values-schema.yaml
Rama main · réplica de lectura del repositorio original.
$schema: 'http://json-schema.org/draft-07/schema'
version: 3
additionalProperties: true
definitions:
rawValues:
description: "May define value overrides for a chart. WARNING: these values currently have no schema and can't be validated as such, and may break deployment. You are on your own here."
type: object
alerts:
additionalProperties: false
type: object
properties:
repeatInterval:
default: 3h
description: Waiting time before sending a notification again after it was sent successfully for an alert.
title: Repeat Interval
type: string
groupInterval:
default: 5m
description: Waiting time before sending a notification about new alerts that are added to a group of alerts.
title: Group Interval
type: string
receivers:
description: Select notification channel(s) for receiving alerts. Use 'none' if no channel available.
title: Notification receivers
type: array
items:
enum:
- slack
- msteams
# - email
- none
type: string
uniqueItems: true
slack:
title: Slack
description: Configure Slack endpoints for alerts.
additionalProperties: false
properties:
channel:
default: mon-apl
description: The Slack channel for non-critical notifications.
title: Non-critical
type: string
channelCrit:
default: mon-apl-crit
description: The Slack channel for critical notifications.
title: Critical
type: string
url:
type: string
description: A Slack webhook URL.
x-secret: ''
# TODO: Enable again when form rework is done
# required:
# - url
type: object
msteams:
additionalProperties: false
description: Configure Microsoft Teams endpoints for alerts.
properties:
highPrio:
title: High prio web hook
type: string
x-secret: ''
lowPrio:
title: Low prio web hook
type: string
x-secret: ''
# TODO: Enable again when form rework is done
# required:
# - highPrio
# - lowPrio
title: Microsoft Teams
type: object
# NOTE: keep this in case email alertReceiver gets re-enabled again
# email:
# title: Email
# description: Configure email endpoints for alerts.
# additionalProperties: false
# properties:
# critical:
# title: Critical Events
# $ref: '#/email'
# description: One or more email addresses (comma separated) for critical events.
# nonCritical:
# title: Non-critical Events
# $ref: '#/email'
# description: One or more email addresses (comma separated) for non-critical events.
# # TODO: Enable again when form rework is done
# # required:
# # - critical
# # - nonCritical
# type: object
annotations:
$ref: '#/definitions/labelsAnnotations'
description: A set of annotations.
autoscaling:
additionalProperties: false
properties:
maxReplicas:
type: integer
default: 10
minReplicas:
type: integer
default: 1
autoscalingEnabled:
additionalProperties: false
properties:
enabled:
default: true
type: boolean
maxReplicas:
type: integer
default: 10
minReplicas:
type: integer
default: 1
targetCPUUtilizationPercentage:
type: integer
default: 80
targetMemoryUtilizationPercentage:
type: integer
default: 80
gatewayAutoscallingEnabled:
additionalProperties: false
properties:
enabled:
default: true
type: boolean
maxReplicas:
type: integer
default: 10
minReplicas:
type: integer
default: 1
targetCPUUtilizationPercentage:
type: integer
default: 80
akamai:
definitions:
dns:
properties:
host:
title: Akamai API host
description: Akamai Edgegrid API server
$ref: '#/definitions/wordCharacterPattern'
accessToken:
title: Akamai access token
description: Akamai Edgegrid API access token
$ref: '#/definitions/wordCharacterPattern'
x-secret: ''
clientToken:
title: Akamai client token
description: Akamai Edgegrid API client token
$ref: '#/definitions/wordCharacterPattern'
x-secret: ''
clientSecret:
title: Akamai client secret
description: Akamai Edgegrid API client secret
$ref: '#/definitions/wordCharacterPattern'
x-secret: ''
required:
- host
- accessToken
- clientToken
- clientSecret
aws:
definitions:
accessKey:
title: AWS access key
description: An AWS access key ID.
$ref: '#/definitions/wordCharacterPattern'
x-secret: ''
secretKey:
title: AWS secret key
description: An AWS secret key.
type: string
x-secret: ''
region:
title: AWS region
description: An AWS region.
$ref: '#/definitions/wordCharacterPattern'
role:
description: Role may be set explicitly if no metadata can be accessed.
example: arn:aws:iam::YYYYYYYYYYYY:role/dns-manager
$ref: '#/definitions/wordCharacterPattern'
azure:
definitions:
clientId:
title: Azure client id
description: An Azure client id.
$ref: '#/definitions/wordCharacterPattern'
clientSecret:
title: Azure client secret
description: An Azure client secret.
type: string
x-secret: ''
dns:
properties:
resourceGroup:
$ref: '#/definitions/azure/definitions/resourceGroup'
hostedZoneName:
title: Hosted zone name
description: Name of the DNS zone that should be used.
$ref: '#/definitions/wordCharacterPattern'
tenantId:
$ref: '#/definitions/azure/definitions/tenantId'
subscriptionId:
$ref: '#/definitions/azure/definitions/subscriptionId'
aadClientId:
$ref: '#/definitions/azure/definitions/clientId'
aadClientSecret:
$ref: '#/definitions/azure/definitions/clientSecret'
title: Client secret
type: string
description: Azure Application Client Secret
x-secret: ''
required:
- tenantId
- subscriptionId
- resourceGroup
- aadClientId
- aadClientSecret
environment:
title: Azure environment
description: An Azure environment.
type: string
default: AzurePublicCloud
enum:
- AzurePublicCloud
- AzureChinaCloud
- AzureUSGovernment
- AzureGermanCloud
tenantId:
title: Azure tenant id
description: An Azure tenant id.
$ref: '#/definitions/wordCharacterPattern'
subscriptionId:
title: Azure subscription id
description: An Azure subscription id.
$ref: '#/definitions/wordCharacterPattern'
resourceGroup:
title: Resource group
description: An Azure resource group.
$ref: '#/definitions/wordCharacterPattern'
catalog:
additionalProperties: false
properties:
name:
type: string
description: 'A lowercase name that starts with a letter and may contain dashes.'
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
repositoryUrl:
type: string
description: 'Git repository URL for the catalog'
pattern: '^(https?|git|ssh)://.*'
branch:
type: string
description: 'Git branch or tag to use'
enabled:
type: boolean
description: 'Whether this catalog is active'
chartsPath:
type: string
description: 'Path within the repository where charts are located'
default: 'charts'
secretName:
type: string
description: 'Kubernetes secret name containing git credentials (for private repos)'
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
required:
- name
- repositoryUrl
- branch
cluster:
additionalProperties: false
properties:
apiServer:
description: Used to generate KUBECONFIG for download, for local access to target cluster.
pattern: '^https:\/\/.*'
domainSuffix:
$ref: '#/definitions/domain'
description: Domain suffix for the cluster. Also added to list of dns zones in the Otomi Console.
k8sContext:
$ref: '#/definitions/k8sContext'
description: Optional. Must be set for development mode and must point to an existing context in KUBECONFIG.
name:
$ref: '#/definitions/idName'
description: Short name that will be used in construction of cluster domain and messaging.
owner:
$ref: '#/definitions/idName'
description: The name of the organization owning the cluster.
default: otomi
provider:
$ref: '#/definitions/provider'
linode:
additionalProperties: false
properties:
tier:
type: string
description: Linode Kubernetes Engine tier (standard LKE or enterprise LKE-E)
enum:
- standard
- enterprise
defaultStorageClass:
type: string
description: Default storage class for platform components. Use '' for relying on the cluster's default storage class.
default: ''
required:
- name
- provider
containerSpecNoSec:
properties:
image:
$ref: '#/definitions/image'
resources:
$ref: '#/definitions/resources'
env:
$ref: '#/definitions/env'
files:
$ref: '#/definitions/files'
nativeSecrets:
$ref: '#/definitions/nativeSecrets'
description: Reserved for internal use.
secrets:
$ref: '#/definitions/secrets'
secretMounts:
$ref: '#/definitions/secretMounts'
command:
type: array
items:
type: string
args:
type: array
items:
type: string
required:
- image
- resources
containerSpec:
allOf:
- $ref: '#/definitions/securityContext'
- $ref: '#/definitions/containerSpecNoSec'
cpuQuantity:
description: Amount of cpu cores, or slice of cpu core in millis.
examples:
- '1'
- 200m
pattern: ^([1-9][0-9]*|([0]|[1-9]+)\\.[0-9]{1,3}|[1-9][0-9]*m)$
type: string
domain:
pattern: ^([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)*[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?$
type: string
wildcardDomainOrIp:
pattern: ^((\*\.)?([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)*[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?|([a-f0-9:]+:+)+[a-f0-9]+)$
type: string
duration:
description: 'Prometheus duration (See: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#configuration-file)'
pattern: '((([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?|0)'
type: string
default: 1d
email:
pattern: '^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$'
type: string
env:
additionalProperties: false
examples:
- FOO: bar
- bar: foo
patternProperties:
'[a-zA-Z_]{1,}[a-zA-Z0-9_]*':
maxLength: 131072
type: string
nullable: true
type: object
title: Environment variables
files:
additionalProperties: false
description: Dictionary of absolute path > content pairs.
patternProperties:
'^[/].*':
type: string
google:
additionalProperties: false
definitions:
accountJson:
type: string
x-secret: ''
project:
$ref: '#/definitions/wordCharacterPattern'
hostPort:
pattern: '^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]):()([1-9]|[1-5]?[0-9]{2,4}|6[1-4][0-9]{3}|65[1-4][0-9]{2}|655[1-2][0-9]|6553[1-5])$'
type: string
idName:
description: A lowercase name that starts with a letter and may contain dashes.
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
type: string
image:
additionalProperties: false
properties:
pullPolicy:
default: IfNotPresent
enum:
- IfNotPresent
- Always
type: string
repository:
$ref: '#/definitions/repository'
tag:
default: latest
$ref: '#/definitions/wordCharacterPattern'
title: Container image
imagePullPolicy:
default: IfNotPresent
enum:
- IfNotPresent
- Always
type: string
imageTag:
x-default: stable
pattern: '[\w][\w.-]{0,127}'
type: string
x-message: a valid container registry image tag
imageSimple:
properties:
tag:
$ref: '#/definitions/imageTag'
pullPolicy:
$ref: '#/definitions/imagePullPolicy'
required:
- tag
type: object
title: Container image
ingressClassParameters:
type: object
properties:
entrypoint:
description: A public IP address that has a route to a private loadbalancer ip, allowing access to private clusters. (Provider "custom" only.)
type: string
network:
title: Load balancer type
type: string
enum:
- public
default: public
loadBalancerIP:
title: Load balancer IP address
description: A static IP address assigned to a load balancer
type: string
sourceIpAddressFiltering:
title: Source IP address filtering
type: string
description: 'Whitelist source IP address ranges. The value is a comma separated list of CIDRs, e.g. 10.0.0.0/24,172.10.0.1'
annotations:
properties:
annotations:
$ref: '#/definitions/annotations'
gateway:
type: object
description: 'Ingress gateway deployment configuration'
properties:
replicas:
type: integer
minimum: 1
minAvailable:
type: integer
minimum: 1
resources:
$ref: '#/definitions/resources'
autoscaling:
$ref: '#/definitions/gatewayAutoscallingEnabled'
ipV4Address:
type: string
pattern: ^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$
jobs:
description: You may pass an array of Job objects. The Kubernetes API accepts
a Job specification, which is meant for run-to-completion apps (e.g. batch
Jobs).
items:
type: object
allOf:
- properties:
id:
type: string
readOnly: true
type: object
- $ref: '#/definitions/jobSpec'
- $ref: '#/definitions/podSpec'
type: array
jobSpec:
properties:
type:
default: Job
enum:
- Job
- CronJob
type: string
name:
$ref: '#/definitions/idName'
title: Name
description: A job name
example: some-job
enabled:
default: true
type: boolean
runPolicy:
default: OnSpecChange
description: |
If runPolicy is set to 'Always', the job controller will always be re-deployed after a successful deployment with Helm.
If runPolicy is set to 'OnSpecChange', the job controller will only be re-deployed if one changes this specification.
enum:
- Always
- OnSpecChange
type: string
schedule:
default: 0 1 * * *
description: Must give a cron-type expression if the job type is 'Cronjob'.
type: string
script:
$ref: '#/definitions/script'
shell:
default: /bin/sh
description: Full path to a shell binary that exists in the image.
type: string
ttlSecondsAfterFinished:
default: 86400
description: Time To Live after job is finished in seconds. Will be removed afterwards.
minimum: 0
title: TTL after finished
type: integer
init:
type: array
items:
$ref: '#/definitions/containerSpec'
nullable: true
required:
- name
- script
- type
type: object
k8sContext:
description: The cluster k8s context as found in $KUBECONFIG.
$ref: '#/definitions/wordCharacterPattern'
labels:
$ref: '#/definitions/labelsAnnotations'
description: A set of labels.
labelsAnnotations:
additionalProperties: false
patternProperties:
'^((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]){1,253}\/)?([a-z0-9A-Z]+[a-z0-9A-Z-_.]+[a-z0-9A-Z]){1,63}$':
pattern: '^((.){1,253}\/)?(.){1,63}$'
type: string
logLevel:
type: string
default: info
enum:
- error
- warn
- info
- debug
- trace
memoryQuantity:
description: Amount of memory. Valid units are E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki.
examples:
- 1Mi
- 0.5M
pattern: '^([0-9]+\.)?[0-9]+(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$'
type: string
nativeSecrets:
description: List of kubernetes secret names.
additionalProperties: false
patternProperties:
'[a-zA-Z_]{1,}[a-zA-Z0-9_]*':
maxLength: 131072
type: string
nullable: true
type: object
title: Kubernetes secrets
appNetworkPolicyConfig:
type: object
properties:
enabled:
type: boolean
default: false
description: Enable network policies for this application with sensible defaults
netpol:
type: object
properties:
name:
$ref: '#/definitions/idName'
title: Network Policy name
description: 'A unique name for the network policy'
ruleType:
properties:
type:
type: string
enum:
- ingress
- egress
ingress:
properties:
toLabelName:
type: string
title: Selector label name
description: 'The name of the Pod selector label'
toLabelValue:
type: string
title: Selector label value
description: 'The value of the Pod selector label'
mode:
default: AllowOnly
enum:
- AllowOnly
- AllowAll
allow:
title: Add team or team with service
type: array
items:
type: object
properties:
fromLabelName:
type: string
title: Selector label name
description: 'The name of the Pod selector label'
fromLabelValue:
type: string
title: Selector label value
description: 'The value of the Pod selector label'
fromNamespace:
$ref: '#/definitions/idName'
title: Namespace name
description: 'The name of the namespace'
required:
- fromNamespace
egress:
properties:
domain:
title: FQDN, Wildcard domain, or IP address
$ref: '#/definitions/wildcardDomainOrIp'
ports:
properties:
number:
title: Port number
type: integer
minimum: 1
maximum: 65535
protocol:
title: Protocol
type: string
enum: [HTTPS, HTTP, TCP]
default: HTTPS
required:
- number
- protocol
default:
- number: 443
protocol: HTTPS
required:
- domain
required:
- type
required:
- name
path:
description: An absolute path
type: string
pattern: '^[/].*$'
podSecurityContext:
allOf:
- $ref: '#/definitions/securityContext'
- properties:
fsGroup:
description: Supplementary group ID. Volumes that support ownership management are modified to be owned and writable by this ID.
$ref: '#/definitions/unixOwnerId'
fsGroupChangePolicy:
description: |
'Defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions.
This field has two possible values:
- OnRootMismatch: Only change permissions and ownership if permission and ownership of root directory does not match with expected permissions of the volume. This could help shorten the time it takes to change ownership and permission of a volume.
- Always: Always change permission and ownership of the volume when volume is mounted.'
type: string
enum:
- Always
- OnRootMismatch
description: Security context for the pod.
title: Pod security context
podSpec:
allOf:
- properties:
annotations:
$ref: '#/definitions/annotations'
title: Pod annotations
type: object
- $ref: '#/definitions/podSecurityContext'
- $ref: '#/definitions/containerSpec'
type: object
portNumber:
maximum: 32768
minimum: 80
type: integer
provider:
type: string
description: Enter the cloud provider of the cluster.
enum:
- custom
- linode
default: linode
registry:
pattern: '^[a-z0-9]+(?:[._-][a-z0-9]+)*$'
type: string
repoUrl:
description: Path to a remote git repo with or without protocol prefix of either https:// or file:// (https:// used if omitted)
pattern: '^(https://|file://)?(.+@)*([\w\d\.]+)(:[\d]+){0,1}/*(.*)$'
type: string
repository:
description: A container image repository.
pattern: '^[a-z0-9]+(?:[/._-]{1,2}[a-z0-9]+)*$'
type: string
resource:
additionalProperties: false
properties:
cpu:
$ref: '#/definitions/cpuQuantity'
memory:
$ref: '#/definitions/memoryQuantity'
required:
- cpu
- memory
resources:
additionalProperties: false
description: Compute resources for containers.
properties:
limits:
$ref: '#/definitions/resource'
description: Requested resources (best effort).
requests:
$ref: '#/definitions/resource'
description: Requested resources (guaranteed).
required:
- limits
- requests
title: Pod resources
unixOwnerIdRange:
type: object
additionalProperties: false
required: [min, max]
properties:
min:
type: integer
minimum: 0
maximum: 65535
max:
type: integer
minimum: 0
maximum: 65535
unixOwnerId:
description: The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
type: integer
minimum: 0
maximum: 65535
default: 1001
script:
description: May specify a non-empty string containing an executable script.
type: string
properties:
id:
readOnly: true
type: string
name:
$ref: '#/definitions/idName'
required:
- name
- type
backupSchedule:
default: 0 0 * * *
description: Cron-type expression to schedule the backup. Defaults to once a day at 00:00.
type: string
secret:
type: object
properties:
id:
readOnly: true
type: string
clusterWide:
description: Will create the secret in all namespaces.
type: boolean
default: false
teamWide:
description: Will create the secret in all team-* namespaces.
type: boolean
default: false
name:
$ref: '#/definitions/idName'
namespace:
$ref: '#/definitions/idName'
description: A kubernetes namespace.
required:
- name
oneOf:
- title: Generic
properties:
type:
default: generic
enum:
- generic
entries:
type: array
items:
description: A property name at vaultPath
minItems: 1
# a valid secret key must consist of alphanumeric characters, '-', '_' or '.' (e.g. 'key.name', or 'KEY_NAME', or 'key-name' )
pattern: '^[-._a-zA-Z0-9]+$'
type: string
uniqueItems: true
required:
- type
- entries
- title: Docker registry
properties:
type:
default: docker-registry
enum:
- docker-registry
type: string
required:
- type
- title: TLS
properties:
type:
default: tls
enum:
- tls
type: string
crt:
type: string
default: 'tls.crt'
key:
type: string
default: 'tls.key'
ca:
type: string
default: 'ca.crt'
required:
- type
- crt
- key
secrets:
description: List of secret names that will have their props injected as env vars into the container.
items:
type: string
pattern: '[a-zA-Z_]{1,}[a-zA-Z0-9_]*'
nullable: true
title: Secrets
type: array
secretMounts:
description: Dictionary of absolute folder path > secret name. Will mount the contents of the secret in the container at the specified folder path.
examples:
- /foo: bar
nullable: true
patternProperties:
'^[/].*$':
type: string
title: Secret mounts
type: object
secretTemplates:
definitions:
otomiAdminUsername:
x-secret: 'otomi-admin'
securityContext:
additionalProperties:
uniqueItems: true
properties:
runAsUser:
$ref: '#/definitions/unixOwnerId'
runAsNonRoot:
description: Enforces that the container must run as non root. This implies that the UID must also be set with runAsUser.
type: boolean
default: true
runAsGroup:
description: The GID to run the entrypoint of the container process. Defaults to group specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
$ref: '#/definitions/unixOwnerId'
service:
additionalProperties: false
properties:
trafficControl:
title: Traffic Control
description: Split traffic between multiple services (blue/green, canary)
properties:
enabled:
type: boolean
default: false
weightV1:
type: integer
default: 90
weightV2:
type: integer
default: 10
headers:
properties:
response:
properties:
set:
type: array
items:
type: object
properties:
name:
type: string
value:
type: string
required:
- name
- value
request:
properties:
set:
type: array
items:
type: object
properties:
name:
type: string
value:
type: string
required:
- name
- value
ksvc:
type: object
properties:
predeployed:
description: Set this flag it the service is managed by knative service
type: boolean
default: false
name:
$ref: '#/definitions/idName'
description: Short name. Will be used for generation of knative service name, as well as service URL.
namespace:
$ref: '#/definitions/idName'
description: A kubernetes namespace. Only used by core services, so should be disallowed for non-admins.
paths:
items:
description: |
Path mapping to only route certain paths to the service. This allows micro services to operate on the same domain and port.
When left empty all paths will go to this service.
$ref: '#/definitions/wordCharacterPattern'
# nullable: true
type: array
port:
$ref: '#/definitions/portNumber'
description: Points to the backing k8s service (only used when 'svc' is set).
ingressClassName:
description: Ingress class name
$ref: '#/definitions/idName'
default: platform
svc:
$ref: '#/definitions/idName'
description: When given a backing k8s service is expected to be deployed with this name, which will be exposed through this team service.
useCname:
description: Will configure additional host(CNAME) for the service.
type: boolean
default: false
cname:
properties:
domain:
description: CNAME of the service.
type: string
tlsSecretName:
description: Kubernetes secret name of type TLS.
$ref: '#/definitions/idName'
removeRequestHeaders:
description: >-
Strip selected headers from HTTP request.
type: array
items:
type: string
required:
- name
size:
description: Disk size. Valid units are E|P|T|G|Ti|Gi.
examples:
- 1Gi
- 0.5Ti
pattern: '^([0-9]+\.)?[0-9]+(E|P|T|G||Ti|Gi)?$'
type: string
subdomainType:
type: string
# A lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com')
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
team:
additionalProperties: false
properties:
settings:
properties:
id:
$ref: '#/definitions/idName'
description: Must be the same as the name.
networkPolicy:
ingressPrivate:
title: Enable filtering of ingress traffic inside the cluster
description: When set a user can define ingress from other services for a particular team service
type: boolean
default: true
egressPublic:
title: Enable filtering of egress traffic outside the cluster
description: When set a user can define egress towards FQDNs and public IPs for a team service
type: boolean
default: true
managedMonitoring:
title: Managed monitoring
description: Activate managed Grafana, Prometheus or Alertmanager instances
properties:
grafana:
type: boolean
alertmanager:
type: boolean
limitRange:
description: 'Kubernetes limit range. As is.'
properties:
default:
$ref: '#/definitions/resource'
defaultRequest:
$ref: '#/definitions/resource'
oidc:
additionalProperties: false
properties:
groupMapping:
description: IDP group id to map onto this team.
$ref: '#/definitions/wordCharacterPattern'
resourceQuota:
description: 'List of kubernetes resource quota. Should adhere to the "spec.hard" format as described here: https://kubernetes.io/docs/concepts/policy/resource-quotas/. Not validated as there is no schema published. Change at your own risk.'
type: array
items:
type: object
properties:
name:
type: string
value:
type: string
required:
- name
- value
selfService:
$ref: '#/definitions/teamSelfService'
alerts:
$ref: '#/definitions/alerts'
apps:
additionalProperties: true
alertmanager:
additionalProperties: false
properties:
resources:
$ref: '#/definitions/resources'
grafana:
additionalProperties: false
properties:
additionalProperties: false
properties:
grafana:
$ref: '#/definitions/resources'
sidecar:
$ref: '#/definitions/resources'
tekton:
additionalProperties: false
properties:
resources:
additionalProperties: false
properties:
dashboard:
$ref: '#/definitions/resources'
buildpacksTask:
$ref: '#/definitions/resources'
gitCloneTask:
$ref: '#/definitions/resources'
grypeTask:
$ref: '#/definitions/resources'
kanikoTask:
$ref: '#/definitions/resources'
services:
items:
$ref: '#/definitions/service'
type: array
netpols:
items:
$ref: '#/definitions/netpol'
type: array
workloads:
type: array
items:
$ref: '#/definitions/workload'
policies:
type: object
builds:
type: array
items:
$ref: '#/definitions/build'
codeRepos:
type: array
items:
$ref: '#/definitions/codeRepo'
teamSelfService:
title: Team Permissions
description: Grant team permissions to modify certain configuration parameters.
type: object
properties:
teamMembers:
title: Team Members Permissions
type: object
properties:
createServices:
title: Create Services
type: boolean
default: false
description: Permission to create services.
editSecurityPolicies:
title: Edit Security Policies
type: boolean
default: false
description: Permission to edit security policies.
useCloudShell:
title: Use Cloud Shell
type: boolean
default: false
description: Permission to use the cloud shell.
downloadKubeconfig:
title: Download Kubeconfig
type: boolean
default: false
description: Permission to download the kubeconfig.
downloadDockerLogin:
title: Download Docker Login
type: boolean
default: false
description: Permission to download the docker login configuration.
required:
- createServices
- editSecurityPolicies
- useCloudShell
- downloadKubeconfig
- downloadDockerLogin
x-acl:
platformAdmin: [read-any, update-any]
teamAdmin: [read]
teamMember: [read]
backupRetentionPolicy:
default: 7d
description: Delete backups according to retention policy. In DAYS|WEEKS|MONTHS
title: Retention policy
type: string
url:
pattern: '^https?:\/\/[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*)'
type: string
volumes:
items:
additionalProperties: false
properties:
name:
description: Name must match mount name.
$ref: '#/definitions/idName'
configMap:
properties:
name:
$ref: '#/definitions/idName'
type: array
wordCharacterPattern:
type: string
# At least one non whitespace character
pattern: ^[^\s]+$
policies:
type: object
build:
type: object
description: Define location of code to build
properties:
name:
description: Name of the build
$ref: '#/definitions/idName'
imageName:
description: Name of the image
$ref: '#/definitions/idName'
tag:
description: Image tag
$ref: '#/definitions/imageTag'
trigger:
type: boolean
default: false
externalRepo:
type: boolean
description: Select when using an external private Git repository.
default: false
scanSource:
type: boolean
default: true
description: Select to scan source
secretName:
description: The name of the secret with the credentials of the external private Git repository
$ref: '#/definitions/idName'
mode:
properties:
docker:
properties:
repoUrl:
description: URL of the Git repository holding the application code.
$ref: '#/definitions/url'
revision:
description: This may be a commit sha, branch name, or tag. If omitted, will equal to HEAD.
$ref: '#/definitions/wordCharacterPattern'
default: HEAD
path:
description: A relative directory path within the Git repository.
type: string
default: ./Dockerfile
envVars:
type: array
items:
type: object
properties:
name:
type: string
value:
type: string
required:
- name
- value
buildpacks:
properties:
repoUrl:
description: URL of the Git repository holding the application code.
$ref: '#/definitions/url'
revision:
description: This may be a commit sha, branch name, or tag. If omitted, will equal to HEAD.
$ref: '#/definitions/wordCharacterPattern'
default: HEAD
path:
description: A relative directory path within the Git repository.
type: string
envVars:
type: array
items:
type: object
properties:
name:
type: string
value:
type: string
required:
- name
- value
required:
- name
sealedsecret:
type: object
description: Define location of code to build
properties:
name:
$ref: '#/definitions/idName'
namespace:
$ref: '#/definitions/idName'
immutable:
description: 'Immutable, if set to true, ensures that data stored in the Secret cannot be updated (only object metadata can be modified).'
type: boolean
type:
description: Used to facilitate programmatic handling of secret data.
type: string
default: kubernetes.io/opaque
enum:
[
'kubernetes.io/opaque',
'kubernetes.io/service-account-token',
'kubernetes.io/dockercfg',
'kubernetes.io/dockerconfigjson',
'kubernetes.io/basic-auth',
'kubernetes.io/ssh-auth',
'kubernetes.io/tls',
]
encryptedData:
type: object
metadata:
type: object
required:
- type
- encryptedData
- name
workload:
type: object
description: Define location of the application's manifests or chart
properties:
name:
$ref: '#/definitions/idName'
url:
description: URL to either Helm or Git repository
$ref: '#/definitions/url'
chartProvider:
type: string
title: Chart provider
enum: ['helm', 'git']
default: git
path:
description: A relative directory path within the Git repository. Absolute paths cause errors. (only valid for applications sourced from Git)
$ref: '#/definitions/wordCharacterPattern'
chart:
description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo.
$ref: '#/definitions/wordCharacterPattern'
revision:
description: In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version.
$ref: '#/definitions/wordCharacterPattern'
default: HEAD
chartMetadata:
title: ''
properties:
helmChartVersion:
type: string
title: Helm chart version
default: ''
helmChartDescription:
type: string
title: Helm chart description
default: ''
namespace:
description: Workload namespace. Applicable only for team-admin. Default value is 'team-<team_id>'
$ref: '#/definitions/idName'
createNamespace:
type: boolean
default: false
sidecarInject:
type: boolean
default: false
imageUpdateStrategy:
description: Automatically update the image. Only supported wit Helm charts in local Gitea repository and images stored in Harbor.
title: Auto Image Updater
additionalProperties: false
properties:
digest:
additionalProperties: false
properties:
imageRepository:
type: string
description: The container image repository name
$ref: '#/definitions/wordCharacterPattern'
tag:
$ref: '#/definitions/wordCharacterPattern'
imageParameter:
type: string
default: image.name
description: The parameter for specifying the image name
tagParameter:
type: string
default: image.tag
description: The parameter for specifying the image tag
required:
- tag
semver:
additionalProperties: false
properties:
imageRepository:
type: string
description: The container image repository name
$ref: '#/definitions/wordCharacterPattern'
versionConstraint:
$ref: '#/definitions/wordCharacterPattern'
imageParameter:
type: string
default: image.name
description: The parameter for specifying the image name
tagParameter:
type: string
default: image.tag
description: The parameter for specifying the image tag
required:
- versionConstraint
type:
type: string
enum:
- semver
- digest
- disabled
default: disabled
required:
- type
required:
- name
- url
codeRepo:
type: object
description: Define location of code repository to build
properties:
name:
$ref: '#/definitions/idName'
gitService:
description: Git service provider
type: string
default: gitea
enum:
- gitea
- github
- gitlab
repositoryUrl:
description: URL of the Git repository holding the application code.
$ref: '#/definitions/repoUrl'
private:
type: boolean
default: false
secret:
description: The name of the secret with the credentials of the external private Git repository
type: string
required:
- name
- gitService
- repositoryUrl
properties:
alerts:
$ref: '#/definitions/alerts'
installation:
type: object
description: Top-level installation settings.
required:
- mode
additionalProperties: true
properties:
mode:
type: string
description: |
Installation execution mode.
- `standard`: runs the normal installation workflow and follows the configuration bootstrap process.
- `recovery`: runs recovery behavior intended to restore configuration that is stored in external git repository. It neither bootstraps nor initializes the configuration. For this mode `git` and `kms` objects are required so the operator knows how access and decrypt the data.
enum:
- recovery
- standard
default: standard
recovery:
type: object
description: Recovery settings for disaster recovery scenarios. Only used when mode=recovery.
properties:
manifests:
type: object
description: >
K8s resource List containing recovery manifests (e.g., sealed-secrets TLS key pairs)
to apply during installation. Not stored in the values repository.
Export from old cluster:
kubectl get secret -n sealed-secrets -l sealedsecrets.bitnami.com/sealed-secrets-key=active -o yaml
properties:
apiVersion:
type: string
kind:
type: string
items:
type: array
items:
type: object
additionalProperties: true
metadata:
type: object
additionalProperties: true
additionalProperties: true
azure:
description: Azure specific configuration.
properties:
storageType:
properties:
fast:
type: string
standard:
type: string
appgw:
properties:
isManaged:
default: false
description: Indicates Azure Application Gateway Ingress Controller add-on is installed by AKS.
type: boolean
apps:
additionalProperties: true
properties:
alertmanager:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
image:
$ref: '#/definitions/imageSimple'
resources:
properties:
alertmanger:
$ref: '#/definitions/resources'
argocd:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
controllerStatusProcessors:
default: 20
type: integer
controllerOperationProcessors:
default: 10
type: integer
applicationSet:
replicas:
default: 1
type: integer
controller:
replicas:
default: 1
type: integer
autoscaling:
repoServer:
$ref: '#/definitions/autoscalingEnabled'
server:
$ref: '#/definitions/autoscalingEnabled'
resources:
additionalProperties: false
properties:
server:
$ref: '#/definitions/resources'
controller:
$ref: '#/definitions/resources'
repo:
$ref: '#/definitions/resources'
redis:
$ref: '#/definitions/resources'
applicationSet:
$ref: '#/definitions/resources'
notifications:
$ref: '#/definitions/resources'
imageUpdater:
$ref: '#/definitions/resources'
cert-manager:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
networkPolicies:
$ref: '#/definitions/appNetworkPolicyConfig'
resources:
certManager:
$ref: '#/definitions/resources'
startupapicheck:
$ref: '#/definitions/resources'
cainjector:
$ref: '#/definitions/resources'
webhook:
$ref: '#/definitions/resources'
byoWildcardCert:
description: 'Bring your own trusted wildcard certificate. Only applicable for byo-wildcard-cert issuer'
type: string
byoWildcardCertKey:
description: 'A certificate key corresponding to the byoWildcardCert.'
type: string
x-secret: ''
externallyManagedTlsSecretName:
description: |
The name of a custom secret in the istio-system namespace that contains a trusted certificate and private key.
To be used with issuer externally-managed-tls-secret.
$ref: '#/definitions/idName'
customRootCA:
type: string
description: CA that is used to create and verify self-signed certificates. Leave it empty to generate one automatically.
customRootCAKey:
x-secret: ''
type: string
description: CA private key that is used to issue certificates. Leave it empty to generate one automatically.
email:
$ref: '#/definitions/email'
issuer:
description: |
Indicates the origin of the wildcard certificate.
The custom-ca - cert-manager uses the customRootCA to generate wildcard certificate.
The letsencrypt - cert-manager requests certificate from letsencrypt endpoint.
The byo-wildcard-cert allows users to bring their own trusted wildcard certificate (cert-manager not involved)
through the values byoWildcardCert and byoWildcardCertKey.
The externally-managed-tls-secret is similar to byo-wildcard-cert, but assumes the certificate is already stored
in a secret (referenced by externallyManagedTlsSecretName) and not provided through the values.
type: string
enum:
- custom-ca
- letsencrypt
- byo-wildcard-cert
- externally-managed-tls-secret
default: custom-ca
stage:
type: string
enum:
- production
- staging
default: production
cnpg:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
$ref: '#/definitions/resources'
barmanPluginResources:
$ref: '#/definitions/resources'
useBackupPlugin:
type: boolean
default: false
description: Use CNPG plugin for platform database backups
dex:
additionalProperties: false
description: Dex is an OIDC identity broker, installed by default. otomi.oidc.authenticationLayer decides whether it is actually used.
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
idp:
additionalProperties: false
properties:
clientID:
$ref: '#/definitions/wordCharacterPattern'
default: otomi
description: The OAuth2 client identifier platform applications will use against Dex.
replicas:
type: integer
default: 2
description: Number of Dex replicas. More than one requires all replicas to share the same storage backend.
resources:
$ref: '#/definitions/resources'
networkPolicies:
$ref: '#/definitions/appNetworkPolicyConfig'
external-dns:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
logLevel:
type: string
default: 'info'
resources:
$ref: '#/definitions/resources'
external-secrets:
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
properties:
operator:
$ref: '#/definitions/resources'
gitea:
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
adminUsername:
type: string
default: otomi-admin
databaseMaxConnections:
type: number
description: Maximum amount of total connections of the application to the database server
databaseMaxIdleConnections:
type: number
description: Maximum amount of idle connections of the application to the database server
resources:
additionalProperties: false
properties:
gitea:
$ref: '#/definitions/resources'
init:
$ref: '#/definitions/resources'
networkPolicies:
$ref: '#/definitions/appNetworkPolicyConfig'
grafana:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
image:
$ref: '#/definitions/imageSimple'
resources:
grafana:
$ref: '#/definitions/resources'
sidecar:
$ref: '#/definitions/resources'
harbor:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: true
privateLibrary:
type: boolean
default: true
description: Will mark the main project named "library" as private.
oidcAutoOnboard:
type: boolean
oidcUserClaim:
type: string
databaseMaxConnections:
type: number
description: Maximum amount of total connections of the application to the database server
databaseMaxIdleConnections:
type: number
description: Maximum amount of idle connections of the application to the database server
resources:
additionalProperties: false
properties:
core:
$ref: '#/definitions/resources'
jobservice:
$ref: '#/definitions/resources'
portal:
$ref: '#/definitions/resources'
redis:
$ref: '#/definitions/resources'
registry:
$ref: '#/definitions/resources'
registryController:
$ref: '#/definitions/resources'
trivy:
$ref: '#/definitions/resources'
nginx:
$ref: '#/definitions/resources'
istio:
properties:
_rawValues:
$ref: '#/definitions/rawValues'
autoscaling:
properties:
egressgateway:
$ref: '#/definitions/autoscaling'
ingressgateway:
$ref: '#/definitions/autoscaling'
pilot:
$ref: '#/definitions/autoscaling'
egressGateway:
properties:
enabled:
default: false
type: boolean
global:
additionalProperties: false
properties:
logging:
properties:
level:
type: string
extensionProviders:
description: 'See: https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig'
type: array
items:
type: object
image:
$ref: '#/definitions/imageSimple'
ambient:
description: Enable Istio ambient mesh
type: boolean
resources:
properties:
egressgateway:
$ref: '#/definitions/resources'
ingressgateway:
$ref: '#/definitions/resources'
ingressgateway-private:
$ref: '#/definitions/resources'
pilot:
$ref: '#/definitions/resources'
proxy:
$ref: '#/definitions/resources'
operator:
$ref: '#/definitions/resources'
keycloak:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: true
description: Whether Keycloak is deployed. Independent of otomi.oidc.authenticationLayer — enabling Keycloak does not select it as the issuer.
idp:
additionalProperties: false
properties:
alias:
type: string
default: otomi-idp
clientID:
$ref: '#/definitions/wordCharacterPattern'
default: otomi
adminUsername:
type: string
default: otomi-admin
theme:
type: string
default: otomi
image:
properties:
keycloak:
$ref: '#/definitions/imageSimple'
postgresql:
$ref: '#/definitions/imageSimple'
databaseMaxConnections:
type: number
description: Maximum amount of total connections of the application to the database server
databaseMinConnections:
type: number
description: Minimum amount of connections of the application to the database server
databaseInitialConnections:
type: number
description: Initial amount of connections of the application to the database server on startup
resources:
additionalProperties: false
properties:
keycloak:
$ref: '#/definitions/resources'
operator:
$ref: '#/definitions/resources'
kserve:
additionalProperties: false
properties:
enabled:
type: boolean
default: false
_rawValues:
$ref: '#/definitions/rawValues'
resources:
additionalProperties: false
properties:
controller:
$ref: '#/definitions/resources'
rbacProxy:
$ref: '#/definitions/resources'
inferenceService:
$ref: '#/definitions/resources'
kyverno:
additionalProperties: false
properties:
enabled:
type: boolean
default: false
_rawValues:
$ref: '#/definitions/rawValues'
mode:
type: string
enum: ['DevTest', 'Prod']
default: DevTest
resources:
additionalProperties: false
properties:
admissionController:
$ref: '#/definitions/resources'
cleanupController:
$ref: '#/definitions/resources'
backgroundController:
$ref: '#/definitions/resources'
reportsController:
$ref: '#/definitions/resources'
policy-reporter:
additionalProperties: false
properties:
enabled:
type: boolean
default: false
_rawValues:
$ref: '#/definitions/rawValues'
resources:
$ref: '#/definitions/resources'
knative:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: true
resources:
queueSidecar:
$ref: '#/definitions/resources'
controller:
$ref: '#/definitions/resources'
activator:
$ref: '#/definitions/resources'
webhook:
$ref: '#/definitions/resources'
autoscaler:
$ref: '#/definitions/resources'
autoscalerHpa:
$ref: '#/definitions/resources'
operator:
$ref: '#/definitions/resources'
operatorWebhook:
$ref: '#/definitions/resources'
serving:
type: object
properties:
replicas:
default: 1
type: integer
minimum: 1
gateway:
type: object
description: 'Knative local gateway deployment configuration'
properties:
replicas:
type: integer
minimum: 1
minAvailable:
type: integer
minimum: 1
resources:
$ref: '#/definitions/resources'
autoscaling:
$ref: '#/definitions/gatewayAutoscallingEnabled'
kubeflow-pipelines:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
default: false
type: boolean
persistence:
properties:
mysql:
properties:
size:
default: 20Gi
$ref: '#/definitions/size'
resources:
additionalProperties: false
properties:
cacheDeployer:
$ref: '#/definitions/resources'
cacheServer:
$ref: '#/definitions/resources'
metadataEnvoy:
$ref: '#/definitions/resources'
metadataGrpc:
$ref: '#/definitions/resources'
metadataWriter:
$ref: '#/definitions/resources'
mlPipeline:
$ref: '#/definitions/resources'
mlPipelinePersistenceagent:
$ref: '#/definitions/resources'
mlPipelineScheduledworkflow:
$ref: '#/definitions/resources'
mlPipelineUi:
$ref: '#/definitions/resources'
mlPipelineViewer:
$ref: '#/definitions/resources'
mlPipelineVisualizationserver:
$ref: '#/definitions/resources'
mysql:
$ref: '#/definitions/resources'
workflowController:
$ref: '#/definitions/resources'
linode-cfw:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
sealed-secrets:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
properties:
operator:
$ref: '#/definitions/resources'
tekton:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
resources:
additionalProperties: false
properties:
dashboard:
$ref: '#/definitions/resources'
pipelinesController:
$ref: '#/definitions/resources'
pipelinesRemoteresolver:
$ref: '#/definitions/resources'
pipelinesEvents:
$ref: '#/definitions/resources'
pipelinesWebhook:
$ref: '#/definitions/resources'
triggersInterceptors:
$ref: '#/definitions/resources'
triggersController:
$ref: '#/definitions/resources'
triggersWebhook:
$ref: '#/definitions/resources'
loki:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
resources:
additionalProperties: false
properties:
compactor:
$ref: '#/definitions/resources'
ingester:
$ref: '#/definitions/resources'
gateway:
$ref: '#/definitions/resources'
querier:
$ref: '#/definitions/resources'
distributor:
$ref: '#/definitions/resources'
queryFrontend:
$ref: '#/definitions/resources'
reverseProxy:
$ref: '#/definitions/resources'
queryScheduler:
$ref: '#/definitions/resources'
indexGateway:
$ref: '#/definitions/resources'
singleBinary:
$ref: '#/definitions/resources'
autoscaling:
properties:
ingester:
$ref: '#/definitions/autoscalingEnabled'
gateway:
$ref: '#/definitions/autoscalingEnabled'
querier:
$ref: '#/definitions/autoscalingEnabled'
distributor:
$ref: '#/definitions/autoscalingEnabled'
queryFrontend:
$ref: '#/definitions/autoscalingEnabled'
queryScheduler:
$ref: '#/definitions/autoscalingEnabled'
persistentVolumeSize:
$ref: '#/definitions/size'
v13SchemaStartDate:
description: Automatically set to a date in the future in case of an upgrade
title: Schema v13 start date
type: string
networkPolicies:
$ref: '#/definitions/appNetworkPolicyConfig'
metrics-server:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: true
apiServer:
additionalProperties: false
properties:
create:
type: boolean
default: true
extraArgs:
type: array
resources:
$ref: '#/definitions/resources'
oauth2-proxy:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
$ref: '#/definitions/resources'
oauth2-proxy-redis:
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
additionalProperties: false
properties:
master:
$ref: '#/definitions/resources'
sentinel:
$ref: '#/definitions/resources'
replicas:
type: integer
persistentVolumeSize:
$ref: '#/definitions/size'
type: object
otomi-api:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
editorInactivityTimeout:
type: integer
default: 10
kubeconfigExpirationSeconds:
type: integer
resources:
additionalProperties: false
properties:
api:
$ref: '#/definitions/resources'
tools:
$ref: '#/definitions/resources'
networkPolicies:
$ref: '#/definitions/appNetworkPolicyConfig'
otomi-console:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
$ref: '#/definitions/resources'
allOf:
- anyOf:
- not:
properties:
enabled:
const: true
required:
- enabled
- properties:
registry:
required:
- username
- password
type: object
apl-harbor-operator:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
additionalProperties: false
properties:
operator:
$ref: '#/definitions/resources'
apl-gitea-operator:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
additionalProperties: false
properties:
operator:
$ref: '#/definitions/resources'
apl-keycloak-operator:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
additionalProperties: false
properties:
operator:
$ref: '#/definitions/resources'
apl-operator:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
resources:
additionalProperties: false
properties:
operator:
$ref: '#/definitions/resources'
git-server:
additionalProperties: false
properties:
enabled:
type: boolean
htpasswd:
type: string
x-secret: ''
_rawValues:
$ref: '#/definitions/rawValues'
resources:
$ref: '#/definitions/resources'
createHttpRoute:
type: boolean
prometheus:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
disabledRules:
type: array
items:
type: string
remoteWrite:
properties:
enabled:
type: boolean
default: false
insecureSkipVerify:
type: boolean
default: false
rwConfig:
properties:
target:
type: string
basicAuth:
properties:
enabled:
type: boolean
default: false
username:
type: string
password:
$ref: '#/definitions/wordCharacterPattern'
x-secret: ''
customConfig:
description: Custom remote write config. Will be appended to the remoteWrite list.
type: string
replicas:
type: integer
default: 1
scrapeInterval:
type: string
default: 60s
retention:
$ref: '#/definitions/duration'
retentionSize:
description: 'The maximum number of bytes of storage blocks to retain. The oldest data will be removed first. Defaults to 0 or disabled. Units supported: B, KB, MB, GB, TB, PB, EB'
default: 4GB
pattern: '^([0-9]+\.)?[0-9]+(B|KB|MB|GB|TB|PB|EB)?$'
storageSize:
$ref: '#/definitions/size'
default: 5Gi
image:
properties:
prometheus:
$ref: '#/definitions/imageSimple'
kube-state-metrics:
$ref: '#/definitions/imageSimple'
node-exporter:
$ref: '#/definitions/imageSimple'
resources:
properties:
prometheusOperator:
$ref: '#/definitions/resources'
prometheus:
$ref: '#/definitions/resources'
kube-state-metrics:
$ref: '#/definitions/resources'
node-exporter:
$ref: '#/definitions/resources'
prometheusConfigReloader:
$ref: '#/definitions/resources'
promtail:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
resources:
$ref: '#/definitions/resources'
rabbitmq:
additionalProperties: false
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
resources:
properties:
clusterOperator:
description: Controller which is used to create RabbitMQ-clusters
$ref: '#/definitions/resources'
msgTopologyOperator:
description: Controller which is used to create RabbitMQ queues and policies
$ref: '#/definitions/resources'
trivy:
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
operator:
properties:
replicaCount:
description: Number of Operator replicas.
type: integer
default: 1
resources:
additionalProperties: false
properties:
operator:
$ref: '#/definitions/resources'
trivy:
$ref: '#/definitions/resources'
otel:
properties:
_rawValues:
$ref: '#/definitions/rawValues'
enabled:
type: boolean
default: false
operator:
properties:
replicaCount:
description: Number of replicas.
type: integer
default: 1
resources:
additionalProperties: false
properties:
logsCollector:
$ref: '#/definitions/resources'
manager:
$ref: '#/definitions/resources'
catalogs:
type: object
additionalProperties:
$ref: '#/definitions/catalog'
cluster:
$ref: '#/definitions/cluster'
dns:
additionalProperties: false
properties:
zones:
description: Extra dns zones that the cluster can administer. Team services can use this to publish their URLs on.
items:
$ref: '#/definitions/domain'
type: array
domainFilters:
description: Limit possible target zones by domain suffixes.
items:
type: string
type: array
zoneIdFilters:
description: Limit possible target zones by zone id.
items:
type: string
type: array
policy:
description: Modify how DNS records are synchronized between sources and providers.
type: string
enum:
- upsert-only
- sync
provider:
description: The DNS provider managing the domains.
oneOf:
- title: Akamai EdgeDNS
additionalProperties: false
properties:
akamai:
$ref: '#/definitions/akamai/definitions/dns'
required:
- akamai
- title: AWS
description: Uses credentials when either a pair of id+key or a secret name is provided. Assumes node role otherwise.
additionalProperties: false
properties:
aws:
properties:
credentials:
properties:
secretKey:
$ref: '#/definitions/aws/definitions/secretKey'
accessKey:
$ref: '#/definitions/aws/definitions/accessKey'
required: [secretKey, accessKey]
region:
$ref: '#/definitions/aws/definitions/region'
role:
$ref: '#/definitions/aws/definitions/role'
required: [region]
oneOf:
- required: [credentials]
- required: [role]
- not:
anyOf:
- required: [credentials]
- required: [role]
required:
- aws
- title: Azure
additionalProperties: false
properties:
azure:
$ref: '#/definitions/azure/definitions/dns'
required:
- azure
- title: Azure Private
additionalProperties: false
properties:
azure-private-dns:
$ref: '#/definitions/azure/definitions/dns'
required:
- azure-private-dns
- title: Google
additionalProperties: false
properties:
google:
properties:
serviceAccountKey:
$ref: '#/definitions/google/definitions/accountJson'
description: A service account key in json format for managing a DNS zone.
project:
$ref: '#/definitions/google/definitions/project'
required: [project, serviceAccountKey]
required:
- google
- title: Digital Ocean
additionalProperties: false
properties:
digitalocean:
properties:
apiToken:
type: string
x-secret: ''
required:
- apiToken
required:
- digitalocean
- title: Linode
additionalProperties: false
properties:
linode:
properties:
apiToken:
type: string
x-secret: ''
required:
- apiToken
required:
- linode
- title: CloudFlare
additionalProperties: false
properties:
cloudflare:
properties:
apiToken:
type: string
x-secret: ''
apiSecret:
type: string
x-secret: ''
description: Required when Email is set.
email:
$ref: '#/definitions/email'
description: Required when Email is set.
proxied:
type: boolean
x-default: true
oneOf:
- required: [apiToken]
- required: [apiSecret, email]
- not:
anyOf:
- required: [apiToken]
- required: [apiSecret]
- required: [email]
required:
- cloudflare
- title: Other
additionalProperties: false
properties:
other:
description: This option requires configuration for both external-dns as well as cert-manager. No schema validation is available so provide correct data.
type: object
properties:
name:
type: string
description: Name of the provider.
external-dns:
title: YAML for external-dns.
type: object
description: 'The provider config as provided here: https://github.com/linode/apl-core/blob/main/charts/external-dns/values.yaml'
cert-manager:
title: YAML for cert-manager.
type: object
description: 'The dns01 config as provided here: https://cert-manager.io/docs/configuration/acme/dns01/'
required:
- name
- external-dns
- cert-manager
required:
- other
entrypoint:
$ref: '#/definitions/ipV4Address'
description: Optional. A public IP address that will override (loadbalancer) ip used for registering hosts. This allows for access to private clusters.
files:
type: object
description: 'Custom values for the workload chart.'
patternProperties:
'^/|(/[\w-]+)+$':
type: string
pattern: ^[^\s]+$
oidc:
additionalProperties: false
description: 'Holds many parts used in different locations. Please see keycloak, grafana, istio and oauth-proxy as those are all consuming (parts of) these settings.'
properties:
issuer:
$ref: '#/definitions/url'
clientID:
$ref: '#/definitions/wordCharacterPattern'
x-secret: ''
clientSecret:
type: string
x-secret: ''
platformAdminGroupID:
$ref: '#/definitions/wordCharacterPattern'
allTeamsAdminGroupID:
$ref: '#/definitions/wordCharacterPattern'
teamAdminGroupID:
$ref: '#/definitions/wordCharacterPattern'
usernameClaimMapper:
$ref: '#/definitions/wordCharacterPattern'
description: Claim name from identity provider used by Keycloak to create the username. Best to not change this from the default.
default: '${CLAIM.upn}'
subClaimMapper:
type: string
description: Claim name passed by Keycloak as a unique user identifier. Best to not change this from the default.
default: sub
required:
- clientID
- issuer
otomi:
additionalProperties: false
properties:
isPreInstalled:
type: boolean
description: Defines if APL is installed and managed by Linode
default: false
oidc:
additionalProperties: false
properties:
authenticationLayer:
type: string
enum:
- dex
- keycloak
default: keycloak
description: Which app every consumer authenticates against.
aiEnabled:
type: boolean
description: Defines if APL enables AI/ML components
default: false
globalPullSecret:
title: Global pullsecret
description: Will be connected to each "default" service account in all otomi app namespaces.
Handy for authenticating with DockerHub to avoid rate limiting.
Also useful when pulling all otomi images from a private repo. (One would need to override all the images in the config first.)
additionalProperties: false
properties:
username:
$ref: '#/definitions/wordCharacterPattern'
password:
type: string
x-secret: ''
email:
$ref: '#/definitions/email'
default: not@us.ed
server:
$ref: '#/definitions/wordCharacterPattern'
default: docker.io
required:
- username
- password
git:
type: object
title: Git Configuration
description: |
Git configuration for APL values repository.
additionalProperties: true
properties:
repoUrl:
type: string
description: |
The base URL of the Git repository (without credentials). Auto-derived for internal Gitea.
pattern: '^https?://.+'
x-secret: ''
username:
type: string
description: |
Username for authenticating with the Git repository.
Defaults to 'otomi-admin' for internal Gitea.
x-secret: ''
password:
type: string
description: Password or token for authenticating with the Git repository
x-secret: ''
email:
type: string
description: |
Email address to use for Git commits.
Defaults to 'pipeline@cluster.local' for internal Gitea.
x-secret: ''
branch:
type: string
description: The branch to use in the Git repository
x-secret: ''
hasExternalDNS:
description: Set this to true when an external dns zone is available to manage dns records. (Expects required `dns:` fields to be set.)
default: false
type: boolean
hasExternalIDP:
default: false
description: Set this to true when bringing your own external IDP such as Azure AD. (Expects required `oidc:` fields to be set.)
type: boolean
isMultitenant:
default: true
description: Whether to separate team metrics and logs. Disabling this lets everybody be admin and see everything.
type: boolean
nodeSelector:
$ref: '#/definitions/labelsAnnotations'
description: 'One or more "label: value" pairs that must exist on one or more nodes, which will force all otomi platform workloads to be scheduled there.'
version:
default: latest
description: 'Best pin this to a valid release version found in the repo.'
pattern: '(v[0-9]+.[0-9]+.[0-9]+|[a-zA-Z]+[a-zA-Z0-9-])'
useORCS:
type: boolean
description: Defines if the OCI Registry Cache Service (ORCS) is used to cache images from the public registry.
ingress:
properties:
platformClass:
type: object
allOf:
- properties:
className:
type: string
enum: [platform]
- $ref: '#/definitions/ingressClassParameters'
classes:
type: array
items:
allOf:
- type: object
properties:
className:
type: string
- $ref: '#/definitions/ingressClassParameters'
required:
- className
smtp:
additionalProperties: false
properties:
auth_identity:
type: string
auth_password:
type: string
x-secret: ''
auth_secret:
type: string
x-secret: ''
auth_username:
type: string
from:
$ref: '#/definitions/email'
description: The "from" address. Defaults to alerts@$clusterDomain.
hello:
type: string
smarthost:
$ref: '#/definitions/hostPort'
description: 'The smtp host:port combination.'
required:
- smarthost
platformBackups:
type: object
properties:
database:
type: object
title: Database backups
properties:
harbor:
title: Harbor
properties:
enabled:
type: boolean
default: false
retentionPolicy:
$ref: '#/definitions/backupRetentionPolicy'
schedule:
$ref: '#/definitions/backupSchedule'
pathSuffix:
type: string
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
default: harbor
gitea:
title: Gitea
properties:
enabled:
type: boolean
default: false
retentionPolicy:
$ref: '#/definitions/backupRetentionPolicy'
schedule:
$ref: '#/definitions/backupSchedule'
pathSuffix:
type: string
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
default: gitea
keycloak:
title: Keycloak
properties:
enabled:
type: boolean
default: false
retentionPolicy:
$ref: '#/definitions/backupRetentionPolicy'
schedule:
$ref: '#/definitions/backupSchedule'
pathSuffix:
type: string
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
default: keycloak
gitea:
type: object
title: Gitea
description: Enable application-level backup of Gitea repositories and database
additionalProperties: false
properties:
enabled:
type: boolean
default: false
resources:
$ref: '#/definitions/resources'
retentionPolicy:
$ref: '#/definitions/backupRetentionPolicy'
schedule:
$ref: '#/definitions/backupSchedule'
obj:
properties:
showWizard:
type: boolean
default: true
description: Show the Object Storage wizard.
provider:
properties:
linode:
properties:
region:
description: The region of the bucket
$ref: '#/definitions/wordCharacterPattern'
accessKeyId:
type: string
description: The ID of the access key
$ref: '#/definitions/wordCharacterPattern'
secretAccessKey:
type: string
description: The secret of the access key
$ref: '#/definitions/wordCharacterPattern'
x-secret: ''
buckets:
properties:
loki:
type: string
$ref: '#/definitions/wordCharacterPattern'
default: loki
cnpg:
type: string
$ref: '#/definitions/wordCharacterPattern'
default: cnpg
harbor:
type: string
$ref: '#/definitions/wordCharacterPattern'
default: harbor
gitea:
type: string
$ref: '#/definitions/wordCharacterPattern'
default: gitea
kubeflow-pipelines:
type: string
$ref: '#/definitions/wordCharacterPattern'
default: kubeflow-pipelines
required:
- region
- accessKeyId
- secretAccessKey
type:
type: string
enum:
- linode
- disabled
default: disabled
databases:
properties:
keycloak:
title: Keycloak
properties:
size:
type: string
storageClass:
type: string
walStorageSize:
type: string
resources:
$ref: '#/definitions/resources'
backupSidecarResources:
$ref: '#/definitions/resources'
postgresqlParameters:
type: object
additionalProperties:
type: string
default: {}
replicas:
type: integer
default: 2
recovery:
type: object
additionalProperties: true
default: {}
externalClusters:
type: array
items:
type: object
additionalProperties: true
default: []
harbor:
title: Harbor
properties:
size:
type: string
storageClass:
type: string
walStorageSize:
type: string
resources:
$ref: '#/definitions/resources'
backupSidecarResources:
$ref: '#/definitions/resources'
postgresqlParameters:
type: object
additionalProperties:
type: string
default: {}
replicas:
type: integer
default: 2
recovery:
type: object
additionalProperties: true
default: {}
externalClusters:
type: array
items:
type: object
additionalProperties: true
default: []
gitea:
title: gitea
properties:
size:
type: string
storageClass:
type: string
walStorageSize:
type: string
resources:
$ref: '#/definitions/resources'
backupSidecarResources:
$ref: '#/definitions/resources'
postgresqlParameters:
type: object
additionalProperties:
type: string
default: {}
replicas:
type: integer
default: 2
recovery:
type: object
additionalProperties: true
default: {}
externalClusters:
type: array
items:
type: object
additionalProperties: true
default: []
teamConfig:
additionalProperties: false
patternProperties:
'^[a-z0-9]([-a-z0-9]*[a-z0-9])+$':
$ref: '#/definitions/team'
versions:
properties:
specVersion:
type: integer
description: DO NOT CHANGE! Holds the values-schema version. For more details, see `otomi migrate`.
license:
type: string
describe: License in form of JWT
x-secret: ''
status:
type: object
properties:
otomi:
properties:
deployingTag:
type: string
deployingVersion:
type: string
status:
type: string
enum: [deploying, deployed]
version:
type: string
helm:
type: object
required:
- cluster