values.yaml

# Default values for BotKube.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1
# Extra annotations to pass to the BotKube pod
extraAnnotations: {}
# Priority class name for the pod
priorityClassName: ""
image:
  registry: ghcr.io
  repository: infracloudio/botkube
  pullPolicy: IfNotPresent
  ## default tag is appVersion from Chart.yaml. If you want to use
  ## some other tag then it can be specified here
  tag: v0.12.4

nameOverride: ""
fullnameOverride: ""

# Enable podSecurityPolicy to allow BotKube to run in restricted clusters
podSecurityPolicy:
  enabled: false

# Configure securityContext to manage user Privileges in pods
# set to run as a Non-Privileged user by default
securityContext:
  runAsUser: 101
  runAsGroup: 101

containerSecurityContext:
  privileged: false
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true

kubeconfig:
  # If true, enables overriding the kubernetes auth.
  enabled: false
  # A base64 encoded kubeconfig that will be stored in a secret, mounted to the pod, and specified in the KUBECONFIG environment variable.
  base64Config: ""
  # A secret containing a kubeconfig to use.
  # Secret format:
  #  data:
  #    config: {base64_encoded_kubeconfig}
  existingSecret: ""

# set one of the log levels- info, warn, debug, error, fatal, panic
logLevel: info

config:
  ## Resources you want to watch
  resources:
    - name: v1/pods             # Name of the resource. Resource name must be in group/version/resource (G/V/R) format
                                # resource name should be plural (e.g apps/v1/deployments, v1/pods)
      namespaces:               # List of namespaces, "all" will watch all the namespaces
        include:
          - all
        ignore:                 # List of namespaces to be ignored (omitempty), used only with include: all, can contain a wildcard (*)
          -                     # example : include [all], ignore [x,y,secret-ns-*]
      events:                   # List of lifecycle events you want to receive, e.g create, update, delete, error OR all
        - create
        - delete
        - error
    - name: v1/services
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: apps/v1/deployments
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - update
        - delete
        - error
      updateSetting:
        includeDiff: true
        fields:
          - spec.template.spec.containers[*].image
          - status.availableReplicas
    - name: apps/v1/statefulsets
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - update
        - delete
        - error
      updateSetting:
        includeDiff: true
        fields:
          - spec.template.spec.containers[*].image
          - status.readyReplicas
    - name: networking.k8s.io/v1beta1/ingresses
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: v1/nodes
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: v1/namespaces
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: v1/persistentvolumes
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: v1/persistentvolumeclaims
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: v1/configmaps
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: apps/v1/daemonsets
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - update
        - delete
        - error
      updateSetting:
        includeDiff: true
        fields:
          - spec.template.spec.containers[*].image
          - status.numberReady
    - name: batch/v1/jobs
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - update
        - delete
        - error
      updateSetting:
        includeDiff: true
        fields:
          - spec.template.spec.containers[*].image
          - status.conditions[*].type
    - name: rbac.authorization.k8s.io/v1/roles
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: rbac.authorization.k8s.io/v1/rolebindings
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: rbac.authorization.k8s.io/v1/clusterrolebindings
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    - name: rbac.authorization.k8s.io/v1/clusterroles
      namespaces:
        include:
          - all
        ignore:
          -
      events:
        - create
        - delete
        - error
    # Custom resource example
    #- name: velero.io/v1/backups
    #  namespaces:
    #    include:
    #      - all
    #    ignore:
    #      -
    #  events:
    #    - create
    #    - update
    #    - delete
    #    - error
    #  updateSetting:
    #    includeDiff: true
    #    fields:
    #      - status.phase

  # Check true if you want to receive recommendations
  # about the best practices for the created resource
  recommendations: true

  # For using custom SSL certificates
  ssl:
    # Set to true and specify cert path in the next line after uncommenting
    enabled: false
    # Using existing SSL secret. It MUST be in botkube Namespace.
    # Secret format:
    #  data:
    #    ca-certificates.crt: {base64_encoded_ssl_cert}
    #existingSecretName: ""

    # SSL Certificate file e.g certs/my-cert.crt
    #cert:

  # Setting to support multiple clusters
  settings:
    # Cluster name to differentiate incoming messages
    clustername: not-configured
    # Kubectl executor configs
    kubectl:
      # Set true to enable kubectl commands execution
      enabled: false
      # List of allowed commands
      commands:
        # method which are allowed
        verbs: ["api-resources", "api-versions", "cluster-info", "describe", "diff", "explain", "get", "logs", "top", "auth"]
        # resource configuration which is allowed
        resources: ["deployments", "pods" , "namespaces", "daemonsets", "statefulsets", "storageclasses", "nodes" ]
      # set Namespace to execute BotKube kubectl commands by default
      defaultNamespace: default
      # Set true to enable commands execution from configured channel only
      restrictAccess: false
    # Set true to enable config watcher
    configwatcher: true
    # Set false to disable upgrade notification
    upgradeNotifier: true

# Communication settings
communications:

  # Using existing Communication secret. It MUST be in botkube Namespace.
  # Secret format:
  #  stringData:
  #    comm_config.yaml: |
  #      communications:
  #        # Here specify settings for each app, like Slack, Mattermost etc.
  #        # NOTE: Use setting format visible below.
  existingSecretName: ""

  # Settings for Slack
  slack:
    enabled: false
    channel: 'SLACK_CHANNEL'                   # Slack channel name without '#' prefix where you have added BotKube and want to receive notifications in
    token: 'SLACK_API_TOKEN'
    notiftype: short                           # Change notification type short/long you want to receive. notiftype is optional and Default notification type is short (if not specified)

  # Settings for Mattermost
  mattermost:
    enabled: false
    botName: 'BotKube'                          # User in mattermost which belongs the Personal Access token to
    url: 'MATTERMOST_SERVER_URL'                # URL where Mattermost is running. e.g https://example.com:9243
    token: 'MATTERMOST_TOKEN'                   # Personal Access token generated by BotKube user
    team: 'MATTERMOST_TEAM'                     # Mattermost Team to configure with BotKube
    channel: 'MATTERMOST_CHANNEL'               # Mattermost Channel for receiving BotKube alerts
    notiftype: short                            # Change notification type short/long you want to receive. notiftype is optional and Default notification type is short (if not specified)

  # Settings for MS Teams
  teams:
    enabled: false
    appID: 'APPLICATION_ID'
    appPassword: 'APPLICATION_PASSWORD'
    messagePath: "/bots/teams"
    notiftype: short
    port: 3978

  # Settings for Discord
  discord:
    enabled: false
    token: 'DISCORD_TOKEN'                      # BotKube Bot Token
    botid: 'DISCORD_BOT_ID'                     # BotKube Application Client ID
    channel: 'DISCORD_CHANNEL_ID'               # Discord Channel id for receiving BotKube alerts
    notiftype: short                            # Change notification type short/long you want to receive. notiftype is optional and Default notification type is short (if not specified)

  # Settings for ELS
  elasticsearch:
    enabled: false
    awsSigning:
      enabled: false                            # enable awsSigning using IAM for Elasticsearch hosted on AWS, if true make sure AWS environment variables are set. Refer https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
      awsRegion: "us-east-1"                    # AWS region where Elasticsearch is deployed
      roleArn: ''                               # AWS IAM Role arn to assume for credentials, use this only if you don't want to use the EC2 instance role or not running on AWS instance
    server: 'ELASTICSEARCH_ADDRESS'             # e.g https://example.com:9243
    username: 'ELASTICSEARCH_USERNAME'          # Basic Auth
    password: 'ELASTICSEARCH_PASSWORD'
    skipTLSVerify: false                      # toggle verification of TLS certificate of the Elastic nodes. Verification is skipped when option is true. Enable to connect to clusters with self-signed certs
    # ELS index settings
    index:
      name: botkube
      type: botkube-event
      shards: 1
      replicas: 0

  # Settings for Webhook
  webhook:
    enabled: false
    url: 'WEBHOOK_URL'                          # e.g https://example.com:80

  # Settings for lark
  lark:
    enabled: false
    endpoint: "LARK_URL"
    appID: "LARK_APP_ID"
    appSecret: "LARK_APP_SECRET"
    encryptKey: "LARK_ENCRYPT_KEY"
    verificationToken: "LARK_VERIFICATION_TOKEN"
    messagePath: "/bots/lark"
    chatGroup: "LARK_CHAT_GROUP_ID"
    port: 9999

service:
  name: metrics
  port: 2112
  targetPort: 2112

# Ingress settings to expose teams and lark endpoints
ingress:
  create: false
  annotations:
    kubernetes.io/ingress.class: nginx
  host: 'HOST'
  tls:
    enabled: false
    secretName: ''

serviceMonitor:
  ## If true, a ServiceMonitor CR is created for a BotKube
  ##  https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#servicemonitor
  ##
  enabled: false
  interval: 10s
  path: /metrics
  port: metrics
  labels: {}

deployment:
  annotations: {}

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #  cpu: 100m
  #  memory: 128Mi
  # requests:
  #  cpu: 100m
  #  memory: 128Mi

extraEnv: []
## Extra environment variables to pass to the BotKube container, example HTTP_PROXY
## extraEnv:
##   HTTP_PROXY: <proxyURL>:<port>

nodeSelector: {}

tolerations: []

affinity: {}

rbac:
  create: true
  rules:
    - apiGroups: ["*"]
      resources: ["*"]
      verbs: ["get", "watch", "list"]
serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  #name:
  # annotations for the service account
  annotations: {}

# Extra Kubernetes resources to create. Helm templating is allowed as it is evaluated before creating the resources.
extraObjects: []
# For example, to create a ClusterRoleBinding resource without creating a dedicated ClusterRole, uncomment the following snippet.
# NOTE: While running Helm install/upgrade with this sample snippet uncommented, make sure to set the following values:
#    1. `rbac.create: false`
#    2.`extraClusterRoleName: {clusterRole}`, where {clusterRole} is a given ClusterRole name (e.g. `cluster-admin`).
#
#    - apiVersion: rbac.authorization.k8s.io/v1
#      kind: ClusterRoleBinding
#      metadata:
#        name: "{{ include \"botkube.fullname\" . }}-clusterrolebinding"
#        labels:
#          app.kubernetes.io/name: "{{ include \"botkube.name\" . }}"
#          helm.sh/chart: "{{ include \"botkube.chart\" . }}"
#          app.kubernetes.io/instance: "{{ .Release.Name }}"
#          app.kubernetes.io/managed-by: "{{ .Release.Service }}"
#      roleRef:
#        apiGroup: rbac.authorization.k8s.io
#        kind: ClusterRole
#        name: "{{ .Values.extraClusterRoleName }}"
#      subjects:
#      - kind: ServiceAccount
#        name: "{{ include \"botkube.serviceAccountName\" . }}"
#        namespace: "{{ .Release.Namespace }}"