stable/graylog/values.yaml - master - githubmirror/charts

stable/graylog/values.yaml
399 строк12 KB
Volodymyr Linevych
[stable/graylog] provisioner job hook (#23468)
10 авг 2020, 10:50
10 авг 2020, 10:50cf6d6c4
# Default values for Graylog.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

rbac:
  # Specifies whether RBAC resources should be created
  ##
  create: true

  resources:
    - pods
    - secrets

serviceAccount:
  # Specifies whether a ServiceAccount should be created
  ##
  create: true
  # The name of the ServiceAccount to use.
  # If not set and create is true, a name is generated using the fullname template
  ##
  name:

tags:
  # If true, this chart will install Elasticsearch from requirement dependencies
  install-elasticsearch: true
  # If true, this chart will install MongoDB replicaset from requirement dependencies
  install-mongodb: true

## Enable only if your current release was migrated from helm2 (using 2to3 plugin).
##
## Because Kubernetes considers some StatefulSets fields/labels immutable,
## this flag preserves the values rendered by helm2. This allows helm3
## to upgrade the current release without a complete purge/reinstall.
##
## Further details: https://github.com/helm/charts/issues/20306
##
# helm2Compatibility: true

graylog:
  ## Graylog image version
  ## Ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
  ##
  ## Important note: Official Graylog Docker image may replace the existing Docker image tags and cause some corrupt when starting the pod.
  ## Make sure you strict with the `x` version of Graylog where `x` is ${version}-${x}
  ##
  image:
    repository: "graylog/graylog:3.1"
    pullPolicy: "IfNotPresent"

  ## Number of Graylog instance
  ##
  replicas: 2

  ## Additional environment variables to be added to Graylog pods
  ##
  env: {}

  ## Additional environment variables in raw yaml format
  ## - name: POD_IP
  ##   valueFrom:
  ##     fieldRef:
  ##       fieldPath: status.podIP
  ## - name: SERVICE_8000_NAME
  ##   value: servicename
  envRaw: {}

  ## Run as privileged container
  ##
  privileged: false

  ## Pod affinity
  ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  ##
  affinity: {}

  ## Node tolerations for node-exporter scheduling to nodes with taints
  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
  ##
  tolerations: []
    # - key: "key"
    #   operator: "Equal|Exists"
    #   value: "value"
    #   effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"

  ## Node labels for node-exporter pod assignment
  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
  ##
  nodeSelector: {}

  ## Annotations to be added to Graylog pods
  ##
  podAnnotations: {}

  persistence:
    ## If true, Graylog will create/use a Persistent Volume Claim
    ## If false, use emptyDir
    ##
    enabled: true
    ## Graylog data Persistent Volume access modes
    ## Must match those of existing PV or dynamic provisioner
    ## Ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
    ##
    accessMode: ReadWriteOnce
    ## Graylog data Persistent Volume size
    ##
    size: "20Gi"
    ## Graylog data Persistent Volume Storage Class
    ## If defined, storageClassName: <storageClass>
    ## If set to "-", storageClassName: "", which disables dynamic provisioning
    ## If undefined (the default) or set to null, no storageClassName spec is
    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
    ##   GKE, AWS & OpenStack)
    ##
    # storageClass: "ssd"

  ## Additional plugins you need to install on Graylog.
  ##
  plugins: []
    # - name: graylog-plugin-slack-notification-3.1.0.jar
    #   url: https://github.com/omise/graylog-plugin-slack-notification/releases/download/v3.1.0/graylog-plugin-slack-notification-3.1.0.jar
    # - name: graylog-plugin-function-check-diff-1.0.0.jar
    #   url: https://github.com/omise/graylog-plugin-function-check-diff/releases/download/1.0.0/graylog-plugin-function-check-diff-1.0.0.jar
    # - name: graylog-plugin-auth-sso-3.0.0.jar
    #   url: https://github.com/Graylog2/graylog-plugin-auth-sso/releases/download/3.0.0/graylog-plugin-auth-sso-3.0.0.jar

  ## Sidecar containers
  ##
  sidecarContainers: []

  ## Additional init containers
  ##
  extraInitContainers: []

  ## Additional volume mounts
  ##
  extraVolumeMounts: []

  ## Additional volumes
  ##
  extraVolumes: []

  ## A service for Graylog web interface
  ##
  service:
    type: ClusterIP
    port: 9000
    ## Add additional ports for the service/statefulset to expose
    ##
    ports: []

    headless:
      ## Add suffix to headless service name
      ##
      suffix: ""

    master:
      ## Enable Graylog master service
      ##
      enabled: true
      ## Graylog master service Ingress annotations
      ##
      annotations: {}
      ## Graylog master service port.
      ##
      port: 9000

  ## Additional input ports for receiving logs from servers
  ## Note: Name must be in IANA_SVC_NAME (at most 15 characters, matching regex [a-z0-9]([a-z0-9-]*[a-z0-9])* and it must contains at least one letter [a-z], hyphens cannot be adjacent to other hyphens)
  ## Note: Array must be sorted by port order
  ##
  input: {}
    # tcp:
    #   service:
    #     type: LoadBalancer
    #     loadBalancerIP:
    #   ports:
    #     - name: gelf
    #       port: 12222
    # udp:
    #   service:
    #     type: ClusterIP
    #   ports:
    #     - name: syslog
    #       port: 12222

  tls:
    ## If true, Graylog server will run with TLS enabled
    ##
    enabled: false
    ## TLS certificate key file
    ##
    keyFile: /etc/graylog/server/server.key
    ## TLS certificate file
    ##
    certFile: /etc/graylog/server/server.cert

  ## External URL to access Graylog at
  ##
  externalUri: ""

  ingress:
    ## If true, Graylog server Ingress will be created
    ##
    enabled: false
    ## Graylog server Ingress annotations
    ##
    annotations: {}
    ## Graylog server Ingress hostnames with optional path
    ## Must be provided if Ingress is enabled
    ## Note: Graylog does not support two URL. You can specify only single URL
    ##
    hosts: []
    #   - graylog.yourdomain.com

    ## Extra paths to prepend to every host configuration. This is useful when working with annotation based services.
    extraPaths: []
    # - path: /*
    #   backend:
    #     serviceName: ssl-redirect
    #     servicePort: use-annotation

    ## Graylog server Ingress TLS configuration
    ## Secrets must be manually created in the namespace
    ##
    tls: []
    #   - secretName: graylog-server-tls
    #     hosts:
    #       - graylog.yourdomain.com


  ## Configure resource requests and limits
  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
  ##
  resources:
    limits:
      cpu: "1"
    requests:
      cpu: "500m"
      memory: "1024Mi"

  ## Set Graylog Java heapsize. If this value empty, chart will allocate heapsize using `-XX:+UseCGroupMemoryLimitForHeap`
  ## ref: https://blogs.oracle.com/java-platform-group/java-se-support-for-docker-cpu-and-memory-limits
  ##
  # heapSize: "1024g"

  ## RollingUpdate update strategy
  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
  ##
  updateStrategy: RollingUpdate
  ## Graylog server pod termination grace period
  ##
  terminationGracePeriodSeconds: 120

  metrics:
    ## If true, prometheus annotations will be attached
    ##
    enabled: false

  geoip:
    ## If true, Maxmind GeoLite2 will be installed to ${GRAYLOG_HOME}/geoip location
    ##
    enabled: false
    ## If true, mmdbUri points to the URI where to find the DB
    # https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/
    mmdbUri: ""

  ## Graylog root user name
  ##
  rootUsername: "admin"

  ## Graylog root password
  ## Defaults to a random 16-character alphanumeric string if not set
  ##
  # rootPassword: ""

  ## Graylog root email
  ##
  rootEmail: ""

  ## Graylog root timezone
  ##
  rootTimezone: "UTC"

  ## Grayog existing root secret
  ##
  existingRootSecret: ""

  elasticsearch:
    ## List of Elasticsearch hosts Graylog should connect to.
    ## Need to be specified as a comma-separated list of valid URIs for the http ports of your elasticsearch nodes.
    ## If one or more of your elasticsearch hosts require authentication, include the credentials in each node URI that
    ## requires authentication.
    ##
    # hosts: http://elasticsearch-client.graylog.svc.cluster.local:9200
    hosts: ""
    # Allow elasticsearch hosts to be fetched from a k8s secret
    # {{ graylog.fullname }}-es will be used as uriSecretName if left empty
    uriSecretName: ""
    uriSecretKey: ""
    uriSSL: false

  mongodb:
    ## MongoDB connection string
    ## See https://docs.mongodb.com/manual/reference/connection-string/ for details
    # uri: mongodb://user:pass@host1:27017,host2:27017,host3:27017/graylog?replicaSet=rs01
    uri: ""
    # Allow mongodb uri to be fetched from a k8s secret
    # {{ graylog.fullname }}-mongodb will be used as uriSecretName if left empty
    uriSecretName: ""
    uriSecretKey: ""

    ## Increase this value according to the maximum connections your MongoDB server can handle from a single client
    ## if you encounter MongoDB connection problems.
    ##
    maxConnections: 1000

  transportEmail:
    ## If true, enable Email transport.
    ## See http://docs.graylog.org/en/3.0/pages/configuration/server.conf.html#email for detail
    ##
    enabled: false
    hostname: ""
    port: 2587
    useAuth: true
    useTls: true
    useSsl: false
    authUsername: ""
    authPassword: ""
    subjectPrefix: "[graylog]"
    fromEmail: ""

  ## Additional graylog config which is defined on `graylog.conf`.
  ## You can find a complete list of graylog config from http://docs.graylog.org/en/3.0/pages/configuration/server.conf.html
  ## Graylog config is written in Java properites format. Make sure you write it correctly.
  ##
  # config: |
  #   elasticsearch_connect_timeout = 10s
  #   elasticsearch_socket_timeout = 60s
  #   elasticsearch_idle_timeout = -1s

  journal:
    ## Sometime Graylog journal continually grow up or corrupt and cause Graylog unable to start.
    ## You need to clean up all journal files in order to run the Graylog.
    ## Change `graylog.journal.deleteBeforeStart` to `true` to delete all journal files before start
    ## Note: All uncommitted logs will be permanently DELETED when this value is true
    ##
    deleteBeforeStart: false

  init:
    # Additional environment variables to be added to Graylog initContainer
    env: {}

    # Configure resource requests and limits for the Graylog StatefulSet initContainer
    resources: {}

  ## Additional server files will be deployed to /etc/graylog/server
  ## For example, you can put server certificates or authorized clients certificates here
  ##
  serverFiles: {}
    # server.key: |
    # server.cert: |

  ## Configure whether Graylog pods should log in JSON (one event per line)
  logInJson: false

  ## Specify a Bash script to run as Kubernetes Job (running on Alpine with curl and bash packages already installed).
  ## Useful for calling the API to pre-configure some aspect of Graylog, as in the example.
  ##
  provisioner:
    enabled: false
    annotations: {}
    useGraylogServiceAccount: false
    # script: |
    #  json='{
    #    "username_header": "X-Auth-Request-User",
    #    "fullname_header": "X-Auth-Request-User",
    #    "email_header": "X-Auth-Request-Email",
    #    "default_group": "Admin",
    #    "auto_create_user": true,
    #    "require_trusted_proxies": true,
    #    "trusted_proxies": "0.0.0.0/0",
    #    "default_email_domain": "mydomain.com",
    #    "sync_roles": false,
    #    "roles_header": "Roles"
    #  }'
    #  curl -v -u "admin:$GRAYLOG_PASSWORD_SECRET" -X PUT --header 'Content-Type: application/json' --header 'X-Requested-By: localhost' --data-binary "${json}" http://graylog-master:9000/api/plugins/org.graylog.plugins.auth.sso/config
## Specify image pull secrets used in the deployment
imagePullSecrets: []
## imagePullSecrets:
##   - name: some-registry
##   - name: another-registry
## Specify Elasticsearch version from requirement dependencies. Ignore this seection if you install Elasticsearch manually.
## Note: Graylog 2.4 requires Elasticsearch version <= 5.6
elasticsearch:
  image:
    repository: "docker.elastic.co/elasticsearch/elasticsearch-oss"
    tag: "6.5.4"
  cluster:
    xpackEnable: false