metrics.prometheus Prometheus metrics endpoint
prometheus: /actuator/prometheus
## @param zeebe.nodeSelector can be used to define on which nodes the broker pods should run
nodeSelector: {}
## @param zeebe.tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
tolerations: []
## @extra global.zeebe.Affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
# The default defined PodAntiAffinity allows constraining on which nodes the Zeebe pods are scheduled on https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
# It uses a hard requirement for scheduling and works based on the Zeebe pod labels
## @skip zeebe.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[0].labelSelector.matchExpressions[0].key
## @skip zeebe.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[0].labelSelector.matchExpressions[0].operator
## @skip zeebe.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[0].labelSelector.matchExpressions[0].values
## @skip zeebe.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[0].topologyKey
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: "app.kubernetes.io/component"
operator: In
values:
- zeebe-broker
topologyKey: "kubernetes.io/hostname"
## @param zeebe.priorityClassName can be used to define the broker pods priority https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass
priorityClassName: ""
retention:
## @param zeebe.retention.enabled if true, the ILM Policy is created and applied to the index templates.
enabled: false
## @param zeebe.retention.minimumAge defines how old the data must be, before the data is deleted as a duration.
minimumAge: 30d
## @param zeebe.retention.policyName defines the name of the created and applied ILM policy.
policyName: zeebe-record-retention-policy
# Zeebe.
#### ## ##### ###### # # ## # #
# # # # # # # # # # # #
# # # # ##### # # # # #
# ### ###### # # # ## # ###### #
# # # # # # ## ## # # #
#### # # # ###### # # # # #
## @section Zeebe Gateway Parameters
## @extra Gateway configuration to define properties related to the standalone gateway
zeebe-gateway:
## @param zeebe-gateway.replicas defines how many standalone gateways are deployed
replicas: 2
## @extra zeebe-gateway.image configuration to configure the zeebe-gateway image specifics
image:
## @param zeebe-gateway.image.registry can be used to set container image registry.
registry: ""
## @param zeebe-gateway.image.repository defines which image repository to use
repository: camunda/zeebe
## @param zeebe-gateway.image.tag can be set to overwrite the global tag, which should be used in that chart
tag:
## @param zeebe-gateway.image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
pullSecrets: []
## @param zeebe-gateway.sidecars can be used to attach extra containers to the zeebe gateway deployment
sidecars: []
## @param zeebe-gateway.podAnnotations can be used to define extra gateway pod annotations
podAnnotations: {}
## @param zeebe-gateway.podLabels can be used to define extra gateway pod labels
podLabels: {}
## @param zeebe-gateway.logLevel defines the log level which is used by the gateway
logLevel: info
## @param zeebe-gateway.log4j2 can be used to overwrite the log4j2 configuration of the gateway
log4j2: ''
## @param zeebe-gateway.javaOpts can be used to set java options for the zeebe gateways
javaOpts: >-
-XX:+ExitOnOutOfMemoryError
## @param zeebe-gateway.env can be used to set extra environment variables in each gateway container
env: []
## @extra zeebe-gateway.configMap configuration which will be applied to the mounted config map.
configMap:
## @param zeebe-gateway.configMap.defaultMode can be used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
# See https://github.com/kubernetes/api/blob/master/core/v1/types.go#L1615-L1623
defaultMode: 0744
## @param zeebe-gateway.command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
command: []
## @extra zeebe-gateway.podDisruptionBudget configuration to configure a pod disruption budget for the gateway pods https://kubernetes.io/docs/tasks/run-application/configure-pdb/
podDisruptionBudget:
## @param zeebe-gateway.podDisruptionBudget.enabled if true a pod disruption budget is defined for the gateways
enabled: false
## @param zeebe-gateway.podDisruptionBudget.minAvailable can be used to set how many pods should be available. Be aware that if minAvailable is set, maxUnavailable will not be set (they are mutually exclusive).
minAvailable: 1
## @param zeebe-gateway.podDisruptionBudget.maxUnavailable can be used to set how many pods should be at max. unavailable
maxUnavailable:
## @extra zeebe-gateway.resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
## @param zeebe-gateway.resources.requests.cpu
## @param zeebe-gateway.resources.requests.memory
## @param zeebe-gateway.resources.limits.cpu
## @param zeebe-gateway.resources.limits.memory
resources:
requests:
cpu: 400m
memory: 450Mi
limits:
cpu: 400m
memory: 450Mi
## @param zeebe-gateway.priorityClassName can be used to define the gateway pods priority https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass
priorityClassName: ""
## @extra zeebe-gateway.podSecurityContext defines the security options the gateway pod should be run wit
podSecurityContext:
## @param zeebe-gateway.podSecurityContext.runAsNonRoot
runAsNonRoot: true
## @param zeebe-gateway.podSecurityContext.fsGroup
fsGroup: 1000
## @extra zeebe-gateway.containerSecurityContext defines the security options the gateway container should be run with
containerSecurityContext:
## @param zeebe-gateway.containerSecurityContext.privileged
privileged: false
## @param zeebe-gateway.containerSecurityContext.readOnlyRootFilesystem
readOnlyRootFilesystem: true
## @param zeebe-gateway.containerSecurityContext.allowPrivilegeEscalation
allowPrivilegeEscalation: false
## @param zeebe-gateway.containerSecurityContext.runAsNonRoot
runAsNonRoot: true
## @param zeebe-gateway.containerSecurityContext.runAsUser
runAsUser: 1000
## @extra zeebe-gateway.startupProbe configuration
startupProbe:
## @param zeebe-gateway.startupProbe.enabled if true, the startup probe is enabled in app container
enabled: false
## @param zeebe-gateway.startupProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param zeebe-gateway.startupProbe.probePath defines the startup probe route used on the app
probePath: /actuator/health/startup
## @param zeebe-gateway.startupProbe.initialDelaySeconds defines the number of seconds after the container has started before
# the probe is initiated.
initialDelaySeconds: 30
## @param zeebe-gateway.startupProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param zeebe-gateway.startupProbe.successThreshold defines how often it needs to be true to be marked as ready, after failure
successThreshold: 1
## @param zeebe-gateway.startupProbe.failureThreshold defines when the probe is considered as failed so the Pod will be marked Unready
failureThreshold: 5
## @param zeebe-gateway.startupProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## @extra zeebe-gateway.readinessProbe configuration
readinessProbe:
## @param zeebe-gateway.readinessProbe.enabled if true, the readiness probe is enabled in app container
enabled: true
## @param zeebe-gateway.readinessProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param zeebe-gateway.readinessProbe.probePath defines the readiness probe route used on the app
probePath: /actuator/health/readiness
## @param zeebe-gateway.readinessProbe.initialDelaySeconds defines the number of seconds after the container has started before
## @extra zeebe-gateway.the probe is initiated.
initialDelaySeconds: 30
## @param zeebe-gateway.readinessProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param zeebe-gateway.readinessProbe.successThreshold defines how often it needs to be true to be marked as ready, after failure
successThreshold: 1
## @param zeebe-gateway.readinessProbe.failureThreshold defines when the probe is considered as failed so the Pod will be marked Unready
failureThreshold: 5
## @param zeebe-gateway.readinessProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## @extra zeebe-gateway.livenessProbe configuration
livenessProbe:
## @param zeebe-gateway.livenessProbe.enabled if true, the liveness probe is enabled in app container
enabled: false
## @param zeebe-gateway.livenessProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param zeebe-gateway.livenessProbe.probePath defines the liveness probe route used on the app
probePath: /actuator/health/liveness
## @param zeebe-gateway.livenessProbe.initialDelaySeconds defines the number of seconds after the container has started before
initialDelaySeconds: 30
## @param zeebe-gateway.livenessProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param zeebe-gateway.livenessProbe.successThreshold defines how often it needs to be true to be considered successful after having failed
successThreshold: 1
## @param zeebe-gateway.livenessProbe.failureThreshold defines when the probe is considered as failed so the container will be restarted
failureThreshold: 5
## @param zeebe-gateway.livenessProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## Metrics configuration
metrics:
## @param zeebe-gateway.metrics.prometheus Prometheus metrics endpoint
prometheus: /actuator/prometheus
## @param zeebe-gateway.nodeSelector can be used to define on which nodes the gateway pods should run
nodeSelector: {}
## @param zeebe-gateway.tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
tolerations: []
## @extra zeebe-gateway.affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
# The default defined PodAntiAffinity allows constraining on which nodes the Zeebe gateway pods are scheduled on https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
# It uses a hard requirement for scheduling and works based on the Zeebe gateway pod labels
## @skip zeebe-gateway.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[0].labelSelector.matchExpressions[0].key
## @skip zeebe-gateway.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[0].labelSelector.matchExpressions[0].operator
## @skip zeebe-gateway.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[0].labelSelector.matchExpressions[0].values
## @skip zeebe-gateway.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[0].topologyKey
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: "app.kubernetes.io/component"
operator: In
values:
- zeebe-gateway
topologyKey: "kubernetes.io/hostname"
## @param zeebe-gateway.extraVolumeMounts can be used to mount extra volumes for the gateway pods, useful for enabling tls between gateway and broker
extraVolumeMounts: []
## @param zeebe-gateway.extraVolumes can be used to define extra volumes for the gateway pods, useful for enabling tls between gateway and broker
extraVolumes: []
## @param zeebe-gateway.extraInitContainers (Deprecated - use `initContainers` instead) can be used to set up extra init containers for the gateway pods, useful for adding interceptors
extraInitContainers: []
## @param zeebe-gateway.initContainers can be used to set up extra init containers for the gateway pods, useful for adding interceptors
initContainers: []
## @extra zeebe-gateway.service configuration for the gateway service
service:
## @param zeebe-gateway.service.annotations can be used to define annotations, which will be applied to the zeebe-gateway service
annotations: {}
## @param zeebe-gateway.service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
type: ClusterIP
## @param zeebe-gateway.service.loadBalancerIP defines public ip of the load balancer if the type is LoadBalancer
loadBalancerIP: ""
## @param zeebe-gateway.service.loadBalancerSourceRanges defines list of allowed source ip address ranges if the type is LoadBalancer
loadBalancerSourceRanges: []
## @param zeebe-gateway.service.httpPort defines the port of the http endpoint, where for example metrics are provided
httpPort: 9600
## @param zeebe-gateway.service.httpName defines the name of the http endpoint, where for example metrics are provided
httpName: "http"
## @param zeebe-gateway.service.gatewayPort defines the port of the gateway endpoint, where client commands (grpc) are sent to
gatewayPort: 26500
## @param zeebe-gateway.service.gatewayName defines the name of the gateway endpoint, where client commands (grpc) are sent to
gatewayName: "gateway"
## @param zeebe-gateway.service.internalPort defines the port of the internal api endpoint, which is used for internal communication
internalPort: 26502
## @param zeebe-gateway.service.internalName defines the name of the internal api endpoint, which is used for internal communication
internalName: "internal"
## @extra zeebe-gateway.serviceAccount configuration for the service account where the gateway pods are assigned to
serviceAccount:
## @param zeebe-gateway.serviceAccount.enabled if true, enables the gateway service account
enabled: true
## @param zeebe-gateway.serviceAccount.name can be used to set the name of the gateway service account
name: ""
## @param zeebe-gateway.serviceAccount.annotations can be used to set the annotations of the gateway service account
annotations: {}
ingress:
## @param zeebe-gateway.ingress.enabled if true, an ingress resource is deployed with the Zeebe gateway deployment. Only useful if an ingress controller is available, like nginx.
enabled: false
## @param zeebe-gateway.ingress.className defines the class or configuration of ingress which should be used by the controller
className: nginx
## @param zeebe-gateway.ingress.annotations [object] defines the ingress related annotations, consumed mostly by the ingress controller
## @skip zeebe-gateway.ingress.annotations.ingress.kubernetes.io/rewrite-target
## @skip zeebe-gateway.ingress.annotations.nginx.ingress.kubernetes.io/ssl-redirect
## @skip zeebe-gateway.ingress.annotations.nginx.ingress.kubernetes.io/backend-protocol
## @skip zeebe-gateway.ingress.annotations.nginx.ingress.kubernetes.io/proxy-buffer-size
annotations:
ingress.kubernetes.io/rewrite-target: "/"
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
## @param zeebe-gateway.ingress.path defines the path which is associated with the operate service and port https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
path: /
## @param zeebe-gateway.ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
# If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
host: ""
## @extra zeebe-gateway.ingress.tls configuration for tls on the ingress resource https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
tls:
## @param zeebe-gateway.ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
enabled: false
## @param zeebe-gateway.ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
secretName: camunda-platform-zeebe-gateway
################################################
#####
# # ##### ###### ##### ## ##### ######
# # # # # # # # # # #
# # # # ##### # # # # # #####
# # ##### # ##### ###### # #
# # # # # # # # # #
##### # ###### # # # # # ######
################################################
## @section Operate Parameters
## @extra.operate configuration for the Operate sub chart.
operate:
## @param operate.enabled if true, the Operate deployment and its related resources are deployed via a helm release
enabled: true
## @extra operate.image configuration to configure the Operate image specifics
image:
## @param operate.image.registry can be used to set container image registry.
registry: ""
## @param operate.image.repository defines which image repository to use
repository: camunda/operate
## @param operate.image.tag can be set to overwrite the global tag, which should be used in that chart
tag:
## @param operate.image.pullSecrets can be used to configure image pull secrets https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
pullSecrets: []
## @param operate.sidecars can be used to attach extra containers to the operate deployment
sidecars: []
## @param operate.initContainers can be used to set up extra init containers for the operate pods, useful for additional exporters
initContainers: []
# contextPath: "/operate"
## @param operate.contextPath can be used to make Operate web application works on a custom sub-path. This is mainly used to run Camunda web applications under a single domain.
contextPath: ""
## @param operate.podAnnotations can be used to define extra Operate pod annotations
podAnnotations: {}
## @param operate.podLabels can be used to define extra Operate pod labels
podLabels: {}
## @extra operate.logging configuration for the Operate logging. This template will be directly included in the Operate configuration yaml file
## @param operate.logging.level.ROOT
## @param operate.logging.level.io.camunda.operate
logging:
level:
ROOT: INFO
io.camunda.operate: INFO
## @extra operate.service configuration to configure the Operate service.
service:
## @param operate.service.annotations can be used to define annotations, which will be applied to the Operate service
annotations: {}
## @param operate.service.type defines the type of the service https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
type: ClusterIP
## @param operate.service.port defines the port of the service, where the Operate web application will be available
port: 80
## @extra operate.resources configuration to set request and limit configuration for the container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
## @param operate.resources.requests.cpu
## @param operate.resources.requests.memory
## @param operate.resources.limits.cpu
## @param operate.resources.limits.memory
resources:
requests:
cpu: 600m
memory: 400Mi
limits:
cpu: 2000m
memory: 2Gi
## @param operate.env can be used to set extra environment variables in each Operate container
env: []
## @extra operate.configMap configuration which will be applied to the mounted config map.
configMap:
## @param operate.configMap.defaultMode can be used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
# See https://github.com/kubernetes/api/blob/master/core/v1/types.go#L1615-L1623
defaultMode: 0744
## @param operate.command can be used to override the default command provided by the container image. See https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
command: []
## @param operate.extraVolumes can be used to define extra volumes for the Operate pods, useful for tls and self-signed certificates
extraVolumes: []
## @param operate.extraVolumeMounts can be used to mount extra volumes for the Operate pods, useful for tls and self-signed certificates
extraVolumeMounts: []
## @extra operate.serviceAccount configuration for the service account where the Operate pods are assigned to
serviceAccount:
## @param operate.serviceAccount.enabled if true, enables the Operate service account
enabled: true
## @param operate.serviceAccount.name can be used to set the name of the Operate service account
name: ""
## @param operate.serviceAccount.annotations can be used to set the annotations of the Operate service account
annotations: {}
ingress:
## @param operate.ingress.enabled if true, an ingress resource is deployed with the Operate deployment. Only useful if an ingress controller is available, like nginx.
enabled: false
## @param operate.ingress.className defines the class or configuration of ingress which should be used by the controller
className: nginx
## @param operate.ingress.annotations [object] defines the ingress related annotations, consumed mostly by the ingress controller
## @skip operate.ingress.annotations.ingress.kubernetes.io/rewrite-target
## @skip operate.ingress.annotations.nginx.ingress.kubernetes.io/ssl-redirect
## @skip operate.ingress.annotations.nginx.ingress.kubernetes.io/proxy-buffer-size
annotations:
ingress.kubernetes.io/rewrite-target: "/"
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
## @param operate.ingress.path defines the path which is associated with the Operate service and port https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
path: /
## @param operate.ingress.host can be used to define the host of the ingress rule. https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
# If not specified the rules applies to all inbound http traffic, if specified the rule applies to that host.
host: ""
## @extra Ingress.tls configuration for tls on the ingress resource https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
tls:
## @param operate.ingress.tls.enabled if true, then tls is configured on the ingress resource. If enabled the Ingress.host need to be defined.
enabled: false
## @param operate.ingress.tls.secretName defines the secret name which contains the TLS private key and certificate
secretName: camunda-platform-operate
## @extra operate.podSecurityContext defines the security options the Operate pod should be run with
podSecurityContext:
## @param operate.podSecurityContext.runAsNonRoot
runAsNonRoot: true
## @param operate.podSecurityContext.fsGroup
fsGroup: 1000
## @extra operate.containerSecurityContext defines the security options the Operate container should be run with
containerSecurityContext:
## @param operate.containerSecurityContext.allowPrivilegeEscalation
allowPrivilegeEscalation: false
## @param operate.containerSecurityContext.privileged
privileged: false
## @param operate.containerSecurityContext.readOnlyRootFilesystem
readOnlyRootFilesystem: true
## @param operate.containerSecurityContext.runAsUser
runAsUser: 1004
## @extra operate.startupProbe configuration
startupProbe:
## @param operate.startupProbe.enabled if true, the startup probe is enabled in app container
enabled: false
## @param operate.startupProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param operate.startupProbe.probePath defines the startup probe route used on the app
probePath: /actuator/health/readiness
## @param operate.startupProbe.initialDelaySeconds defines the number of seconds after the container has started before
# the probe is initiated.
initialDelaySeconds: 30
## @param operate.startupProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param operate.startupProbe.successThreshold defines how often it needs to be true to be marked as ready, after failure
successThreshold: 1
## @param operate.startupProbe.failureThreshold defines when the probe is considered as failed so the Pod will be marked Unready
failureThreshold: 5
## @param operate.startupProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## @extra operate.readinessProbe configuration
readinessProbe:
## @param operate.readinessProbe.enabled if true, the readiness probe is enabled in app container
enabled: true
## @param operate.readinessProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param operate.readinessProbe.probePath defines the readiness probe route used on the app
probePath: /actuator/health/readiness
## @param operate.readinessProbe.initialDelaySeconds defines the number of seconds after the container has started before
# the probe is initiated.
initialDelaySeconds: 30
## @param operate.readinessProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param operate.readinessProbe.successThreshold defines how often it needs to be true to be marked as ready, after failure
successThreshold: 1
## @param operate.readinessProbe.failureThreshold defines when the probe is considered as failed so the Pod will be marked Unready
failureThreshold: 5
## @param operate.readinessProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## @extra operate.livenessProbe configuration
livenessProbe:
## @param operate.livenessProbe.enabled if true, the liveness probe is enabled in app container
enabled: false
## @param operate.livenessProbe.scheme defines the startup probe schema used on calling the probePath
scheme: HTTP
## @param operate.livenessProbe.probePath defines the liveness probe route used on the app
probePath: /actuator/health/liveness
## @param operate.livenessProbe.initialDelaySeconds defines the number of seconds after the container has started before
# the probe is initiated.
initialDelaySeconds: 30
## @param operate.livenessProbe.periodSeconds defines how often the probe is executed
periodSeconds: 30
## @param operate.livenessProbe.successThreshold defines how often it needs to be true to be considered successful after having failed
successThreshold: 1
## @param operate.livenessProbe.failureThreshold defines when the probe is considered as failed so the container will be restarted
failureThreshold: 5
## @param operate.livenessProbe.timeoutSeconds defines the seconds after the probe times out
timeoutSeconds: 1
## Metrics configuration
metrics:
## @param operate.metrics.prometheus Prometheus metrics endpoint
prometheus: /actuator/prometheus
## @param operate.nodeSelector can be used to define on which nodes the Operate pods should run
nodeSelector: {}
## @param operate.tolerations can be used to define pod toleration's https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
tolerations: []
## @param operate.affinity can be used to define pod affinity or anti-affinity https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
affinity: {}
# Retention can be used to define the data in Elasticsearch (ILM).
retention:
## @param operate.retention.enabled if true, the ILM Policy is created and applied to the index templates.
enabled: false
## @param operate.retention.minimumAge defines how old the data must be, before the data is deleted as a duration.
minimumAge: 30d
##################################################
#######
# ## #### # # # # #### #####
# # # # # # # # # #
# # # #### #### # # #### #
# ###### # # # # # # #