values.yaml

# Copyright 2017 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# General configuration shared across resources
app:
  image:
    pullPolicy: IfNotPresent
    pullSecrets: []
  scaling:
    # Default number of replicas
    replicas: 1
    revisionHistoryLimit: 10
  scheduling:
    # Node labels for pod assignment
    # Ref: https://kubernetes.io/docs/user-guide/node-selection/
    nodeSelector: {}
  security:
    # SecurityContext to be added to pods
    # To disable set the following configuration to null:
    # securityContext: null
    securityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    # ContainerSecurityContext to be added to containers
    # To disable set the following configuration to null:
    # containerSecurityContext: null
    containerSecurityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsUser: 1001
      runAsGroup: 2001
      capabilities:
        drop: ["ALL"]
    # Pod Disruption Budget configuration
    # Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
    podDisruptionBudget:
      enabled: false
      minAvailable: 0
      maxUnavailable: 0
    networkPolicy:
      enabled: false
      ingressDenyAll: false
  # Common labels & annotations shared across all deployed resources
  labels: {}
  annotations: {}
  settings:
    ## Global dashboard settings
    ## Note: Use all or none. Dashboard does not support default value merging currently.
    global:
    #  # Cluster name that appears in the browser window title if it is set
    #  clusterName: ""
    #  # Max number of items that can be displayed on each list page
    #  itemsPerPage: 10
    #  # Number of seconds between every auto-refresh of logs
    #  logsAutoRefreshTimeInterval: 5
    #  # Number of seconds between every auto-refresh of every resource. Set 0 to disable
    #  resourceAutoRefreshTimeInterval: 5
    #  # Hide all access denied warnings in the notification panel
    #  disableAccessDeniedNotifications: false
    ## Pinned CRDs that will be displayed in dashboard's menu
    pinnedCRDs: []
    # - kind: customresourcedefinition
    #  #  Fully qualified name of a CRD
    #  name: prometheus.monitoring.coreos.com
    #  #  Display name
    #  displayName: Prometheus
    #  #  Is this CRD namespaced?
    #  namespaced: true
  ingress:
    enabled: true
    hosts:
    # Keep 'localhost' host only if you want to access Dashboard using 'kubectl port-forward ...' on:
    # https://localhost:8443
    - localhost
    # - kubernetes.dashboard.domain.com
    ingressClassName: internal-nginx
    pathType: ImplementationSpecific
    secretName: kubernetes-dashboard-certs
    issuer:
      name: selfsigned
      # Scope determines what kind of issuer annotation will be used on ingress resource
      # - default - adds 'cert-manager.io/issuer'
      # - cluster - adds 'cert-manager.io/cluster-issuer'
      # - disabled - disables cert-manager annotations
      scope: default
    labels: {}
    annotations: {}
    paths:
      web: /
      api: /api
  # Use the following toleration if Dashboard can be deployed on a tainted control-plane nodes
  # - key: node-role.kubernetes.io/control-plane
  #   effect: NoSchedule
  tolerations: []

# API deployment configuration
api:
  role: api
  image:
    repository: docker.io/kubernetesui/dashboard-api
    tag: v1.0.0
  containers:
    ports:
      - name: api
        containerPort: 9000
        protocol: TCP
    # Additional container arguments
    # Full list of arguments: https://github.com/kubernetes/dashboard/blob/master/docs/common/arguments.md
    # args:
    # - --system-banner="Welcome to the Kubernetes Dashboard"
    args: []
    # Additional container environment variables
    # env:
    # - name: SOME_VAR
    #   value: 'some value'
    env: []
    # Additional volume mounts
    # - mountPath: /kubeconfig
    #   name: dashboard-kubeconfig
    #   readOnly: true
    volumeMounts:
      # Create volume mount to store exec logs (required)
      - mountPath: /tmp
        name: tmp-volume
    # TODO: Validate configuration
    resources:
      requests:
        cpu: 100m
        memory: 200Mi
      limits:
        cpu: 250m
        memory: 400Mi
  # Additional volumes
  # - name: dashboard-kubeconfig
  #   secret:
  #     defaultMode: 420
  #     secretName: dashboard-kubeconfig
  volumes:
    # Create on-disk volume to store exec logs (required)
    - name: tmp-volume
      emptyDir: {}
  nodeSelector: {}
  # Labels & annotations shared between API related resources
  labels: {}
  annotations: {}

# WEB UI deployment configuration
web:
  role: web
  image:
    repository: docker.io/kubernetesui/dashboard-web
    tag: v1.0.0
  containers:
    ports:
      - name: web
        containerPort: 8000
        protocol: TCP
    # Additional container arguments
    # Full list of arguments: https://github.com/kubernetes/dashboard/blob/master/docs/common/arguments.md
    # args:
    # - --system-banner="Welcome to the Kubernetes Dashboard"
    args: []
    # Additional container environment variables
    # env:
    # - name: SOME_VAR
    #   value: 'some value'
    env: []
    # Additional volume mounts
    # - mountPath: /kubeconfig
    #   name: dashboard-kubeconfig
    #   readOnly: true
    volumeMounts:
      # Create volume mount to store logs (required)
      - mountPath: /tmp
        name: tmp-volume
    # TODO: Validate configuration
    resources:
      requests:
        cpu: 100m
        memory: 200Mi
      limits:
        cpu: 250m
        memory: 400Mi
  # Additional volumes
  # - name: dashboard-kubeconfig
  #   secret:
  #     defaultMode: 420
  #     secretName: dashboard-kubeconfig
  volumes:
    # Create on-disk volume to store exec logs (required)
    - name: tmp-volume
      emptyDir: {}
  nodeSelector:
    # TODO: check if it's really needed since we offer cross platform images for darwin/windows/linux
    kubernetes.io/os: linux
  # Labels & annotations shared between WEB UI related resources
  labels: {}
  annotations: {}

### Metrics Scraper
### Container to scrape, store, and retrieve a window of time from the Metrics Server.
### refs: https://github.com/kubernetes-sigs/dashboard-metrics-scraper
metricsScraper:
  enabled: true
  role: metrics-scraper
  image:
    repository: docker.io/kubernetesui/metrics-scraper
    tag: v1.0.9
  containers:
    ports:
      - containerPort: 8000
        protocol: TCP
    args: []
    # Additional container environment variables
    # env:
    # - name: SOME_VAR
    #   value: 'some value'
    env: []
    # Additional volume mounts
    # - mountPath: /kubeconfig
    #   name: dashboard-kubeconfig
    #   readOnly: true
    volumeMounts:
      # Create volume mount to store logs (required)
      - mountPath: /tmp
        name: tmp-volume
    # TODO: Validate configuration
    resources:
      requests:
        cpu: 100m
        memory: 200Mi
      limits:
        cpu: 250m
        memory: 400Mi
    livenessProbe:
      httpGet:
        scheme: HTTP
        path: /
        port: 8000
      initialDelaySeconds: 30
      timeoutSeconds: 30
  # Additional volumes
  # - name: dashboard-kubeconfig
  #   secret:
  #     defaultMode: 420
  #     secretName: dashboard-kubeconfig
  volumes:
    # Create on-disk volume to store exec logs (required)
    - name: tmp-volume
      emptyDir: {}
  nodeSelector:
    # TODO: check if it's really needed since we offer cross platform images for darwin/windows/linux
    kubernetes.io/os: linux
  # Labels & annotations shared between WEB UI related resources
  labels: {}
  annotations: {}


## Optional Metrics Server sub-chart configuration
## Enable this if you don't already have metrics-server enabled on your cluster and
## want to use it with dashboard metrics-scraper
## refs:
##  - https://github.com/kubernetes-sigs/metrics-server
##  - https://github.com/kubernetes-sigs/metrics-server/tree/master/charts/metrics-server
metrics-server:
  enabled: true
  args:
    - --kubelet-preferred-address-types=InternalIP
    - --kubelet-insecure-tls

## Optional Cert Manager sub-chart configuration
## Enable this if you don't already have cert-manager enabled on your cluster.
cert-manager:
  enabled: true
  installCRDs: true

## Optional Nginx Ingress sub-chart configuration
## Enable this if you don't already have nginx-ingress enabled on your cluster.
nginx:
  enabled: true
  controller:
    electionID: ingress-controller-leader
    ingressClassResource:
      name: internal-nginx
      default: false
      controllerValue: k8s.io/internal-ingress-nginx
    service:
      type: ClusterIP

## Extra configurations:
## - manifests
## - predefined roles
## - prometheus
## - etc...
extras:
  # Extra Kubernetes manifests to be deployed
  # manifests:
  # - apiVersion: v1
  #   kind: ConfigMap
  #   metadata:
  #     name: additional-configmap
  #   data:
  #     mykey: myvalue
  manifests: []
  # Start in ReadOnly mode.
  # Specifies whether cluster-wide RBAC resources (ClusterRole, ClusterRolebinding) with read only permissions to all resources listed inside the cluster should be created
  # Only dashboard-related Secrets and ConfigMaps will still be available for writing.
  #
  # The basic idea of the clusterReadOnlyRole
  # is not to hide all the secrets and sensitive data but more
  # to avoid accidental changes in the cluster outside the standard CI/CD.
  #
  # It is NOT RECOMMENDED to use this version in production.
  # Instead, you should review the role and remove all potentially sensitive parts such as
  # access to persistentvolumes, pods/log etc.
  clusterReadOnlyRole: false
  # It is possible to add additional rules if read only role is enabled.
  # This can be useful, for example, to show CRD resources.
  clusterReadOnlyRoleAdditionalRules: []
  serviceMonitor:
    # Whether to create a Prometheus Operator service monitor.
    enabled: false
    # Here labels can be added to the serviceMonitor
    labels: {}
    # Here annotations can be added to the serviceMonitor
    annotations: {}
    # metrics.serviceMonitor.metricRelabelings Specify Metric Relabelings to add to the scrape endpoint
    # ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig
    metricRelabelings: []
    # metrics.serviceMonitor.relabelings [array] Prometheus relabeling rules
    relabelings: []
    # ServiceMonitor connection scheme. Defaults to HTTPS.
    scheme: https
    # ServiceMonitor connection tlsConfig. Defaults to {insecureSkipVerify:true}.
    tlsConfig:
      insecureSkipVerify: true