You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1290 lines
53 KiB
1290 lines
53 KiB
# Available parameters and their default values for the Consul chart.
|
|
|
|
# global holds values that affect multiple components of the chart.
|
|
global:
|
|
# enabled is the master enabled/disabled setting.
|
|
# If true, servers, clients, Consul DNS and the Consul UI will be enabled.
|
|
# Each component can override this default via its component-specific
|
|
# "enabled" config.
|
|
# If false, no components will be installed by default and per-component
|
|
# opt-in is required, such as by setting `server.enabled` to true.
|
|
enabled: true
|
|
|
|
# name sets the prefix used for all resources in the helm chart.
|
|
# If not set, the prefix will be "<helm release name>-consul".
|
|
name: null
|
|
|
|
# domain is the domain Consul will answer DNS queries for
|
|
# (see https://www.consul.io/docs/agent/options.html#_domain) and the domain
|
|
# services synced from Consul into Kubernetes will have,
|
|
# e.g. `service-name.service.consul`.
|
|
domain: consul
|
|
|
|
# image is the name (and tag) of the Consul Docker image for clients and
|
|
# servers. This can be overridden per component.
|
|
# This should be pinned to a specific version tag, otherwise you may
|
|
# inadvertently upgrade your Consul version.
|
|
#
|
|
# Examples:
|
|
# # Consul 1.5.0
|
|
# image: "consul:1.5.0"
|
|
# # Consul Enterprise 1.5.0
|
|
# image: "hashicorp/consul-enterprise:1.5.0-ent"
|
|
image: "consul:1.8.0"
|
|
|
|
# array of objects containing image pull secret names that will be applied to
|
|
# each service account.
|
|
# This can be used to reference image pull secrets if using
|
|
# a custom consul or consul-k8s Docker image.
|
|
# See https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry.
|
|
#
|
|
# Example:
|
|
# imagePullSecrets:
|
|
# - name: pull-secret-name
|
|
# - name: pull-secret-name-2
|
|
imagePullSecrets: []
|
|
|
|
# imageK8S is the name (and tag) of the consul-k8s Docker image that
|
|
# is used for functionality such as catalog sync. This can be overridden
|
|
# per component.
|
|
# Note: support for the catalog sync's liveness and readiness probes was added
|
|
# to consul-k8s 0.6.0. If using an older consul-k8s version, you may need to
|
|
# remove these checks to make the sync work.
|
|
# If using acls.manageSystemACLs then must be >= 0.10.1.
|
|
# If using connect inject then must be >= 0.10.1.
|
|
# If using Consul Enterprise namespaces, must be >= 0.12.
|
|
imageK8S: "hashicorp/consul-k8s:0.16.0"
|
|
|
|
# imageEnvoy defines the default envoy image to use for ingress and
|
|
# terminating gateways.
|
|
imageEnvoy: "envoyproxy/envoy-alpine:v1.14.2"
|
|
|
|
# datacenter is the name of the datacenter that the agents should register
|
|
# as. This can't be changed once the Consul cluster is up and running
|
|
# since Consul doesn't support an automatic way to change this value
|
|
# currently: https://github.com/hashicorp/consul/issues/1858.
|
|
datacenter: dc1
|
|
|
|
# enablePodSecurityPolicies controls whether pod
|
|
# security policies are created for the Consul components created by this
|
|
# chart. See https://kubernetes.io/docs/concepts/policy/pod-security-policy/.
|
|
enablePodSecurityPolicies: false
|
|
|
|
# gossipEncryption configures which Kubernetes secret to retrieve Consul's
|
|
# gossip encryption key from (see https://www.consul.io/docs/agent/options.html#_encrypt).
|
|
# If secretName or secretKey are not set, gossip encryption will not be enabled.
|
|
# The secret must be in the same namespace that Consul is installed into.
|
|
#
|
|
# The secret can be created by running:
|
|
# kubectl create secret generic consul-gossip-encryption-key \
|
|
# --from-literal=key=$(consul keygen).
|
|
#
|
|
# In this case, secretName would be "consul-gossip-encryption-key" and
|
|
# secretKey would be "key".
|
|
gossipEncryption:
|
|
# secretName is the name of the Kubernetes secret that holds the gossip
|
|
# encryption key. The secret must be in the same namespace that Consul is installed into.
|
|
secretName: ""
|
|
# secretKey is the key within the Kubernetes secret that holds the gossip
|
|
# encryption key.
|
|
secretKey: ""
|
|
|
|
# Enables TLS encryption across the cluster to verify authenticity of the
|
|
# servers and clients that connect. Note: It is HIGHLY recommended that you also
|
|
# enable Gossip encryption.
|
|
# See https://learn.hashicorp.com/consul/security-networking/agent-encryption
|
|
#
|
|
# Note: this relies on functionality introduced with Consul 1.4.1. Make sure
|
|
# your global.image value is at least version 1.4.1.
|
|
tls:
|
|
enabled: false
|
|
|
|
# enableAutoEncrypt turns on the auto-encrypt feature on
|
|
# clients and servers.
|
|
# It also switches consul-k8s components to retrieve the CA
|
|
# from the servers via the API.
|
|
# Requires Consul 1.7.1+ and consul-k8s 0.13.0
|
|
enableAutoEncrypt: false
|
|
|
|
# serverAdditionalDNSSANs is a list of additional DNS names to
|
|
# set as Subject Alternative Names (SANs) in the server certificate.
|
|
# This is useful when you need to access the Consul server(s) externally,
|
|
# for example, if you're using the UI.
|
|
serverAdditionalDNSSANs: []
|
|
|
|
# serverAdditionalIPSANs is a list of additional IP addresses to
|
|
# set as Subject Alternative Names (SANs) in the server certificate.
|
|
# This is useful when you need to access Consul server(s) externally,
|
|
# for example, if you're using the UI.
|
|
serverAdditionalIPSANs: []
|
|
|
|
# If verify is true, 'verify_outgoing', 'verify_server_hostname', and
|
|
# 'verify_incoming_rpc' will be set to true for Consul servers and clients.
|
|
# Set this to false to incrementally roll out TLS on an existing Consul cluster.
|
|
# Note: remember to switch it back to true once the rollout is complete.
|
|
# Please see this guide for more details:
|
|
# https://learn.hashicorp.com/consul/security-networking/certificates
|
|
verify: true
|
|
|
|
# If httpsOnly is true, Consul will disable the HTTP port on both
|
|
# clients and servers and only accept HTTPS connections.
|
|
httpsOnly: true
|
|
|
|
# caCert is a Kubernetes secret containing the certificate
|
|
# of the CA to use for TLS communication within the Consul cluster.
|
|
# If you have generated the CA yourself with the consul CLI,
|
|
# you could use the following command to create the secret in Kubernetes:
|
|
#
|
|
# kubectl create secret generic consul-ca-cert \
|
|
# --from-file='tls.crt=./consul-agent-ca.pem'
|
|
caCert:
|
|
secretName: null
|
|
secretKey: null
|
|
|
|
# caKey is a Kubernetes secret containing the private key
|
|
# of the CA to use for TLS communications within the Consul cluster.
|
|
# If you have generated the CA yourself with the consul CLI,
|
|
# you could use the following command to create the secret in Kubernetes:
|
|
#
|
|
# kubectl create secret generic consul-ca-key \
|
|
# --from-file='tls.key=./consul-agent-ca-key.pem'
|
|
#
|
|
# Note that we need the CA key so that we can generate server and client certificates.
|
|
# It is particularly important for the client certificates since they need to have host IPs
|
|
# as Subject Alternative Names. In the future, we may support bringing your own server
|
|
# certificates.
|
|
caKey:
|
|
secretName: null
|
|
secretKey: null
|
|
|
|
# [Enterprise Only] enableConsulNamespaces indicates that you are running
|
|
# Consul Enterprise v1.7+ with a valid Consul Enterprise license and would like to
|
|
# make use of configuration beyond registering everything into the `default` Consul
|
|
# namespace. Requires consul-k8s v0.12+.
|
|
# Additional configuration options are found in the `consulNamespaces` section
|
|
# of both the catalog sync and connect injector.
|
|
enableConsulNamespaces: false
|
|
|
|
# Configure ACLs.
|
|
acls:
|
|
|
|
# If true, the Helm chart will automatically manage ACL tokens and policies
|
|
# for all Consul and consul-k8s components. This requires Consul >= 1.4 and consul-k8s >= 0.14.0.
|
|
manageSystemACLs: false
|
|
|
|
# bootstrapToken references a Kubernetes secret containing the bootstrap token to use
|
|
# for creating policies and tokens for all Consul and consul-k8s components.
|
|
# If set, we will skip ACL bootstrapping of the servers and will only initialize
|
|
# ACLs for the Consul and consul-k8s system components.
|
|
# Requires consul-k8s >= 0.14.0
|
|
bootstrapToken:
|
|
secretName: null
|
|
secretKey: null
|
|
|
|
# If true, an ACL token will be created that can be used in secondary
|
|
# datacenters for replication. This should only be set to true in the
|
|
# primary datacenter since the replication token must be created from that
|
|
# datacenter.
|
|
# In secondary datacenters, the secret needs to be imported from the primary
|
|
# datacenter and referenced via global.acls.replicationToken.
|
|
# Requires consul-k8s >= 0.13.0
|
|
createReplicationToken: false
|
|
|
|
# replicationToken references a secret containing the replication ACL token.
|
|
# This token will be used by secondary datacenters to perform ACL replication
|
|
# and create ACL tokens and policies.
|
|
# This value is ignored if bootstrapToken is also set.
|
|
# Requires consul-k8s >= 0.13.0
|
|
replicationToken:
|
|
secretName: null
|
|
secretKey: null
|
|
|
|
# Settings related to federating with another Consul datacenter.
|
|
federation:
|
|
# If enabled, this datacenter will be federation-capable. Only federation
|
|
# through mesh gateways is supported.
|
|
# Mesh gateways and servers will be configured to allow federation.
|
|
# Requires global.tls.enabled, meshGateway.enabled and connectInject.enabled
|
|
# to be true.
|
|
# Requires Consul 1.8+.
|
|
enabled: false
|
|
|
|
# If true, the chart will create a Kubernetes secret that can be imported
|
|
# into secondary datacenters so they can federate with this datacenter. The
|
|
# secret contains all the information secondary datacenters need to contact
|
|
# and authenticate with this datacenter. This should only be set to true
|
|
# in your primary datacenter. The secret name is
|
|
# <global.name>-federation (if setting global.name), otherwise
|
|
# <helm-release-name>-consul-federation.
|
|
# Requires consul-k8s 0.15.0+.
|
|
createFederationSecret: false
|
|
|
|
# Server, when enabled, configures a server cluster to run. This should
|
|
# be disabled if you plan on connecting to a Consul cluster external to
|
|
# the Kube cluster.
|
|
server:
|
|
enabled: "-"
|
|
image: null
|
|
replicas: 3
|
|
bootstrapExpect: 3 # Should <= replicas count
|
|
|
|
# enterpriseLicense refers to a Kubernetes secret that you have created that
|
|
# contains your enterprise license. It is required if you are using an
|
|
# enterprise binary. Defining it here applies it to your cluster once a leader
|
|
# has been elected. If you are not using an enterprise image
|
|
# or if you plan to introduce the license key via another route, then set
|
|
# these fields to null.
|
|
# Note: the job to apply license runs on both Helm installs and upgrades.
|
|
enterpriseLicense:
|
|
secretName: null
|
|
secretKey: null
|
|
|
|
# storage and storageClass are the settings for configuring stateful
|
|
# storage for the server pods. storage should be set to the disk size of
|
|
# the attached volume. storageClass is the class of storage which defaults
|
|
# to null (the Kube cluster will pick the default).
|
|
storage: 10Gi
|
|
storageClass: null
|
|
|
|
# connect will enable Connect on all the servers, initializing a CA
|
|
# for Connect-related connections. Other customizations can be done
|
|
# via the extraConfig setting.
|
|
connect: true
|
|
|
|
# Resource settings for Server agents.
|
|
# NOTE: The use of a YAML string is deprecated. Instead, set directly as a
|
|
# YAML map.
|
|
resources:
|
|
requests:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
|
|
# updatePartition is used to control a careful rolling update of Consul
|
|
# servers. This should be done particularly when changing the version
|
|
# of Consul. Please refer to the documentation for more information.
|
|
updatePartition: 0
|
|
|
|
# disruptionBudget enables the creation of a PodDisruptionBudget to
|
|
# prevent voluntary degrading of the Consul server cluster.
|
|
disruptionBudget:
|
|
enabled: true
|
|
|
|
# maxUnavailable will default to (n/2)-1 where n is the number of
|
|
# replicas. If you'd like a custom value, you can specify an override here.
|
|
maxUnavailable: null
|
|
|
|
# extraConfig is a raw string of extra configuration to set with the
|
|
# server. This should be JSON.
|
|
extraConfig: |
|
|
{}
|
|
|
|
# extraVolumes is a list of extra volumes to mount. These will be exposed
|
|
# to Consul in the path `/consul/userconfig/<name>/`. The value below is
|
|
# an array of objects, examples are shown below.
|
|
extraVolumes: []
|
|
# - type: secret (or "configMap")
|
|
# name: my-secret
|
|
# load: false # if true, will add to `-config-dir` to load by Consul
|
|
# items: # optional items array
|
|
# - key: key
|
|
# path: path
|
|
|
|
# Affinity Settings
|
|
# Commenting out or setting as empty the affinity variable, will allow
|
|
# deployment to single node services such as Minikube
|
|
affinity: |
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app: {{ template "consul.name" . }}
|
|
release: "{{ .Release.Name }}"
|
|
component: server
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
# Toleration Settings for server pods
|
|
# This should be a multi-line string matching the Toleration array
|
|
# in a PodSpec.
|
|
tolerations: ""
|
|
|
|
# nodeSelector labels for server pod assignment, formatted as a multi-line string.
|
|
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
|
|
# Example:
|
|
# nodeSelector: |
|
|
# beta.kubernetes.io/arch: amd64
|
|
nodeSelector: null
|
|
|
|
# used to assign priority to server pods
|
|
# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
|
priorityClassName: ""
|
|
|
|
# Extra annotations to attach to the server pods.
|
|
# This should be a multi-line YAML string.
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
service:
|
|
# Annotations to apply to the server service.
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
# extraEnvVars is a list of extra environment variables to set with the stateful set. These could be
|
|
# used to include proxy settings required for cloud auto-join feature,
|
|
# in case kubernetes cluster is behind egress http proxies. Additionally, it could be used to configure
|
|
# custom consul parameters.
|
|
extraEnvironmentVars: {}
|
|
# http_proxy: http://localhost:3128,
|
|
# https_proxy: http://localhost:3128,
|
|
# no_proxy: internal.domain.com
|
|
|
|
# Configuration for Consul servers when the servers are running outside of Kubernetes.
|
|
# When running external servers, configuring these values is recommended
|
|
# if setting global.tls.enableAutoEncrypt to true (requires consul-k8s >= 0.13.0)
|
|
# or global.acls.manageSystemACLs to true (requires consul-k8s >= 0.14.0).
|
|
externalServers:
|
|
# If true, the Helm chart will be configured to talk to the external servers.
|
|
# If setting this to true, you must also set server.enabled to false.
|
|
enabled: false
|
|
|
|
# An array of external Consul server hosts that are used to make
|
|
# HTTPS connections from the components in this Helm chart.
|
|
# Valid values include IPs, DNS names, or Cloud auto-join string.
|
|
# The port must be provided separately below.
|
|
# NOTE: client.join must also be set to the hosts that should be
|
|
# used to join the cluster. In most cases the client.join values
|
|
# should be the same, however they may be different if you
|
|
# wish to use separate hosts for the HTTPS connections.
|
|
hosts: []
|
|
|
|
# The HTTPS port of the Consul servers.
|
|
httpsPort: 8501
|
|
|
|
# tlsServerName is the server name to use as the SNI
|
|
# host header when connecting with HTTPS.
|
|
tlsServerName: null
|
|
|
|
# If true, the Helm chart will ignore the CA set in
|
|
# global.tls.caCert and will rely on the container's
|
|
# system CAs for TLS verification when talking to Consul servers.
|
|
# Otherwise, the chart will use global.tls.caCert.
|
|
useSystemRoots: false
|
|
|
|
# If you are setting global.acls.manageSystemACLs and connectInject.enabled to true,
|
|
# set k8sAuthMethodHost to the address of the Kubernetes API server.
|
|
# This address must to be reachable from the Consul servers.
|
|
# Please see https://www.consul.io/docs/acl/auth-methods/kubernetes.html.
|
|
# Requires consul-k8s >= 0.14.0.
|
|
#
|
|
# You could retrieve this value from your kubeconfig by running:
|
|
# kubectl config view \
|
|
# -o jsonpath="{.clusters[?(@.name=='<your cluster name>')].cluster.server}"
|
|
k8sAuthMethodHost: null
|
|
|
|
# Client, when enabled, configures Consul clients to run on every node
|
|
# within the Kube cluster. The current deployment model follows a traditional
|
|
# DC where a single agent is deployed per node.
|
|
client:
|
|
enabled: "-"
|
|
image: null
|
|
join: null
|
|
|
|
# dataDirectoryHostPath is an absolute path to a directory on the host machine
|
|
# to use as the Consul client data directory.
|
|
# If set to the empty string or null, the Consul agent will store its data
|
|
# in the Pod's local filesystem (which will be lost if the Pod is deleted).
|
|
# Security Warning: If setting this, Pod Security Policies *must* be enabled on your cluster
|
|
# and in this Helm chart (via the global.enablePodSecurityPolicies setting)
|
|
# to prevent other Pods from mounting the same host path and gaining
|
|
# access to all of Consul's data. Consul's data is not encrypted at rest.
|
|
dataDirectoryHostPath: null
|
|
|
|
# If true, Consul's gRPC port will be exposed (see https://www.consul.io/docs/agent/options.html#grpc_port).
|
|
# This should be set to true if connectInject or meshGateway is enabled.
|
|
grpc: true
|
|
|
|
# exposeGossipPorts exposes the clients' gossip ports as hostPorts.
|
|
# This is only necessary if pod IPs in the k8s cluster are not directly
|
|
# routable and the Consul servers are outside of the k8s cluster. This
|
|
# also changes the clients' advertised IP to the hostIP rather than podIP.
|
|
exposeGossipPorts: false
|
|
|
|
# Resource settings for Client agents.
|
|
# NOTE: The use of a YAML string is deprecated. Instead, set directly as a
|
|
# YAML map.
|
|
resources:
|
|
requests:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
|
|
# extraConfig is a raw string of extra configuration to set with the
|
|
# client. This should be JSON.
|
|
extraConfig: |
|
|
{}
|
|
|
|
# extraVolumes is a list of extra volumes to mount. These will be exposed
|
|
# to Consul in the path `/consul/userconfig/<name>/`. The value below is
|
|
# an array of objects, examples are shown below.
|
|
extraVolumes: []
|
|
# - type: secret (or "configMap")
|
|
# name: my-secret
|
|
# load: false # if true, will add to `-config-dir` to load by Consul
|
|
|
|
# Toleration Settings for Client pods
|
|
# This should be a multi-line string matching the Toleration array
|
|
# in a PodSpec.
|
|
# The example below will allow Client pods to run on every node
|
|
# regardless of taints
|
|
# tolerations: |
|
|
# - operator: "Exists"
|
|
tolerations: ""
|
|
|
|
# nodeSelector labels for client pod assignment, formatted as a multi-line string.
|
|
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
|
|
# Example:
|
|
# nodeSelector: |
|
|
# beta.kubernetes.io/arch: amd64
|
|
nodeSelector: null
|
|
|
|
# Affinity Settings for Client pods, formatted as a multi-line YAML string.
|
|
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
|
# Example:
|
|
# affinity: |
|
|
# nodeAffinity:
|
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
|
# nodeSelectorTerms:
|
|
# - matchExpressions:
|
|
# - key: node-role.kubernetes.io/master
|
|
# operator: DoesNotExist
|
|
affinity: {}
|
|
|
|
# used to assign priority to client pods
|
|
# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
|
priorityClassName: ""
|
|
|
|
# Extra annotations to attach to the client pods
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
# extraEnvVars is a list of extra environment variables to set with the pod. These could be
|
|
# used to include proxy settings required for cloud auto-join feature,
|
|
# in case kubernetes cluster is behind egress http proxies. Additionally, it could be used to configure
|
|
# custom consul parameters.
|
|
extraEnvironmentVars: {}
|
|
# http_proxy: http://localhost:3128,
|
|
# https_proxy: http://localhost:3128,
|
|
# no_proxy: internal.domain.com
|
|
|
|
# dnsPolicy to use.
|
|
dnsPolicy: null
|
|
|
|
# hostNetwork defines whether or not we use host networking instead of hostPort in the event
|
|
# that a CNI plugin doesnt support hostPort. This has security implications and is not recommended
|
|
# as doing so gives the consul client unnecessary access to all network traffic on the host.
|
|
# In most cases, pod network and host network are on different networks so this should be
|
|
# combined with `dnsPolicy: ClusterFirstWithHostNet`
|
|
hostNetwork: false
|
|
|
|
# updateStrategy for the DaemonSet.
|
|
# See https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#daemonset-update-strategy.
|
|
# This should be a multi-line string mapping directly to the updateStrategy
|
|
# Example:
|
|
# updateStrategy: |
|
|
# rollingUpdate:
|
|
# maxUnavailable: 5
|
|
# type: RollingUpdate
|
|
updateStrategy: null
|
|
|
|
# snapshotAgent contains settings for setting up and running snapshot agents
|
|
# within the Consul clusters. They are required to be co-located with Consul
|
|
# clients, so will inherit the clients' nodeSelector, tolerations and affinity.
|
|
# This is an Enterprise feature only.
|
|
snapshotAgent:
|
|
enabled: false
|
|
|
|
# replicas determines how many snapshot agent pods are created
|
|
replicas: 2
|
|
|
|
# configSecret references a Kubernetes secret that should be manually created to
|
|
# contain the entire config to be used on the snapshot agent. This is the preferred
|
|
# method of configuration since there are usually storage credentials present.
|
|
# Snapshot agent config details:
|
|
# https://www.consul.io/docs/commands/snapshot/agent.html#config-file-options-
|
|
# To create a secret:
|
|
# https://kubernetes.io/docs/concepts/configuration/secret/#creating-a-secret-using-kubectl-create-secret
|
|
configSecret:
|
|
secretName: null
|
|
secretKey: null
|
|
|
|
# Resource settings for snapshot agent pods.
|
|
resources:
|
|
requests:
|
|
memory: "50Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "50Mi"
|
|
cpu: "50m"
|
|
|
|
# Optional PEM-encoded CA certificate that will be added to the trusted system CAs.
|
|
# Useful if using an S3-compatible storage exposing a self-signed certificate.
|
|
# Example
|
|
# caCert: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIC7jCCApSgAwIBAgIRAIq2zQEVexqxvtxP6J0bXAwwCgYIKoZIzj0EAwIwgbkx
|
|
# ...
|
|
caCert: null
|
|
|
|
# Configuration for DNS configuration within the Kubernetes cluster.
|
|
# This creates a service that routes to all agents (client or server)
|
|
# for serving DNS requests. This DOES NOT automatically configure kube-dns
|
|
# today, so you must still manually configure a `stubDomain` with kube-dns
|
|
# for this to have any effect:
|
|
# https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/#configure-stub-domain-and-upstream-dns-servers
|
|
dns:
|
|
enabled: "-"
|
|
|
|
# Set a predefined cluster IP for the DNS service.
|
|
# Useful if you need to reference the DNS service's IP
|
|
# address in CoreDNS config.
|
|
clusterIP: null
|
|
|
|
# Extra annotations to attach to the dns service
|
|
# This should be a multi-line string of
|
|
# annotations to apply to the dns Service
|
|
annotations: null
|
|
|
|
ui:
|
|
# True if you want to enable the Consul UI. The UI will run only
|
|
# on the server nodes. This makes UI access via the service below (if
|
|
# enabled) predictable rather than "any node" if you're running Consul
|
|
# clients as well.
|
|
enabled: "-"
|
|
|
|
# True if you want to create a Service entry for the Consul UI.
|
|
#
|
|
# serviceType can be used to control the type of service created. For
|
|
# example, setting this to "LoadBalancer" will create an external load
|
|
# balancer (for supported K8S installations) to access the UI.
|
|
service:
|
|
enabled: true
|
|
type: null
|
|
|
|
# Annotations to apply to the UI service.
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
# Additional ServiceSpec values
|
|
# This should be a multi-line string mapping directly to a Kubernetes
|
|
# ServiceSpec object.
|
|
additionalSpec: null
|
|
|
|
# syncCatalog will run the catalog sync process to sync K8S with Consul
|
|
# services. This can run bidirectional (default) or unidirectionally (Consul
|
|
# to K8S or K8S to Consul only).
|
|
#
|
|
# This process assumes that a Consul agent is available on the host IP.
|
|
# This is done automatically if clients are enabled. If clients are not
|
|
# enabled then set the node selection so that it chooses a node with a
|
|
# Consul agent.
|
|
syncCatalog:
|
|
# True if you want to enable the catalog sync. Set to "-" to inherit from
|
|
# global.enabled.
|
|
enabled: false
|
|
image: null
|
|
default: true # true will sync by default, otherwise requires annotation
|
|
|
|
# toConsul and toK8S control whether syncing is enabled to Consul or K8S
|
|
# as a destination. If both of these are disabled, the sync will do nothing.
|
|
toConsul: true
|
|
toK8S: true
|
|
|
|
# k8sPrefix is the service prefix to prepend to services before registering
|
|
# with Kubernetes. For example "consul-" will register all services
|
|
# prepended with "consul-". (Consul -> Kubernetes sync)
|
|
k8sPrefix: null
|
|
|
|
# k8sAllowNamespaces is a list of k8s namespaces to sync the k8s services from.
|
|
# If a k8s namespace is not included in this list or is listed in `k8sDenyNamespaces`,
|
|
# services in that k8s namespace will not be synced even if they are explicitly
|
|
# annotated. Use ["*"] to automatically allow all k8s namespaces.
|
|
#
|
|
# For example, ["namespace1", "namespace2"] will only allow services in the k8s
|
|
# namespaces `namespace1` and `namespace2` to be synced and registered
|
|
# with Consul. All other k8s namespaces will be ignored.
|
|
#
|
|
# To deny all namespaces, set this to [].
|
|
#
|
|
# Note: `k8sDenyNamespaces` takes precedence over values defined here.
|
|
# Requires consul-k8s v0.12+
|
|
k8sAllowNamespaces: ["*"]
|
|
|
|
# k8sDenyNamespaces is a list of k8s namespaces that should not have their
|
|
# services synced. This list takes precedence over `k8sAllowNamespaces`.
|
|
# `*` is not supported because then nothing would be allowed to sync.
|
|
# Requires consul-k8s v0.12+.
|
|
#
|
|
# For example, if `k8sAllowNamespaces` is `["*"]` and `k8sDenyNamespaces` is
|
|
# `["namespace1", "namespace2"]`, then all k8s namespaces besides "namespace1"
|
|
# and "namespace2" will be synced.
|
|
k8sDenyNamespaces: ["kube-system", "kube-public"]
|
|
|
|
# [DEPRECATED] Use k8sAllowNamespaces and k8sDenyNamespaces instead. For
|
|
# backwards compatibility, if both this and the allow/deny lists are set,
|
|
# the allow/deny lists will be ignored.
|
|
# k8sSourceNamespace is the Kubernetes namespace to watch for service
|
|
# changes and sync to Consul. If this is not set then it will default
|
|
# to all namespaces.
|
|
k8sSourceNamespace: null
|
|
|
|
# [Enterprise Only] These settings manage the catalog sync's interaction with
|
|
# Consul namespaces (requires consul-ent v1.7+ and consul-k8s v0.12+).
|
|
# Also, `global.enableConsulNamespaces` must be true.
|
|
consulNamespaces:
|
|
# consulDestinationNamespace is the name of the Consul namespace to register all
|
|
# k8s services into. If the Consul namespace does not already exist,
|
|
# it will be created. This will be ignored if `mirroringK8S` is true.
|
|
consulDestinationNamespace: "default"
|
|
|
|
# mirroringK8S causes k8s services to be registered into a Consul namespace
|
|
# of the same name as their k8s namespace, optionally prefixed if
|
|
# `mirroringK8SPrefix` is set below. If the Consul namespace does not
|
|
# already exist, it will be created. Turning this on overrides the
|
|
# `consulDestinationNamespace` setting.
|
|
# `addK8SNamespaceSuffix` may no longer be needed if enabling this option.
|
|
mirroringK8S: false
|
|
|
|
# If `mirroringK8S` is set to true, `mirroringK8SPrefix` allows each Consul namespace
|
|
# to be given a prefix. For example, if `mirroringK8SPrefix` is set to "k8s-", a
|
|
# service in the k8s `staging` namespace will be registered into the
|
|
# `k8s-staging` Consul namespace.
|
|
mirroringK8SPrefix: ""
|
|
|
|
# addK8SNamespaceSuffix appends Kubernetes namespace suffix to
|
|
# each service name synced to Consul, separated by a dash.
|
|
# For example, for a service 'foo' in the default namespace,
|
|
# the sync process will create a Consul service named 'foo-default'.
|
|
# Set this flag to true to avoid registering services with the same name
|
|
# but in different namespaces as instances for the same Consul service.
|
|
# Namespace suffix is not added if 'annotationServiceName' is provided.
|
|
addK8SNamespaceSuffix: true
|
|
|
|
# consulPrefix is the service prefix which prepends itself
|
|
# to Kubernetes services registered within Consul
|
|
# For example, "k8s-" will register all services prepended with "k8s-".
|
|
# (Kubernetes -> Consul sync)
|
|
# consulPrefix is ignored when 'annotationServiceName' is provided.
|
|
# NOTE: Updating this property to a non-null value for an existing installation will result in deregistering
|
|
# of existing services in Consul and registering them with a new name.
|
|
consulPrefix: null
|
|
|
|
# k8sTag is an optional tag that is applied to all of the Kubernetes services
|
|
# that are synced into Consul. If nothing is set, defaults to "k8s".
|
|
# (Kubernetes -> Consul sync)
|
|
k8sTag: null
|
|
|
|
# syncClusterIPServices syncs services of the ClusterIP type, which may
|
|
# or may not be broadly accessible depending on your Kubernetes cluster.
|
|
# Set this to false to skip syncing ClusterIP services.
|
|
syncClusterIPServices: true
|
|
|
|
# nodePortSyncType configures the type of syncing that happens for NodePort
|
|
# services. The valid options are: ExternalOnly, InternalOnly, ExternalFirst.
|
|
# - ExternalOnly will only use a node's ExternalIP address for the sync
|
|
# - InternalOnly use's the node's InternalIP address
|
|
# - ExternalFirst will preferentially use the node's ExternalIP address, but
|
|
# if it doesn't exist, it will use the node's InternalIP address instead.
|
|
nodePortSyncType: ExternalFirst
|
|
|
|
# aclSyncToken refers to a Kubernetes secret that you have created that contains
|
|
# an ACL token for your Consul cluster which allows the sync process the correct
|
|
# permissions. This is only needed if ACLs are enabled on the Consul cluster.
|
|
aclSyncToken:
|
|
secretName: null
|
|
secretKey: null
|
|
|
|
# nodeSelector labels for syncCatalog pod assignment, formatted as a multi-line string.
|
|
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
|
|
# Example:
|
|
# nodeSelector: |
|
|
# beta.kubernetes.io/arch: amd64
|
|
nodeSelector: null
|
|
|
|
# Affinity Settings
|
|
# This should be a multi-line string matching the affinity object
|
|
affinity: null
|
|
|
|
# Toleration Settings
|
|
# This should be a multi-line string matching the Toleration array
|
|
# in a PodSpec.
|
|
tolerations: null
|
|
|
|
# Resource settings for sync catalog pods.
|
|
resources:
|
|
requests:
|
|
memory: "50Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "50Mi"
|
|
cpu: "50m"
|
|
|
|
# Log verbosity level. One of "trace", "debug", "info", "warn", or "error".
|
|
logLevel: info
|
|
|
|
# Override the default interval to perform syncing operations creating Consul services.
|
|
consulWriteInterval: null
|
|
|
|
# ConnectInject will enable the automatic Connect sidecar injector.
|
|
connectInject:
|
|
# True if you want to enable connect injection. Set to "-" to inherit from
|
|
# global.enabled.
|
|
# Requires consul-k8s >= 0.10.1.
|
|
enabled: false
|
|
image: null # image for consul-k8s that contains the injector
|
|
default: false # true will inject by default, otherwise requires annotation
|
|
|
|
# The Docker image for Consul to use when performing Connect injection.
|
|
# Defaults to global.image.
|
|
imageConsul: null
|
|
|
|
# Resource settings for connect inject pods.
|
|
resources:
|
|
requests:
|
|
memory: "50Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "50Mi"
|
|
cpu: "50m"
|
|
|
|
# The Docker image for envoy to use as the proxy sidecar when performing
|
|
# Connect injection. If using Consul 1.7+, the envoy version must be 1.13+.
|
|
# If not set, the image used depends on the consul-k8s version. For
|
|
# consul-k8s 0.12.0 the default is envoyproxy/envoy-alpine:v1.13.0.
|
|
imageEnvoy: null
|
|
|
|
# namespaceSelector is the selector for restricting the webhook to only
|
|
# specific namespaces. This should be set to a multiline string.
|
|
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
|
|
# for more details.
|
|
# Example:
|
|
# namespaceSelector: |
|
|
# matchLabels:
|
|
# namespace-label: label-value
|
|
namespaceSelector: null
|
|
|
|
# k8sAllowNamespaces is a list of k8s namespaces to allow Connect sidecar
|
|
# injection in. If a k8s namespace is not included or is listed in `k8sDenyNamespaces`,
|
|
# pods in that k8s namespace will not be injected even if they are explicitly
|
|
# annotated. Use ["*"] to automatically allow all k8s namespaces.
|
|
#
|
|
# For example, ["namespace1", "namespace2"] will only allow pods in the k8s
|
|
# namespaces `namespace1` and `namespace2` to have Connect sidecars injected
|
|
# and registered with Consul. All other k8s namespaces will be ignored.
|
|
#
|
|
# To deny all namespaces, set this to [].
|
|
#
|
|
# Note: `k8sDenyNamespaces` takes precedence over values defined here and
|
|
# `namespaceSelector` takes precedence over both since it is applied first.
|
|
# `kube-system` and `kube-public` are never injected, even if included here.
|
|
# Requires consul-k8s v0.12+
|
|
k8sAllowNamespaces: ["*"]
|
|
|
|
# k8sDenyNamespaces is a list of k8s namespaces that should not allow Connect
|
|
# sidecar injection. This list takes precedence over `k8sAllowNamespaces`.
|
|
# `*` is not supported because then nothing would be allowed to be injected.
|
|
#
|
|
# For example, if `k8sAllowNamespaces` is `["*"]` and k8sDenyNamespaces is
|
|
# `["namespace1", "namespace2"]`, then all k8s namespaces besides "namespace1"
|
|
# and "namespace2" will be available for injection.
|
|
#
|
|
# Note: `namespaceSelector` takes precedence over this since it is applied first.
|
|
# `kube-system` and `kube-public` are never injected.
|
|
# Requires consul-k8s v0.12+.
|
|
k8sDenyNamespaces: []
|
|
|
|
# [Enterprise Only] These settings manage the connect injector's interaction with
|
|
# Consul namespaces (requires consul-ent v1.7+ and consul-k8s v0.12+).
|
|
# Also, `global.enableConsulNamespaces` must be true.
|
|
consulNamespaces:
|
|
# consulDestinationNamespace is the name of the Consul namespace to register all
|
|
# k8s pods into. If the Consul namespace does not already exist,
|
|
# it will be created. This will be ignored if `mirroringK8S` is true.
|
|
consulDestinationNamespace: "default"
|
|
|
|
# mirroringK8S causes k8s pods to be registered into a Consul namespace
|
|
# of the same name as their k8s namespace, optionally prefixed if
|
|
# `mirroringK8SPrefix` is set below. If the Consul namespace does not
|
|
# already exist, it will be created. Turning this on overrides the
|
|
# `consulDestinationNamespace` setting.
|
|
mirroringK8S: false
|
|
|
|
# If `mirroringK8S` is set to true, `mirroringK8SPrefix` allows each Consul namespace
|
|
# to be given a prefix. For example, if `mirroringK8SPrefix` is set to "k8s-", a
|
|
# pod in the k8s `staging` namespace will be registered into the
|
|
# `k8s-staging` Consul namespace.
|
|
mirroringK8SPrefix: ""
|
|
|
|
# The certs section configures how the webhook TLS certs are configured.
|
|
# These are the TLS certs for the Kube apiserver communicating to the
|
|
# webhook. By default, the injector will generate and manage its own certs,
|
|
# but this requires the ability for the injector to update its own
|
|
# MutatingWebhookConfiguration. In a production environment, custom certs
|
|
# should probably be used. Configure the values below to enable this.
|
|
certs:
|
|
# secretName is the name of the secret that has the TLS certificate and
|
|
# private key to serve the injector webhook. If this is null, then the
|
|
# injector will default to its automatic management mode that will assign
|
|
# a service account to the injector to generate its own certificates.
|
|
secretName: null
|
|
|
|
# caBundle is a base64-encoded PEM-encoded certificate bundle for the
|
|
# CA that signed the TLS certificate that the webhook serves. This must
|
|
# be set if secretName is non-null.
|
|
caBundle: ""
|
|
|
|
# certName and keyName are the names of the files within the secret for
|
|
# the TLS cert and private key, respectively. These have reasonable
|
|
# defaults but can be customized if necessary.
|
|
certName: tls.crt
|
|
keyName: tls.key
|
|
|
|
# nodeSelector labels for connectInject pod assignment, formatted as a multi-line string.
|
|
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
|
|
# Example:
|
|
# nodeSelector: |
|
|
# beta.kubernetes.io/arch: amd64
|
|
nodeSelector: null
|
|
|
|
# Affinity Settings
|
|
# This should be a multi-line string matching the affinity object
|
|
affinity: null
|
|
|
|
# Toleration Settings
|
|
# This should be a multi-line string matching the Toleration array
|
|
# in a PodSpec.
|
|
tolerations: null
|
|
|
|
# aclBindingRuleSelector accepts a query that defines which Service Accounts
|
|
# can authenticate to Consul and receive an ACL token during Connect injection.
|
|
# The default setting, i.e. serviceaccount.name!=default, prevents the
|
|
# 'default' Service Account from logging in.
|
|
# If set to an empty string all service accounts can log in.
|
|
# This only has effect if ACLs are enabled.
|
|
#
|
|
# See https://www.consul.io/docs/acl/acl-auth-methods.html#binding-rules
|
|
# and https://www.consul.io/docs/acl/auth-methods/kubernetes.html#trusted-identity-attributes
|
|
# for more details.
|
|
# Requires Consul >= v1.5 and consul-k8s >= v0.8.0.
|
|
aclBindingRuleSelector: "serviceaccount.name!=default"
|
|
|
|
# If you are not using global.acls.manageSystemACLs and instead manually setting up an
|
|
# auth method for Connect inject, set this to the name of your auth method.
|
|
overrideAuthMethodName: ""
|
|
|
|
# aclInjectToken refers to a Kubernetes secret that you have created that contains
|
|
# an ACL token for your Consul cluster which allows the Connect injector the correct
|
|
# permissions. This is only needed if Consul namespaces [Enterprise only] and ACLs
|
|
# are enabled on the Consul cluster and you are not setting
|
|
# `global.acls.manageSystemACLs` to `true`.
|
|
# This token needs to have `operator = "write"` privileges to be able to
|
|
# create Consul namespaces.
|
|
aclInjectToken:
|
|
secretName: null
|
|
secretKey: null
|
|
|
|
# Requires Consul >= v1.5 and consul-k8s >= v0.8.1.
|
|
centralConfig:
|
|
# enabled controls whether central config is enabled on all servers and clients.
|
|
# See https://www.consul.io/docs/agent/options.html#enable_central_service_config.
|
|
# If changing this after installation, servers and clients must be restarted
|
|
# for the change to take effect.
|
|
enabled: true
|
|
|
|
# defaultProtocol allows you to specify a convenience default protocol if
|
|
# most of your services are of the same protocol type. The individual annotation
|
|
# on any given pod will override this value.
|
|
# Valid values are "http", "http2", "grpc" and "tcp".
|
|
defaultProtocol: null
|
|
|
|
# proxyDefaults is a raw json string that will be written as the value of
|
|
# the "config" key of the global proxy-defaults config entry.
|
|
# See: https://www.consul.io/docs/agent/config-entries/proxy-defaults.html
|
|
# NOTE: Changes to this value after the chart is first installed have *no*
|
|
# effect. In order to change the proxy-defaults config after installation,
|
|
# you must use the Consul API.
|
|
proxyDefaults: |
|
|
{}
|
|
|
|
sidecarProxy:
|
|
# Set default resources for sidecar proxy. If null, that resource won't
|
|
# be set.
|
|
# These settings can be overridden on a per-pod basis via these annotations:
|
|
# - consul.hashicorp.com/sidecar-proxy-cpu-limit
|
|
# - consul.hashicorp.com/sidecar-proxy-cpu-request
|
|
# - consul.hashicorp.com/sidecar-proxy-memory-limit
|
|
# - consul.hashicorp.com/sidecar-proxy-memory-request
|
|
resources:
|
|
requests:
|
|
# Recommended default: 100Mi
|
|
memory: null
|
|
# Recommended default: 100m
|
|
cpu: null
|
|
limits:
|
|
# Recommended default: 100Mi
|
|
memory: null
|
|
# Recommended default: 100m
|
|
cpu: null
|
|
|
|
# Mesh Gateways enable Consul Connect to work across Consul datacenters.
|
|
meshGateway:
|
|
# If mesh gateways are enabled, a Deployment will be created that runs
|
|
# gateways and Consul Connect will be configured to use gateways.
|
|
# See https://www.consul.io/docs/connect/mesh_gateway.html
|
|
# Requirements: consul 1.6.0+ and consul-k8s 0.15.0+ if using
|
|
# global.acls.manageSystemACLs.
|
|
enabled: false
|
|
|
|
# Globally configure which mode the gateway should run in.
|
|
# Can be set to either "remote", "local", "none" or empty string or null.
|
|
# See https://consul.io/docs/connect/mesh_gateway.html#modes-of-operation for
|
|
# a description of each mode.
|
|
# If set to anything other than "" or null, connectInject.centralConfig.enabled
|
|
# should be set to true so that the global config will actually be used.
|
|
# If set to the empty string, no global default will be set and the gateway mode
|
|
# will need to be set individually for each service.
|
|
globalMode: local
|
|
|
|
# Number of replicas for the Deployment.
|
|
replicas: 2
|
|
|
|
# What gets registered as WAN address for the gateway.
|
|
wanAddress:
|
|
# source configures where to retrieve the WAN address (and possibly port)
|
|
# for the mesh gateway from.
|
|
# Can be set to either: Service, NodeIP, NodeName or Static.
|
|
#
|
|
# Service - Determine the address based on the service type.
|
|
# If service.type=LoadBalancer use the external IP or hostname of
|
|
# the service. Use the port set by service.port.
|
|
# If service.type=NodePort use the Node IP. The port will be set to
|
|
# service.nodePort so service.nodePort cannot be null.
|
|
# If service.type=ClusterIP use the ClusterIP. The port will be set to
|
|
# service.port.
|
|
# service.type=ExternalName is not supported.
|
|
# NodeIP - The node IP as provided by the Kubernetes downward API.
|
|
# NodeName - The name of the node as provided by the Kubernetes downward
|
|
# API. This is useful if the node names are DNS entries that
|
|
# are routable from other datacenters.
|
|
# Static - Use the address hardcoded in meshGateway.wanAddress.static.
|
|
source: "Service"
|
|
|
|
# Port that gets registered for WAN traffic.
|
|
# If source is set to "Service" then this setting will have no effect.
|
|
# See the documentation for source as to which port will be used in that
|
|
# case.
|
|
port: 443
|
|
|
|
# If source is set to "Static" then this value will be used as the WAN
|
|
# address of the mesh gateways. This is useful if you've configured a
|
|
# DNS entry to point to your mesh gateways.
|
|
static: ""
|
|
|
|
# The service option configures the Service that fronts the Gateway Deployment.
|
|
service:
|
|
# Whether to create a Service or not.
|
|
enabled: true
|
|
|
|
# Type of service, ex. LoadBalancer, ClusterIP.
|
|
type: LoadBalancer
|
|
|
|
# Port that the service will be exposed on.
|
|
# The targetPort will be set to meshGateway.containerPort.
|
|
port: 443
|
|
|
|
# Optionally hardcode the nodePort of the service if using a NodePort service.
|
|
# If not set and using a NodePort service, Kubernetes will automatically assign
|
|
# a port.
|
|
nodePort: null
|
|
|
|
# Annotations to apply to the mesh gateway service.
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
# Optional YAML string that will be appended to the Service spec.
|
|
additionalSpec: null
|
|
|
|
# Envoy image to use. For Consul v1.7+, Envoy version 1.13+ is required.
|
|
imageEnvoy: envoyproxy/envoy-alpine:v1.14.2
|
|
|
|
# If set to true, gateway Pods will run on the host network.
|
|
hostNetwork: false
|
|
|
|
# dnsPolicy to use.
|
|
dnsPolicy: null
|
|
|
|
# Consul service name for the mesh gateways.
|
|
# Cannot be set to anything other than "mesh-gateway" if
|
|
# global.acls.manageSystemACLs is true since the ACL token
|
|
# generated is only for the name 'mesh-gateway'.
|
|
consulServiceName: "mesh-gateway"
|
|
|
|
# Port that the gateway will run on inside the container.
|
|
containerPort: 8443
|
|
|
|
# Optional hostPort for the gateway to be exposed on.
|
|
# This can be used with wanAddress.port and wanAddress.useNodeIP
|
|
# to expose the gateways directly from the node.
|
|
# If hostNetwork is true, this must be null or set to the same port as
|
|
# containerPort.
|
|
# NOTE: Cannot set to 8500 or 8502 because those are reserved for the Consul
|
|
# agent.
|
|
hostPort: null
|
|
|
|
# Resource settings for mesh gateway pods.
|
|
# NOTE: The use of a YAML string is deprecated. Instead, set directly as a
|
|
# YAML map.
|
|
resources:
|
|
requests:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
|
|
# By default, we set an anti-affinity so that two gateway pods won't be
|
|
# on the same node. NOTE: Gateways require that Consul client agents are
|
|
# also running on the nodes alongside each gateway pod.
|
|
affinity: |
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app: {{ template "consul.name" . }}
|
|
release: "{{ .Release.Name }}"
|
|
component: mesh-gateway
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
# Optional YAML string to specify tolerations.
|
|
tolerations: null
|
|
|
|
# Optional YAML string to specify a nodeSelector config.
|
|
nodeSelector: null
|
|
|
|
# Optional priorityClassName.
|
|
priorityClassName: ""
|
|
|
|
# Annotations to apply to the mesh gateway deployment.
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
# Configuration options for ingress gateways. Default values for all
|
|
# ingress gateways are defined in `ingressGateways.defaults`. Any of
|
|
# these values may be overridden in `ingressGateways.gateways` for a
|
|
# specific gateway with the exception of annotations. Annotations will
|
|
# include both the default annotations and any additional ones defined
|
|
# for a specific gateway.
|
|
# Requirements: consul >= 1.8.0 and consul-k8s >= 0.16.0 if using
|
|
# global.acls.manageSystemACLs and consul-k8s >= 0.10.0 if not.
|
|
ingressGateways:
|
|
# Enable ingress gateway deployment. Requires `connectInject.enabled=true`
|
|
# and `client.enabled=true`.
|
|
enabled: false
|
|
|
|
# Defaults sets default values for all gateway fields. With the exception
|
|
# of annotations, defining any of these values in the `gateways` list
|
|
# will override the default values provided here. Annotations will
|
|
# include both the default annotations and any additional ones defined
|
|
# for a specific gateway.
|
|
defaults:
|
|
# Number of replicas for each ingress gateway defined.
|
|
replicas: 2
|
|
|
|
# The service options configure the Service that fronts the gateway Deployment.
|
|
service:
|
|
# Type of service: LoadBalancer, ClusterIP or NodePort. If using NodePort service
|
|
# type, you must set the desired nodePorts in the `ports` setting below.
|
|
type: ClusterIP
|
|
|
|
# Ports that will be exposed on the service and gateway container. Any
|
|
# ports defined as ingress listeners on the gateway's Consul configuration
|
|
# entry should be included here. The first port will be used as part of
|
|
# the Consul service registration for the gateway and be listed in its
|
|
# SRV record. If using a NodePort service type, you must specify the
|
|
# desired nodePort for each exposed port.
|
|
ports:
|
|
- port: 8080
|
|
nodePort: null
|
|
- port: 8443
|
|
nodePort: null
|
|
|
|
# Annotations to apply to the ingress gateway service. Annotations defined
|
|
# here will be applied to all ingress gateway services in addition to any
|
|
# service annotations defined for a specific gateway in `ingressGateways.gateways`.
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
# Optional YAML string that will be appended to the Service spec.
|
|
additionalSpec: null
|
|
|
|
# Resource limits for all ingress gateway pods
|
|
resources:
|
|
requests:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
|
|
# By default, we set an anti-affinity so that two of the same gateway pods
|
|
# won't be on the same node. NOTE: Gateways require that Consul client agents are
|
|
# also running on the nodes alongside each gateway pod.
|
|
affinity: |
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app: {{ template "consul.name" . }}
|
|
release: "{{ .Release.Name }}"
|
|
component: ingress-gateway
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
# Optional YAML string to specify tolerations.
|
|
tolerations: null
|
|
|
|
# Optional YAML string to specify a nodeSelector config.
|
|
nodeSelector: null
|
|
|
|
# Optional priorityClassName.
|
|
priorityClassName: ""
|
|
|
|
# Annotations to apply to the ingress gateway deployment. Annotations defined
|
|
# here will be applied to all ingress gateway deployments in addition to any
|
|
# annotations defined for a specific gateway in `ingressGateways.gateways`.
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
# [Enterprise Only] `consulNamespace` defines the Consul namespace to register
|
|
# the gateway into. Requires `global.enableConsulNamespaces` to be true and
|
|
# Consul Enterprise v1.7+ with a valid Consul Enterprise license.
|
|
# Note: The Consul namespace MUST exist before the gateway is deployed.
|
|
consulNamespace: "default"
|
|
|
|
# Gateways is a list of gateway objects. The only required field for
|
|
# each is `name`, though they can also contain any of the fields in
|
|
# `defaults`. Values defined here override the defaults except in the
|
|
# case of annotations where both will be applied.
|
|
gateways:
|
|
- name: ingress-gateway
|
|
|
|
# Configuration options for terminating gateways. Default values for all
|
|
# terminating gateways are defined in `terminatingGateways.defaults`. Any of
|
|
# these values may be overridden in `terminatingGateways.gateways` for a
|
|
# specific gateway with the exception of annotations. Annotations will
|
|
# include both the default annotations and any additional ones defined
|
|
# for a specific gateway.
|
|
# Requirements: consul >= 1.8.0 and consul-k8s >= 0.16.0 if using
|
|
# global.acls.manageSystemACLs and consul-k8s >= 0.10.0 if not.
|
|
terminatingGateways:
|
|
# Enable terminating gateway deployment. Requires `connectInject.enabled=true`
|
|
# and `client.enabled=true`.
|
|
enabled: false
|
|
|
|
# Defaults sets default values for all gateway fields. With the exception
|
|
# of annotations, defining any of these values in the `gateways` list
|
|
# will override the default values provided here. Annotations will
|
|
# include both the default annotations and any additional ones defined
|
|
# for a specific gateway.
|
|
defaults:
|
|
# Number of replicas for each terminating gateway defined.
|
|
replicas: 2
|
|
|
|
# extraVolumes is a list of extra volumes to mount. These will be exposed
|
|
# to Consul in the path `/consul/userconfig/<name>/`. The value below is
|
|
# an array of objects, examples are shown below.
|
|
# extraVolumes:
|
|
# - type: secret
|
|
# name: my-secret
|
|
# items: # optional items array
|
|
# - key: key
|
|
# path: path # secret will now mount to /consul/userconfig/my-secret/path
|
|
extraVolumes: []
|
|
|
|
# Resource limits for all terminating gateway pods
|
|
resources:
|
|
requests:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "100Mi"
|
|
cpu: "100m"
|
|
|
|
# By default, we set an anti-affinity so that two of the same gateway pods
|
|
# won't be on the same node. NOTE: Gateways require that Consul client agents are
|
|
# also running on the nodes alongside each gateway pod.
|
|
affinity: |
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app: {{ template "consul.name" . }}
|
|
release: "{{ .Release.Name }}"
|
|
component: terminating-gateway
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
# Optional YAML string to specify tolerations.
|
|
tolerations: null
|
|
|
|
# Optional YAML string to specify a nodeSelector config.
|
|
nodeSelector: null
|
|
|
|
# Optional priorityClassName.
|
|
priorityClassName: ""
|
|
|
|
# Annotations to apply to the terminating gateway deployment. Annotations defined
|
|
# here will be applied to all terminating gateway deployments in addition to any
|
|
# annotations defined for a specific gateway in `terminatingGateways.gateways`.
|
|
# Example:
|
|
# annotations: |
|
|
# "annotation-key": "annotation-value"
|
|
annotations: null
|
|
|
|
# [Enterprise Only] `consulNamespace` defines the Consul namespace to register
|
|
# the gateway into. Requires `global.enableConsulNamespaces` to be true and
|
|
# Consul Enterprise v1.7+ with a valid Consul Enterprise license.
|
|
# Note: The Consul namespace MUST exist before the gateway is deployed.
|
|
consulNamespace: "default"
|
|
|
|
# Gateways is a list of gateway objects. The only required field for
|
|
# each is `name`, though they can also contain any of the fields in
|
|
# `defaults`. Values defined here override the defaults except in the
|
|
# case of annotations where both will be applied.
|
|
gateways:
|
|
- name: terminating-gateway
|
|
|
|
# Control whether a test Pod manifest is generated when running helm template.
|
|
# When using helm install, the test Pod is not submitted to the cluster so this
|
|
# is only useful when running helm template.
|
|
tests:
|
|
enabled: true
|
|
|