values.yaml

## For OpenFaaS Standard and OpenFaaS for Enterprises users, see:
# https://github.com/openfaas/faas-netes/blob/master/chart/openfaas/values-pro.yaml

functionNamespace: openfaas-fn  # Default namespace for functions

# Contact us via https://www.openfaas.com/support to purchase a license
openfaasPro: false

# Contact us via https://www.openfaas.com/support to purchase a license
oem: false

httpProbe: true               # Setting to true will use HTTP for readiness and liveness probe on the OpenFaaS core components

# set clusterRole: true for:
## Multiple-namespaces
## CPU/RAM metrics in OpenFaaS API
clusterRole: false

createCRDs: true              # Set to false if applying CRDs in another way

basic_auth: true              # Authentication for core components, no good reason to disable this
rbac: true                    # Kubernetes RBAC, no good reason to disable this
generateBasicAuth: true       # Set to false if applying credentials separately from the chart, otherwise set to true

# Define a securityContext for the containers deployed by this helm chart.
securityContext: {}

exposeServices: true
serviceType: NodePort        # serviceType for OpenFaaS gateway
async: true                  # No known reason to disable this, kept for legacy reasons 

queueMode: ""                # Set to `jetstream` to run the async system backed by NATS JetStream. By default the async system uses NATS Streaming 

# create pod security policies for OpenFaaS control plane
# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
psp: false

# image pull policy for openfaas components, can change to `IfNotPresent` for an air-gapped environment
openfaasImagePullPolicy: "IfNotPresent"

# Optionally, give the name of a secret containing a CA bundle to be added to the 
# OIDC plugin and OpenFaaS Dashboard components when a self-signed certificate is used
#
# kubectl create secret generic -n openfaas ca-bundle --from-file=ca.crt=./ca.crt
#
caBundleSecretName: ""       # Name of the secret containing the CA bundle for the OpenFaaS gateway

functions:
  imagePullPolicy: "Always"    # Image pull policy for deployed functions, for OpenFaaS Pro you can also set: IfNotPresent and Never.
  httpProbe: true              # Setting to true will use HTTP for readiness and liveness probe on function pods
  setNonRootUser: false        # It's recommended to set this to "true", but test your images before committing to it
  readinessProbe:
    initialDelaySeconds: 0
    timeoutSeconds: 1           # Tuned-in to run checks early and quickly to support fast cold-start from zero replicas
    periodSeconds: 2            # Reduce to 1 for a faster cold-start, increase higher for lower-CPU usage
    successThreshold: 1
    failureThreshold: 3
  livenessProbe:
    initialDelaySeconds: 0
    timeoutSeconds: 1
    periodSeconds: 2           # Reduce to 1 for a faster cold-start, increase higher for lower-CPU usage
    failureThreshold: 3

gatewayPro:
  image: ghcr.io/openfaasltd/gateway:0.4.27
  pprof: false

gateway:
  image: ghcr.io/openfaas/gateway:0.27.6
  readTimeout: "1m05s"
  writeTimeout: "1m05s"
  upstreamTimeout: "1m"  # Must be smaller than read/write_timeout
  replicas: 1
  scaleFromZero: true
  # change the port when creating multiple releases in the same baremetal cluster
  nodePort: 31112
  maxIdleConns: 1024
  maxIdleConnsPerHost: 1024
  directFunctions: false
  # Custom logs provider url. For example openfaas-loki would be
  # "http://ofloki-openfaas-loki.openfaas:9191/"
  logsProviderURL: ""

  # Set to true for Istio users as a workaround for:
  # https://github.com/openfaas/faas/issues/1721
  probeFunctions: false

  # See the HPA rule from the Customer Community
  # https://github.com/openfaas/customers/blob/master/gateway-hpa.yaml
  resources:
    requests:
      memory: "120Mi"
      cpu: "100m"

  readinessProbe:
    initialDelaySeconds: 1
    periodSeconds: 5
    timeoutSeconds: 5
    failureThreshold: 3
    successThreshold: 1

  livenessProbe:
    initialDelaySeconds: 1
    periodSeconds: 5
    timeoutSeconds: 5
    failureThreshold: 3
    successThreshold: 1

eventSubscription:
  endpoint: ""
  endpointSecret: ""

  # Do not validate the TLS certificate of the endpoint, use when 
  # testing with self-signed certificates
  insecureTLS: false

  metering:
    enabled: false

    # Default memory value used in function_usage events for metering
    # when no memory limit is set on the function.
    defaultRAM: 512Mi
    # Comma-separated list of namespaces to exclude from metering
    # for when functions are used to handle the metering webhook events
    excludedNamespaces: ""
  auditing:
    enabled: false
    # Comma-separated list of HTTP methods to audit.
    httpVerbs: "PUT,POST,DELETE"

eventWorker:
  image: ghcr.io/openfaasltd/event-worker:0.0.9
  replicas: 1
  logs:
    debug: false
    format: "console"
  resources:
    requests:
      memory: "120Mi"
      cpu: "50m"

# For OpenFaaS Pro and the Function CRD
operator:
  image: ghcr.io/openfaasltd/faas-netes:0.5.33
  create: false
  logs:
    debug: false
    format: "console"

  resources:
    requests:
      memory: "120Mi"
      cpu: "50m"

  # For when you are running more than one replica of the gateway
  leaderElection:
    enabled: false

  # Set to 2 for large amounts of functions
  reconcileWorkers: 1

  # For OpenFaaS for Enterprises, these numbers can be set higher,
  # if experiencing rate limiting due to a large number of functions
  # within the cluster
  kubeClientQPS: 100
  kubeClientBurst: 250

  # For OpenFaaS for Enterprises, these numbers can be set higher,
  # For very high usage, you can increase the rate at which Function CRs
  # are processed and turned into deployments, or updated in response to changes
  reconcileQPS: 100
  reconcileBurst: 250

  # When set to true, pprof will be enabled, and the 
  # service "faas-provider" will gain an extra port to
  # expose the pprof endpoint, this cannot be used in production
  # since it may bypass authentication, and should only be used
  # for debugging purposes
  pprof: false

faasnetesPro:
  image: ghcr.io/openfaasltd/faas-netes:0.5.33
  logs:
    debug: false
    format: "console"

faasnetesOem:
  image: ghcr.io/openfaasltd/faas-netes-oem:0.2.0

# For the Community Edition
faasnetes:
  image: ghcr.io/openfaas/faas-netes:0.18.5
  resources:
    requests:
      memory: "120Mi"
      cpu: "100m"

# The values for jetstreamQueueWorker are merged with those under
# the "queueWorkerPro" and "queueWorker" section
#  
# Enable automatically when nats.queueMode is set to "jetstream"
jetstreamQueueWorker:
  image: ghcr.io/openfaasltd/jetstream-queue-worker:0.3.37
  durableName: "faas-workers"
  # Configure the max waiting pulls for the queue-worker JetStream consumer. 
  # The value should be at least max_inflight * replicas.
  # Note that this value can not be updated once the consumer is created.
  maxWaiting: 512
  logs:
    debug: false
    format: "console"

  # Set pprof to listen on port 6000 to debug issues
  pprof: false

# OpenFaaS Pro
# The values for queueWorkerPro are merged with those under
# the "queueWorker" section
#
# To deploy additional named queues, see the "queue-worker"
# chart
#
# Enabled automatically when openfaasPro is set to true
queueWorkerPro:
  image: ghcr.io/openfaasltd/queue-worker:0.4.0
  maxRetryAttempts: "10"
  maxRetryWait: "120s"
  initialRetryWait: "10s"
  # 408 Request Timeout message
  # 429 Too Many Requests
  # 500 Internal Server Error
  # 502 Bad Gateway
  # 503 Service Unavailable
  # 504 Gateway Timeout
  httpRetryCodes: "408,429,500,502,503,504"
  insecureTLS: false
  printRequestBody: false
  printResponseBody: false
  # Control the concurrent invocations
  maxInflight: 50

# Community Edition, maxInflight is 1
# Name of shared queue is "faas-request"
queueWorker:
  image: ghcr.io/openfaas/queue-worker:0.14.1
  # Control HA of queue-worker
  replicas: 1
  queueGroup: "faas"
  ackWait: "60s"
  resources:
    requests:
      memory: "120Mi"
      cpu: "50m"

# OpenFaaS Pro
## Advanced auto-scaler for scaling functions on RPS, CPU and in-flight requests
## Includes: scale to zero
autoscaler:
  image: ghcr.io/openfaasltd/autoscaler:0.3.6
  replicas: 1
  enabled: true
  resources:
    requests:
      memory: "128Mi"
      cpu: "100m"
    limits:
      memory: "256Mi"
  # When disableHorizontalScaling is set to true, then the autoscaler will 
  # only scale to zero, without scaling replicas between the defined Min and Max
  # count for the function
  disableHorizontalScaling: false

# OpenFaaS Pro
## To use with port-forwarding, set publicURL to 
## http://127.0.0.1
dashboard:
  image: ghcr.io/openfaasltd/openfaas-dashboard:0.5.17
  publicURL: https://dashboard.example.com
  # Name of signing key secret for sessions.
  # Leave blank for development, see https://docs.openfaas.com/openfaas-pro/dashboard/ for production and staging.
  signingKeySecret: ""
  replicas: 1
  enabled: false
  logs:
    debug: false
    format: "console"
  resources:
    requests:
      memory: "128Mi"
      cpu: "50m"
    limits:
      memory: "256Mi"

# OpenFaaS Enterprise (OpenFaaS IAM)
# OIDC plugin for authentication on the OpenFaaS REST API
oidcAuthPlugin:
  image: ghcr.io/openfaasltd/openfaas-oidc-plugin:0.7.5
  insecureTLS: false
  replicas: 1
  securityContext: true
  logs:
    debug: false
    format: "console"
  resources:
    requests:
      memory: "120Mi"
      cpu: "50m"

iam:
  enabled: false
  # systemIssuer represents the issuer for the OpenFaaS system components
  systemIssuer:
    url: https://gateway.example.com

  # dashboardIssuer represents the issuer for the OpenFaaS dashboard
  dashboardIssuer:
    url: https://example.eu.auth0.com
    clientId: ""
    clientSecret: ""
    scopes:
      - openid
      - profile
      - email

  # kubernetesIssuer represents the Kubernetes service account issuer.
  kubernetesIssuer:
    create: true
    url: https://kubernetes.default.svc.cluster.local
    tokenExpiry: 2h

prometheus:
  image: prom/prometheus:v2.51.2
  create: true
  retention:
    time: 15d
  resources:
    requests:
      memory: "512Mi"
      cpu: "100m"
  annotations: {}

alertmanager:
  image: prom/alertmanager:v0.27.0
  create: true
  resources:
    requests:
      memory: "25Mi"
      cpu: "50m"
    limits:
      memory: "50Mi"

stan:
  # Image used for the NATS Streaming when using the deprecated 
  # support in the Community Edition (CE)
  image: nats-streaming:0.25.6

# NATS (required for async)
nats:
  channel: "faas-request"
  # Stream replication is set to 1 by default. This is only recommended for development.
  # For production a value of at least 3 is recommended for NATS JetStream to be resilient.
  # See https://github.com/openfaas/openfaas-pro/blob/master/jetstream.md
  streamReplication: 1
  external:
    clusterName: ""
    enabled: false
    host: ""
    port: ""
  # The version of NATS Core used with OpenFaaS Pro and JetStream
  image: nats:2.10.14
  resources:
    requests:
      memory: "120Mi"
      cpu: "100m"

# ingress configuration
ingress:
  enabled: false
  ## For k8s >= 1.18 you need to specify the pathType
  ## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types
  #pathType: ImplementationSpecific

  # Used to create Ingress record (should be used with exposeServices: false).
  hosts:
    - host: gateway.openfaas.local  # Replace with gateway.example.com if public-facing
      serviceName: gateway
      servicePort: 8080
      path: /
  annotations:
    kubernetes.io/ingress.class: nginx
  tls:
  # Secrets must be manually created in the namespace.

  ## You can specify the ingress controller by using the ingressClassName
  #ingressClassName: nginx

# ingressOperator (optional) – component to have specific FQDN and TLS for Functions
# https://github.com/openfaas/ingress-operator
ingressOperator:
  image: ghcr.io/openfaas/ingress-operator:0.8.2
  replicas: 1
  create: false
  resources:
    requests:
      memory: "25Mi"
      cpu: "50m"

nodeSelector: {}

tolerations: []

affinity: {}

kubernetesDNSDomain: cluster.local

istio:
  mtls: false

gatewayExternal:
  annotations: {}

k8sVersionOverride: "" #  Allow kubeVersion to be overridden for the ingress creation