stable/dex/values.yaml - master - githubmirror/charts

stable/dex/values.yaml
277 строк7 KB
Bruno Galindro da Costa
[stable/dex] Add tolerations, affinity and nodeSelector to grpc-certs/web-certs jobs (#23873)
18 окт 2020, 15:38
18 окт 2020, 15:386ef2307
# Default values for dex
# This is a YAML-formatted file.
# Declare name/value pairs to be passed into your templates.
# name: value

image: quay.io/dexidp/dex
imageTag: "v2.24.0"
imagePullPolicy: "IfNotPresent"
imagePullSecrets: {}

inMiniKube: false

nodeSelector: {}

podLabels: {}

podAnnotations: {}

priorityClassName: ""

initContainers: []

tolerations: []
  # - key: CriticalAddonsOnly
  #   operator: Exists
  # - key: foo
  #   operator: Equal
  #   value: bar
  #   effect: NoSchedule

securityContext:
  # Rejecting containers trying to run with root privileges
  # runAsNonRoot: true
  # Preventing privilege escalation to root privileges
  # allowPrivilegeEscalation: false
  # Set the user ID used to run the container
  # runAsUser: 1001
  # Set the primary group ID used to run all processes within any container of the pod
  # runAsGroup: 1001
  # Set the group ID associated with the container
  # fsGroup: 1001

replicas: 1

# resources:
  # limits:
    # cpu: 100m
    # memory: 50Mi
  # requests:
    # cpu: 100m
    # memory: 50Mi

# grpc support
grpc: true

# https termination by dex itself
https: false

# expose prometheus metrics ?
telemetry: false

ports:
  web:
    containerPort: 5556
    # for service.type: NodePort
    nodePort: 32000
    servicePort: 32000
# Relevant only when grpc support is enabled
  grpc:
    containerPort: 5000
    # for service.type: NodePort
    nodePort: 35000
    servicePort: 35000
  telemetry:
    containerPort: 5558
    # for service.type: NodePort
    nodePort: 37000
    servicePort: 37000

livenessProbe:
  enabled: true
  initialDelaySeconds: 1
  failureThreshold: 1
  httpPath: "/healthz"
  periodSeconds: 10
  timeoutSeconds: 1

readinessProbe:
  enabled: true
  initialDelaySeconds: 1
  failureThreshold: 1
  httpPath: "/healthz"
  periodSeconds: 10
  timeoutSeconds: 1

service:
  type: ClusterIP
  # Override IP for the Service Type: LoadBalancer.
  # This feature depends on whether the underlying cloud-provider supports specifying the loadBalancerIP when a load balancer is created.
  # loadBalancerIP: 127.0.0.1
  annotations: {}

ingress:
  enabled: false
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  path: /
  hosts:
    - dex.example.com
  tls: []
  #  - secretName: dex-example-tls
  #    hosts:
  #      - dex.example.com

extraVolumes: []
extraVolumeMounts: []

certs:
  securityContext:
    enabled: true
    runAsUser: 65534
    fsGroup: 65534
  image: gcr.io/google_containers/kubernetes-dashboard-init-amd64
  imageTag: "v1.0.0"
  imagePullPolicy: "IfNotPresent"
  # Section below is relevant only when https termination is enabled
  web:
    create: true
    activeDeadlineSeconds: 300
    caDays: 10000
    certDays: 10000
    altNames:
      - dex.example.com
    altIPs: {}
    secret:
      tlsName: dex-web-server-tls
      caName: dex-web-server-ca
    pod:
      annotations: {}
      nodeSelector: {}
      tolerations: []
        # - key: CriticalAddonsOnly
        #   operator: Exists
        # - key: foo
        #   operator: Equal
        #   value: bar
        #   effect: NoSchedule
      affinity: {}
        # podAntiAffinity:
        #   preferredDuringSchedulingIgnoredDuringExecution:
        #   - weight: 5
        #     podAffinityTerm:
        #       topologyKey: "kubernetes.io/hostname"
        #       labelSelector:
        #         matchLabels:
        #           app: {{ template "dex.name" . }}
        #           release: "{{ .Release.Name }}"
  # Section below is relevant only when grpc support is enabled
  grpc:
    create: true
    activeDeadlineSeconds: 300
    altNames:
      - dex.example.com
    altIPs: {}
    secret:
      serverTlsName: dex-grpc-server-tls
      clientTlsName: dex-grpc-client-tls
      caName: dex-grpc-ca
    pod:
      annotations: {}
      nodeSelector: {}
      tolerations: []
        # - key: CriticalAddonsOnly
        #   operator: Exists
        # - key: foo
        #   operator: Equal
        #   value: bar
        #   effect: NoSchedule
      affinity: {}
        # podAntiAffinity:
        #   preferredDuringSchedulingIgnoredDuringExecution:
        #   - weight: 5
        #     podAffinityTerm:
        #       topologyKey: "kubernetes.io/hostname"
        #       labelSelector:
        #         matchLabels:
        #           app: {{ template "dex.name" . }}
        #           release: "{{ .Release.Name }}"

env: []

rbac:
  # Specifies whether RBAC resources should be created
  create: true

crd:
  # Specifies whether dex's CRDs are already present (if not cluster role and cluster role binding will be created
  # to enable dex to create them). Depends on rbac.create
  present: false

serviceAccount:
  # Specifies whether a ServiceAccount should be created
  create: true
  # The name of the ServiceAccount to use.
  # If not set and create is true, a name is generated using the fullname template
  name:

affinity: {}
  # podAntiAffinity:
  #   preferredDuringSchedulingIgnoredDuringExecution:
  #   - weight: 5
  #     podAffinityTerm:
  #       topologyKey: "kubernetes.io/hostname"
  #       labelSelector:
  #         matchLabels:
  #           app: {{ template "dex.name" . }}
  #           release: "{{ .Release.Name }}"

podDisruptionBudget: {}
  # maxUnavailable: 1

config:
  issuer: http://dex.example.com:8080
  storage:
    type: kubernetes
    config:
      inCluster: true
  logger:
    level: debug
  web:
    # port is taken from ports section above
    address: 0.0.0.0
    tlsCert: /etc/dex/tls/https/server/tls.crt
    tlsKey: /etc/dex/tls/https/server/tls.key
    allowedOrigins: []
# Section below is relevant only when grpc support is enabled
  grpc:
    # port is taken from ports section above
    address: 127.0.0.1
    tlsCert: /etc/dex/tls/grpc/server/tls.crt
    tlsKey: /etc/dex/tls/grpc/server/tls.key
    tlsClientCA: /etc/dex/tls/grpc/ca/tls.crt
  connectors: []
#  - type: github
#    id: github
#    name: GitHub
#    config:
#      clientID: xxxxxxxxxxxxxxx
#      clientSecret: yyyyyyyyyyyyyyyyyyyyy
#      redirectURI: https://dex.minikube.local:5556/callback
#      org: kubernetes
  oauth2:
    alwaysShowLoginScreen: false
    skipApprovalScreen: true

#  expiry:
#    signingKeys: "6h"
#    idTokens: "24h"

#  staticClients:
#  - id: example-app
#    redirectURIs:
#    - 'http://192.168.42.219:31850/oauth2/callback'
#    name: 'Example App'
#    secret: ZXhhbXBsZS1hcHAtc2VjcmV0
#
  enablePasswordDB: true
#  staticPasswords:
#   - email: "admin@example.com"
#     # bcrypt hash of the string "password"
#     hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
#     username: "admin"
#     userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

# frontend:
#   logoURL: https://example.com/yourlogo.png