kuma

1
global:
2
  image:
3
    # -- Default registry for all Kuma Images
4
    registry: "docker.io/kumahq"
5
    # -- The default tag for all Kuma images, which itself defaults to .Chart.AppVersion
6
    tag:
7
  # -- Add `imagePullSecrets` to all the service accounts used for Kuma components
8
  imagePullSecrets: []
9

10
# -- Whether to patch the target namespace with the system label
11
patchSystemNamespace: true
12

13
installCrdsOnUpgrade:
14
  # -- Whether install new CRDs before upgrade (if any were introduced with the new version of Kuma)
15
  enabled: true
16
  # -- The `imagePullSecrets` to attach to the Service Account running CRD installation.
17
  # This field will be deprecated in a future release, please use .global.imagePullSecrets
18
  imagePullSecrets: []
19

20
# -- Whether to disable all helm hooks
21
noHelmHooks: false
22

23
# -- Whether to restart control-plane by calculating a new checksum for the secret
24
restartOnSecretChange: true
25

26
controlPlane:
27
  # -- Environment that control plane is run in, useful when running universal global control plane on k8s
28
  environment: "kubernetes"
29

30
  # -- Labels to add to resources in addition to default labels
31
  extraLabels: {}
32

33
  # -- Kuma CP log level: one of off,info,debug
34
  logLevel: "info"
35

36
  # -- Kuma CP log output path: Defaults to /dev/stdout
37
  logOutputPath: ""
38

39
  # -- Kuma CP modes: one of zone,global
40
  mode: "zone"
41

42
  # -- (string) Kuma CP zone, if running multizone
43
  zone:
44

45
  # -- Only used in `zone` mode
46
  kdsGlobalAddress: ""
47

48
  # -- Number of replicas of the Kuma CP. Ignored when autoscaling is enabled
49
  replicas: 1
50

51
  # -- Minimum number of seconds for which a newly created pod should be ready for it to be considered available.
52
  minReadySeconds: 0
53

54
  # -- Annotations applied only to the `Deployment` resource
55
  deploymentAnnotations: {}
56

57
  # -- Annotations applied only to the `Pod` resource
58
  podAnnotations: {}
59

60
  # Horizontal Pod Autoscaling configuration
61
  autoscaling:
62
    # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
63
    enabled: false
64

65
    # -- The minimum CP pods to allow
66
    minReplicas: 2
67
    # -- The max CP pods to scale to
68
    maxReplicas: 5
69

70
    # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
71
    targetCPUUtilizationPercentage: 80
72
    # -- For clusters that do support autoscaling/v2, use metrics
73
    metrics:
74
      - type: Resource
75
        resource:
76
          name: cpu
77
          target:
78
            type: Utilization
79
            averageUtilization: 80
80

81
  # -- Node selector for the Kuma Control Plane pods
82
  nodeSelector:
83
    kubernetes.io/os: linux
84

85
  # -- Tolerations for the Kuma Control Plane pods
86
  tolerations: []
87

88
  podDisruptionBudget:
89
    # -- Whether to create a pod disruption budget
90
    enabled: false
91
    # -- The maximum number of unavailable pods allowed by the budget
92
    maxUnavailable: 1
93

94
  # -- Affinity placement rule for the Kuma Control Plane pods.
95
  # This is rendered as a template, so you can reference other helm variables or includes.
96
  affinity:
97
    podAntiAffinity:
98
      preferredDuringSchedulingIgnoredDuringExecution:
99
      - weight: 100
100
        podAffinityTerm:
101
          labelSelector:
102
            # These match the selector labels used on the deployment.
103
            matchExpressions:
104
              - key: app.kubernetes.io/name
105
                operator: In
106
                values:
107
                  - '{{ include "kuma.name" . }}'
108
              - key: app.kubernetes.io/instance
109
                operator: In
110
                values:
111
                  - '{{ .Release.Name }}'
112
              - key: app
113
                operator: In
114
                values:
115
                  - '{{ include "kuma.name" . }}-control-plane'
116
          topologyKey: kubernetes.io/hostname
117

118
  # -- Topology spread constraints rule for the Kuma Control Plane pods.
119
  # This is rendered as a template, so you can use variables to generate match labels.
120
  topologySpreadConstraints:
121

122
  # -- Failure policy of the mutating webhook implemented by the Kuma Injector component
123
  injectorFailurePolicy: Fail
124

125
  service:
126
    apiServer:
127
      http:
128
        # -- Port on which Http api server Service is exposed on Node for service of type NodePort
129
        nodePort: 30681
130
      https:
131
        # -- Port on which Https api server Service is exposed on Node for service of type NodePort
132
        nodePort: 30682
133

134
    # -- Whether to create a service resource.
135
    enabled: true
136

137
    # -- (string) Optionally override of the Kuma Control Plane Service's name
138
    name:
139

140
    # -- Service type of the Kuma Control Plane
141
    type: ClusterIP
142

143
    # -- Annotations to put on the Kuma Control Plane
144
    annotations:
145
      prometheus.io/scrape: "true"
146
      prometheus.io/port: "5680"
147

148
  # Kuma API and GUI ingress settings. Useful if you want to expose the
149
  # API and GUI of Kuma outside the k8s cluster.
150
  ingress:
151
    # -- Install K8s Ingress resource that exposes GUI and API
152
    enabled: false
153
    # -- IngressClass defines which controller will implement the resource
154
    ingressClassName:
155
    # -- Ingress hostname
156
    hostname:
157
    # -- Map of ingress annotations.
158
    annotations: {}
159
    # -- Ingress path.
160
    path: /
161
    # -- Each path in an Ingress is required to have a corresponding path type. (ImplementationSpecific/Exact/Prefix)
162
    pathType: ImplementationSpecific
163
    # -- Port from kuma-cp to use to expose API and GUI. Switch to 5682 to expose TLS port
164
    servicePort: 5681
165

166
  globalZoneSyncService:
167
    # -- Whether to create a k8s service for the global zone sync
168
    # service. It will only be created when enabled and deploying the global
169
    # control plane.
170
    enabled: true
171
    # -- Service type of the Global-zone sync
172
    type: LoadBalancer
173
    # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
174
    loadBalancerIP:
175
    # -- Optionally specify allowed source ranges that can access the load balancer
176
    loadBalancerSourceRanges: []
177
    # -- Additional annotations to put on the Global Zone Sync Service
178
    annotations: { }
179
    # -- Port on which Global Zone Sync Service is exposed on Node for service of type NodePort
180
    nodePort: 30685
181
    # -- Port on which Global Zone Sync Service is exposed
182
    port: 5685
183
    # -- Protocol of the Global Zone Sync service port
184
    protocol: grpc
185

186
  defaults:
187
    # -- Whether to skip creating the default Mesh
188
    skipMeshCreation: false
189

190
  # -- Whether to automountServiceAccountToken for cp. Optionally set to false
191
  automountServiceAccountToken: true
192

193
  # -- Optionally override the resource spec
194
  resources:
195
    requests:
196
       cpu: 500m
197
       memory: 256Mi
198
    limits:
199
       memory: 256Mi
200

201
  # -- Pod lifecycle settings (useful for adding a preStop hook, when
202
  # using AWS ALB or NLB)
203
  lifecycle: {}
204

205
  # -- Number of seconds to wait before force killing the pod. Make sure to
206
  # update this if you add a preStop hook.
207
  terminationGracePeriodSeconds: 30
208

209
  # TLS for various servers
210
  tls:
211
    general:
212
      # -- Secret that contains tls.crt, tls.key [and ca.crt when no
213
      # controlPlane.tls.general.caSecretName specified] for protecting
214
      # Kuma in-cluster communication
215
      secretName: ""
216
      # -- Secret that contains ca.crt that was used to sign cert for protecting
217
      # Kuma in-cluster communication (ca.crt present in this secret
218
      # have precedence over the one provided in the controlPlane.tls.general.secretName)
219
      caSecretName: ""
220
      # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
221
      caBundle: ""
222
    apiServer:
223
      # -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
224
      secretName: ""
225
      # -- Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS
226
      clientCertsSecretName: ""
227
    # - if not creating the global control plane, then do nothing
228
    # - if secretName is empty and create is false, then do nothing
229
    # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
230
    # - if secretName is empty and create is true, then create a secret with a default name and use it
231
    # - if secretName is non-empty and create is true, then create the secret using the provided name
232
    kdsGlobalServer:
233
      # -- Name of the K8s TLS Secret resource. If you set this and don't set
234
      # create=true, you have to create the secret manually.
235
      secretName: ""
236
      # -- Whether to create the TLS secret in helm.
237
      create: false
238
      # -- The TLS certificate to offer.
239
      cert: ""
240
      # -- The TLS key to use.
241
      key: ""
242
    # - if not creating the zonal control plane, then do nothing
243
    # - if secretName is empty and create is false, then do nothing
244
    # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
245
    # - if secretName is empty and create is true, then create a secret with a default name and use it
246
    # - if secretName is non-empty and create is true, then create the secret using the provided name
247
    kdsZoneClient:
248
      # -- Name of the K8s Secret resource that contains ca.crt which was
249
      # used to sign the certificate of KDS Global Server. If you set this
250
      # and don't set create=true, you have to create the secret manually.
251
      secretName: ""
252
      # -- Whether to create the TLS secret in helm.
253
      create: false
254
      # -- CA bundle that was used to sign the certificate of KDS Global Server.
255
      cert: ""
256
      # -- If true, TLS cert of the server is not verified.
257
      skipVerify: false
258

259
  # -- Annotations to add for Control Plane's Service Account
260
  serviceAccountAnnotations: { }
261

262
  image:
263
    # -- Kuma CP ImagePullPolicy
264
    pullPolicy: IfNotPresent
265
    # -- Kuma CP image repository
266
    repository: "kuma-cp"
267
    # -- Kuma CP Image tag. When not specified, the value is copied from global.tag
268
    tag:
269

270
  # -- (object with { Env: string, Secret: string, Key: string }) Secrets to add as environment variables,
271
  # where `Env` is the name of the env variable,
272
  # `Secret` is the name of the Secret,
273
  # and `Key` is the key of the Secret value to use
274
  secrets:
275
  #  someSecret:
276
  #    Secret: some-secret
277
  #    Key: secret_key
278
  #    Env: SOME_SECRET
279

280
  # -- Additional environment variables that will be passed to the control plane
281
  envVars: { }
282

283
  # -- Additional config maps to mount into the control plane, with optional inline values
284
  extraConfigMaps: [ ]
285
#    - name: extra-config
286
#      mountPath: /etc/extra-config
287
#      readOnly: true
288
#      values:
289
#        extra-config-key: |
290
#          extra-config-value
291

292
  # -- (object with { name: string, mountPath: string, readOnly: string }) Additional secrets to mount into the control plane,
293
  # where `Env` is the name of the env variable,
294
  # `Secret` is the name of the Secret,
295
  # and `Key` is the key of the Secret value to use
296
  extraSecrets:
297
  #  extraConfig:
298
  #    name: extra-config
299
  #    mountPath: /etc/extra-config
300
  #    readOnly: true
301

302
  webhooks:
303
    validator:
304
      # -- Additional rules to apply on Kuma validator webhook. Useful when building custom policy on top of Kuma.
305
      additionalRules: ""
306
    ownerReference:
307
      # -- Additional rules to apply on Kuma owner reference webhook. Useful when building custom policy on top of Kuma.
308
      additionalRules: ""
309

310
  # -- Specifies if the deployment should be started in hostNetwork mode.
311
  hostNetwork: false
312
  # -- Define a new server port for the admission controller. Recommended to set in combination with
313
  # hostNetwork to prevent multiple port bindings on the same port (like Calico in AWS EKS).
314
  admissionServerPort: 5443
315

316
  # -- Security context at the pod level for control plane.
317
  podSecurityContext:
318
    runAsNonRoot: true
319

320
  # -- Security context at the container level for control plane.
321
  containerSecurityContext:
322
    readOnlyRootFilesystem: true
323

324
cni:
325
  # -- Install Kuma with CNI instead of proxy init container
326
  enabled: false
327
  # -- Install CNI in chained mode
328
  chained: false
329
  # -- Set the CNI install directory
330
  netDir: /etc/cni/multus/net.d
331
  # -- Set the CNI bin directory
332
  binDir: /var/lib/cni/bin
333
  # -- Set the CNI configuration name
334
  confName: kuma-cni.conf
335
  # -- CNI log level: one of off,info,debug
336
  logLevel: info
337
  # -- Node Selector for the CNI pods
338
  nodeSelector:
339
    kubernetes.io/os: linux
340
  # -- Tolerations for the CNI pods
341
  tolerations: []
342
  # -- Additional pod annotations
343
  podAnnotations: { }
344
  # -- Set the CNI namespace
345
  namespace: kube-system
346

347
  image:
348
    # -- CNI image repository
349
    repository: "kuma-cni"
350
    # -- CNI image tag - defaults to .Chart.AppVersion
351
    tag:
352
    # -- CNI image pull policy
353
    imagePullPolicy: IfNotPresent
354

355
  # -- it's only useful in tests to trigger a possible race condition
356
  delayStartupSeconds: 0
357

358
  # -- use new CNI (experimental)
359
  experimental:
360
    imageEbpf:
361
      # -- CNI experimental eBPF image registry
362
      registry: "docker.io/kumahq"
363
      # -- CNI experimental eBPF image repository
364
      repository: "merbridge"
365
      # -- CNI experimental eBPF image tag
366
      tag: "0.8.5"
367

368
  resources:
369
    requests:
370
      cpu: 100m
371
      memory: 100Mi
372
    limits:
373
      memory: 100Mi
374

375
  # -- Security context at the pod level for cni
376
  podSecurityContext: {}
377

378
  # -- Security context at the container level for cni
379
  containerSecurityContext:
380
    readOnlyRootFilesystem: true
381
    runAsNonRoot: false
382
    runAsUser: 0
383
    runAsGroup: 0
384

385
dataPlane:
386
  # -- If true, then turn on CoreDNS query logging
387
  dnsLogging: false
388
  image:
389
    # -- The Kuma DP image repository
390
    repository: "kuma-dp"
391
    # -- Kuma DP ImagePullPolicy
392
    pullPolicy: IfNotPresent
393
    # -- Kuma DP Image Tag. When not specified, the value is copied from global.tag
394
    tag:
395

396
  initImage:
397
    # -- The Kuma DP init image repository
398
    repository: "kuma-init"
399
    # -- Kuma DP init image tag When not specified, the value is copied from global.tag
400
    tag:
401

402
ingress:
403
  # -- If true, it deploys Ingress for cross cluster communication
404
  enabled: false
405

406
  # -- Labels to add to resources, in addition to default labels
407
  extraLabels: {}
408

409
  # -- Time for which old listener will still be active as draining
410
  drainTime: 30s
411

412
  # -- Number of replicas of the Ingress. Ignored when autoscaling is enabled.
413
  replicas: 1
414

415
  # -- Log level for ingress (available values: off|info|debug)
416
  logLevel: info
417

418
  # -- Define the resources to allocate to mesh ingress
419
  resources:
420
    requests:
421
      cpu: 50m
422
      memory: 64Mi
423
    limits:
424
      cpu: 1000m
425
      memory: 512Mi
426

427
  # -- Pod lifecycle settings (useful for adding a preStop hook, when
428
  # using AWS ALB or NLB)
429
  lifecycle: {}
430

431
  # -- Number of seconds to wait before force killing the pod. Make sure to
432
  # update this if you add a preStop hook.
433
  terminationGracePeriodSeconds: 40
434

435
  # Horizontal Pod Autoscaling configuration
436
  autoscaling:
437
    # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
438
    enabled: false
439

440
    # -- The minimum CP pods to allow
441
    minReplicas: 2
442
    # -- The max CP pods to scale to
443
    maxReplicas: 5
444

445
    # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
446
    targetCPUUtilizationPercentage: 80
447
    # -- For clusters that do support autoscaling/v2, use metrics
448
    metrics:
449
      - type: Resource
450
        resource:
451
          name: cpu
452
          target:
453
            type: Utilization
454
            averageUtilization: 80
455

456
  service:
457
    # -- Whether to create a Service resource.
458
    enabled: true
459
    # -- Service type of the Ingress
460
    type: LoadBalancer
461
    # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
462
    loadBalancerIP:
463
    # -- Additional annotations to put on the Ingress service
464
    annotations: { }
465
    # -- Port on which Ingress is exposed
466
    port: 10001
467
    # -- Port on which service is exposed on Node for service of type NodePort
468
    nodePort:
469
  # -- Additional pod annotations (deprecated favor `podAnnotations`)
470
  annotations: { }
471
  # -- Additional pod annotations
472
  podAnnotations: { }
473
  # -- Node Selector for the Ingress pods
474
  nodeSelector:
475
    kubernetes.io/os: linux
476
  # -- Tolerations for the Ingress pods
477
  tolerations: []
478
  podDisruptionBudget:
479
    # -- Whether to create a pod disruption budget
480
    enabled: false
481
    # -- The maximum number of unavailable pods allowed by the budget
482
    maxUnavailable: 1
483

484
  # -- Affinity placement rule for the Kuma Ingress pods
485
  # This is rendered as a template, so you can reference other helm variables
486
  # or includes.
487
  affinity:
488
    podAntiAffinity:
489
      preferredDuringSchedulingIgnoredDuringExecution:
490
      - weight: 100
491
        podAffinityTerm:
492
          labelSelector:
493
            # These match the selector labels used on the deployment.
494
            matchExpressions:
495
              - key: app.kubernetes.io/name
496
                operator: In
497
                values:
498
                  - '{{ include "kuma.name" . }}'
499
              - key: app.kubernetes.io/instance
500
                operator: In
501
                values:
502
                  - '{{ .Release.Name }}'
503
              - key: app
504
                operator: In
505
                values:
506
                  - kuma-ingress
507
          topologyKey: kubernetes.io/hostname
508

509
  # -- Topology spread constraints rule for the Kuma Mesh Ingress pods.
510
  # This is rendered as a template, so you can use variables to generate match labels.
511
  topologySpreadConstraints:
512

513
  # -- Security context at the pod level for ingress
514
  podSecurityContext:
515
    runAsNonRoot: true
516
    runAsUser: 5678
517
    runAsGroup: 5678
518

519
  # -- Security context at the container level for ingress
520
  containerSecurityContext:
521
    readOnlyRootFilesystem: true
522

523
  # -- Annotations to add for Control Plane's Service Account
524
  serviceAccountAnnotations: { }
525
  # -- Whether to automountServiceAccountToken for cp. Optionally set to false
526
  automountServiceAccountToken: true
527

528
egress:
529
  # -- If true, it deploys Egress for cross cluster communication
530
  enabled: false
531
  # -- Labels to add to resources, in addition to the default labels.
532
  extraLabels: {}
533
  # -- Time for which old listener will still be active as draining
534
  drainTime: 30s
535
  # -- Number of replicas of the Egress. Ignored when autoscaling is enabled.
536
  replicas: 1
537

538
  # -- Log level for egress (available values: off|info|debug)
539
  logLevel: info
540

541
  # Horizontal Pod Autoscaling configuration
542
  autoscaling:
543
    # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
544
    enabled: false
545

546
    # -- The minimum CP pods to allow
547
    minReplicas: 2
548
    # -- The max CP pods to scale to
549
    maxReplicas: 5
550

551
    # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
552
    targetCPUUtilizationPercentage: 80
553
    # -- For clusters that do support autoscaling/v2, use metrics
554
    metrics:
555
      - type: Resource
556
        resource:
557
          name: cpu
558
          target:
559
            type: Utilization
560
            averageUtilization: 80
561
  resources:
562
    requests:
563
      cpu: 50m
564
      memory: 64Mi
565
    limits:
566
      cpu: 1000m
567
      memory: 512Mi
568

569
  service:
570
    # -- Whether to create the service object
571
    enabled: true
572
    # -- Service type of the Egress
573
    type: ClusterIP
574
    # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
575
    loadBalancerIP:
576
    # -- Additional annotations to put on the Egress service
577
    annotations: { }
578
    # -- Port on which Egress is exposed
579
    port: 10002
580
    # -- Port on which service is exposed on Node for service of type NodePort
581
    nodePort:
582
  # -- Additional pod annotations (deprecated favor `podAnnotations`)
583
  annotations: { }
584
  # -- Additional pod annotations
585
  podAnnotations: { }
586
  # -- Node Selector for the Egress pods
587
  nodeSelector:
588
    kubernetes.io/os: linux
589
  # -- Tolerations for the Egress pods
590
  tolerations: []
591
  podDisruptionBudget:
592
    # -- Whether to create a pod disruption budget
593
    enabled: false
594
    # -- The maximum number of unavailable pods allowed by the budget
595
    maxUnavailable: 1
596

597
  # -- Affinity placement rule for the Kuma Egress pods.
598
  # This is rendered as a template, so you can reference other helm variables or includes.
599
  affinity:
600
    podAntiAffinity:
601
      preferredDuringSchedulingIgnoredDuringExecution:
602
      - weight: 100
603
        podAffinityTerm:
604
          labelSelector:
605
            # These match the selector labels used on the deployment.
606
            matchExpressions:
607
              - key: app.kubernetes.io/name
608
                operator: In
609
                values:
610
                  - '{{ include "kuma.name" . }}'
611
              - key: app.kubernetes.io/instance
612
                operator: In
613
                values:
614
                  - '{{ .Release.Name }}'
615
              - key: app
616
                operator: In
617
                values:
618
                  - kuma-egress
619
          topologyKey: kubernetes.io/hostname
620

621
  # -- Topology spread constraints rule for the Kuma Egress pods.
622
  # This is rendered as a template, so you can use variables to generate match labels.
623
  topologySpreadConstraints:
624

625
  # -- Security context at the pod level for egress
626
  podSecurityContext:
627
    runAsNonRoot: true
628
    runAsUser: 5678
629
    runAsGroup: 5678
630

631
  # -- Security context at the container level for egress
632
  containerSecurityContext:
633
    readOnlyRootFilesystem: true
634

635
  # -- Annotations to add for Control Plane's Service Account
636
  serviceAccountAnnotations: { }
637
  # -- Whether to automountServiceAccountToken for cp. Optionally set to false
638
  automountServiceAccountToken: true
639

640
kumactl:
641
  image:
642
    # -- The kumactl image repository
643
    repository: kumactl
644
    # -- The kumactl image tag. When not specified, the value is copied from global.tag
645
    tag:
646

647
kubectl:
648
  image:
649
    # -- The kubectl image registry
650
    registry: docker.io
651
    # -- The kubectl image repository
652
    repository: bitnami/kubectl
653
    # -- The kubectl image tag
654
    tag: "1.27.5"
655
hooks:
656
  # -- Node selector for the HELM hooks
657
  nodeSelector:
658
    kubernetes.io/os: linux
659
  # -- Tolerations for the HELM hooks
660
  tolerations: []
661
  # -- Security context at the pod level for crd/webhook/ns
662
  podSecurityContext:
663
    runAsNonRoot: true
664

665
  # -- Security context at the container level for crd/webhook/ns
666
  containerSecurityContext:
667
    readOnlyRootFilesystem: true
668

669
  # -- ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs
670
  # Changing below values will potentially break ebpf cleanup completely,
671
  # so be cautious when doing so.
672
  ebpfCleanup:
673
    # -- Security context at the pod level for crd/webhook/cleanup-ebpf
674
    podSecurityContext:
675
      runAsNonRoot: false
676
    # -- Security context at the container level for crd/webhook/cleanup-ebpf
677
    containerSecurityContext:
678
      readOnlyRootFilesystem: false
679

680
experimental:
681
  # -- If true, it installs experimental Gateway API support
682
  gatewayAPI: false
683
  # Configuration for the experimental ebpf mode for transparent proxy
684
  ebpf:
685
    # -- If true, ebpf will be used instead of using iptables to install/configure transparent proxy
686
    enabled: false
687
    # -- Name of the environmental variable which will contain the IP address of a pod
688
    instanceIPEnvVarName: INSTANCE_IP
689
    # -- Path where BPF file system should be mounted
690
    bpffsPath: /sys/fs/bpf
691
    # -- Host's cgroup2 path
692
    cgroupPath: /sys/fs/cgroup
693
    # -- Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty
694
    tcAttachIface: ""
695
    # -- Path where compiled eBPF programs which will be installed can be found
696
    programsSourcePath: /kuma/ebpf
697
  # -- If false, it uses legacy API for resource synchronization
698
  deltaKds: true
699

700
# Postgres' settings for universal control plane on k8s
701
postgres:
702
  # -- Postgres port, password should be provided as a secret reference in "controlPlane.secrets"
703
  # with the Env value "KUMA_STORE_POSTGRES_PASSWORD".
704
  # Example:
705
  # controlPlane:
706
  #   secrets:
707
  #     - Secret: postgres-postgresql
708
  #       Key: postgresql-password
709
  #       Env: KUMA_STORE_POSTGRES_PASSWORD
710
  port: "5432"
711
  # TLS settings
712
  tls:
713
    # -- Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
714
    mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
715
    # -- Whether to disable SNI the postgres `sslsni` option.
716
    disableSSLSNI: false # ENV: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
717
    # -- Secret name that contains the ca.crt
718
    caSecretName:
719
    # -- Secret name that contains the client tls.crt, tls.key
720
    secretName:
721

722
# @ignored for helm-docs
723
plugins:
724
  policies:
725
    meshaccesslogs: true
726
    meshcircuitbreakers: true
727
    meshfaultinjections: true
728
    meshhealthchecks: true
729
    meshhttproutes: true
730
    meshloadbalancingstrategies: true
731
    meshmetrics: true
732
    meshproxypatches: true
733
    meshratelimits: true
734
    meshretries: true
735
    meshtcproutes: true
736
    meshtimeouts: true
737
    meshtraces: true
738
    meshtrafficpermissions: true
739