-
Notifications
You must be signed in to change notification settings - Fork 4
/
values.yaml
1889 lines (1778 loc) · 79.8 KB
/
values.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
## @section Global parameters
## Global Docker image parameters
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass
##
## @param global.imageRegistry Global Docker image registry
## @param global.imagePullSecrets Global Docker registry secret names as an array
## @param global.storageClass Global StorageClass for Persistent Volume(s)
##
global:
imageRegistry: ""
## E.g.
## imagePullSecrets:
## - myRegistryKeySecretName
##
imagePullSecrets: []
storageClass: ""
postgresql:
## @param global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`)
##
service:
ports:
postgresql: ""
## @section K8S env parameters
##
## @param k8sSetup.platform The platform on which you install the chart. Possible values: AWSEKS/AzureAKS/GoogleGKE/PlainK8s
## @param k8sSetup.validateValues Enable validation of the values
##
k8sSetup:
platform: PlainK8s
validateValues: true
## @section Release server parameters
##
## @param license Sets your XL License by passing a base64 string license, which will then be added to the license file.
## Convert xl-release.lic files content to base64 ( cat xl-release.lic | base64 -w 0 ) and put the output here
##
license:
## @param licenseAcceptEula Accept EULA, in case of missing license, it will generate temporary license.
##
licenseAcceptEula: false
## @param generateXlConfig Generate configuration from environment parameters passed, and volumes mounted with custom changes. If set to false, a default config will be used and all environment variables and volumes added will be ignored.
##
generateXlConfig: true
## @param useIpAsHostname Set IP address of the container as the hostname for the instance.
## If set to true then IP will be used instead of the container ID. This is useful
## when deploying Release as active-active cluster using docker compose as Pekko cannot resolve aliases within the docker network.
##
useIpAsHostname: false
## @param forceRemoveMissingTypes Force removal of the missing types.
##
forceRemoveMissingTypes: false
## @param clusterMode This is to specify if the HA setup is needed and to specify the HA mode. Possible values: "default", "hot-standby", "full"
##
clusterMode: full
## @param forceUpgrade It can be used to perform an upgrade in non-interactive mode by passing flag -force-upgrades while starting a service.
##
forceUpgrade: true
## @param enableEmbeddedQueue Flag to expose external messaging queue. If set to true, a default embedded-queue will be used and all environment variables will be ignored.
##
enableEmbeddedQueue: false
## @param appProtocol Release protocol (the protocol http or https that will be used by enduser to access Release). It is not used if ingress or route are enabled.
##
appProtocol: http
## @param appHostname Release hostname (the hostname that will be used by enduser to access Release). It is not used if ingress or route are enabled.
##
appHostname: ""
## @param appContextRoot Release context root.
##
appContextRoot: /
## @param logback.globalLoggingLevel Global logging level. Possible values: "trace", "debug", "info", "warn", "error"
## @param logback.scanEnabled Enables scanning of logback.xml.
## @param logback.scanPeriod Interval for checking logback.xml configuration.
##
logback:
globalLoggingLevel: "info"
scanEnabled: true
scanPeriod: "30 seconds"
## @section Release hooks
##
hooks:
getLicense:
## @param hooks.getLicense.enabled set to true to support license auto generation by using helm hook, it is working together with enabled licenseAcceptEula
enabled: true
## @param hooks.getLicense.name Name of the resources that will be used during hook execution
name: '{{ include "release.name" . }}-license'
## @param hooks.getLicense.deletePolicy Helm hook delete policy
deletePolicy: "before-hook-creation,hook-succeeded"
## @param hooks.getLicense.getCommand The command for getting temporary license, see hooks.getLicense.configuration.bin_get-license
getCommand:
- /opt/xebialabs/xl-release-server/bin/get-license.sh
## @param hooks.getLicense.installCommand The command for creating the secret with the license, see hooks.getLicense.configuration.bin_install-license
installCommand:
- /opt/xebialabs/xl-release-server/bin/install-license.sh
## @param hooks.getLicense.image.registry getLicense hook container image registry
## @param hooks.getLicense.image.repository getLicense hook container image repository
## @param hooks.getLicense.image.tag getLicense hook container image tag
## @param hooks.getLicense.image.pullPolicy getLicense hook container image pull policy
## @param hooks.getLicense.image.pullSecrets Specify docker-registry secret names as an array
##
image:
registry: docker.io
repository: bitnami/kubectl
tag: 1.28.7-debian-12-r3
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
##
pullPolicy: IfNotPresent
## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
## Example:
## pullSecrets:
## - myRegistryKeySecretName
##
pullSecrets: []
## @param hooks.getLicense.containerSecurityContext.enabled Enabled get licence containers' Security Context
## @param hooks.getLicense.containerSecurityContext.runAsNonRoot Set get licence container's Security Context runAsNonRoot
## @param hooks.getLicense.containerSecurityContext.allowPrivilegeEscalation Set get licence container's Security Context allowPrivilegeEscalation
## @extra hooks.getLicense.containerSecurityContext.capabilities Set get licence container's Security Context capabilities
## @skip hooks.getLicense.containerSecurityContext.capabilities
## @extra hooks.getLicense.containerSecurityContext.seccompProfile Set get licence container's Security Context seccompProfile
## @skip hooks.getLicense.containerSecurityContext.seccompProfile
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## Example:
## containerSecurityContext:
## capabilities:
## drop: ["NET_RAW"]
## readOnlyRootFilesystem: true
##
containerSecurityContext:
enabled: true
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
## @extra hooks.getLicense.configuration Release Configuration file content
## Do not override unless you know what you are doing.
##
configuration:
## @extra hooks.getLicense.configuration.bin_get-license The configuration of the script for getting the license
## @param hooks.getLicense.configuration.bin_get-license.path The path to the script for getting the license
## @param hooks.getLicense.configuration.bin_get-license.mode The access mode of the script for getting the license
## @param hooks.getLicense.configuration.bin_get-license.content Content of the script for getting the license
bin_get-license:
path: "bin/get-license.sh"
mode: 0755
content: |
#!/bin/bash
echo "Requesting unregistered license"
SERVER_PATH_PART=https://download.xebialabs.com
echo -e $(curl -X POST "${SERVER_PATH_PART}/api/unregistered/xl-release" | jq --raw-output .license) > ${APP_HOME}/conf/xl-release-license.lic
file_size=$(stat -c%s "${APP_HOME}/conf/xl-release-license.lic")
if [ "$file_size" -lt 10 ]; then
echo "License file is NOT valid"
exit 1
fi
## @extra hooks.getLicense.configuration.bin_install-license The configuration of the script for setting up license secret
## @param hooks.getLicense.configuration.bin_install-license.path The path to the script for setting up license secret
## @param hooks.getLicense.configuration.bin_install-license.mode The access mode of the script for setting up license secret
## @param hooks.getLicense.configuration.bin_install-license.content Content of the script for setting up license secret
bin_install-license:
path: "bin/install-license.sh"
mode: 0755
content: |
#!/bin/bash
FILE_PATH="/opt/xebialabs/xl-release-server/conf/xl-release-license.lic"
kubectl create secret generic {{ include "common.tplvalues.render" ( dict "value" $.Values.hooks.getLicense.name "context" $ ) }} --from-file=$FILE_PATH
genSelfSigned:
## @param hooks.genSelfSigned.enabled set to true to support self-signed ket auto generation by using helm hook
enabled: false
## @param hooks.genSelfSigned.name Name of the resources that will be used during hook execution
name: '{{ include "release.name" . }}-self-signed'
## @param hooks.genSelfSigned.deletePolicy Helm hook delete policy
deletePolicy: "before-hook-creation,hook-succeeded"
## @param hooks.genSelfSigned.genCommand The command for getting self-signed key, see hooks.genSelfSigned.configuration.bin_gen-self-signed
genCommand:
- /opt/xebialabs/xl-release-server/bin/gen-self-signed.sh
## @param hooks.genSelfSigned.installCommand The command for creating the secret with the self-signed key, see hooks.genSelfSigned.configuration.bin_install-self-signed
installCommand:
- /opt/xebialabs/xl-release-server/bin/install-self-signed.sh
## @param hooks.genSelfSigned.image.registry genSelfSigned hook container image registry
## @param hooks.genSelfSigned.image.repository genSelfSigned hook container image repository
## @param hooks.genSelfSigned.image.tag genSelfSigned hook container image tag
## @param hooks.genSelfSigned.image.pullPolicy genSelfSigned hook container image pull policy
## @param hooks.genSelfSigned.image.pullSecrets Specify docker-registry secret names as an array
##
image:
registry: docker.io
repository: bitnami/kubectl
tag: 1.28.7-debian-12-r3
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
##
pullPolicy: IfNotPresent
## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
## Example:
## pullSecrets:
## - myRegistryKeySecretName
##
pullSecrets: []
## @param hooks.genSelfSigned.containerSecurityContext.enabled Enabled generate self-signed containers' Security Context
## @param hooks.genSelfSigned.containerSecurityContext.runAsNonRoot Set generate self-signed container's Security Context runAsNonRoot
## @param hooks.genSelfSigned.containerSecurityContext.allowPrivilegeEscalation Set generate self-signed container's Security Context allowPrivilegeEscalation
## @extra hooks.genSelfSigned.containerSecurityContext.capabilities Set generate self-signed container's Security Context capabilities
## @skip hooks.genSelfSigned.containerSecurityContext.capabilities
## @extra hooks.genSelfSigned.containerSecurityContext.seccompProfile Set generate self-signed container's Security Context seccompProfile
## @skip hooks.genSelfSigned.containerSecurityContext.seccompProfile
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## Example:
## containerSecurityContext:
## capabilities:
## drop: ["NET_RAW"]
## readOnlyRootFilesystem: true
##
containerSecurityContext:
enabled: true
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
## @extra hooks.genSelfSigned.configuration Release Configuration file content
## Do not override unless you know what you are doing.
##
configuration:
## @extra hooks.genSelfSigned.configuration.bin_gen-self-signed The configuration of the script for creating self signed key
## @param hooks.genSelfSigned.configuration.bin_gen-self-signed.path The path to the script forcreating self signed key
## @param hooks.genSelfSigned.configuration.bin_gen-self-signed.mode The access mode of the script for creating self signed key
## @param hooks.genSelfSigned.configuration.bin_gen-self-signed.content Content of the script for creating self signed key
bin_gen-self-signed:
path: "bin/gen-self-signed.sh"
mode: 0755
content: |
#!/bin/bash
echo "Generating release self-signed cert"
HOSTNAME="{{- include "release.hostname" . -}}"
STOREPASS="{{- .Values.ssl.keystorePassword -}}"
KEYPASS="{{- .Values.ssl.keystoreKeypassword -}}"
KEYTYPE="{{- .Values.ssl.keystoreType -}}"
keytool -genkey -keyalg RSA -alias dai-release -keystore conf/keystore.$KEYTYPE -validity 365 -keysize 2048 -storepass "$STOREPASS" -storetype "$KEYTYPE" -keypass "$KEYPASS" \
-dname "CN=$HOSTNAME,OU=,O=Digital.ai Release,L=,ST=,C=" \
-ext "SAN=DNS:{{- include "common.names.fullname" . -}}.local"
keytool -export -alias dai-release -keystore conf/keystore.$KEYTYPE -rfc -file conf/public.cert -storepass "$STOREPASS" -storetype "$KEYTYPE" -keypass "$KEYPASS"
## @extra hooks.genSelfSigned.configuration.bin_install-self-signed The configuration of the script for setting up self-signed key secret
## @param hooks.genSelfSigned.configuration.bin_install-self-signed.path The path to the script for setting up self-signed key secret
## @param hooks.genSelfSigned.configuration.bin_install-self-signed.mode The access mode of the script for setting up self-signed key secret
## @param hooks.genSelfSigned.configuration.bin_install-self-signed.content Content of the script for setting up self-signed key secret
bin_install-self-signed:
path: "bin/install-self-signed.sh"
mode: 0755
content: |
#!/bin/bash
KEYSTORE_FILE_PATH="/opt/xebialabs/xl-release-server/conf/keystore.{{- .Values.ssl.keystoreType -}}"
CERT_FILE_PATH="/opt/xebialabs/xl-release-server/conf/public.cert"
kubectl create secret generic {{ include "common.tplvalues.render" ( dict "value" $.Values.hooks.genSelfSigned.name "context" $ ) }} \
--from-file=$KEYSTORE_FILE_PATH \
--from-file=$CERT_FILE_PATH \
--from-literal=host={{- include "release.hostname" . -}}
installReleaseRunner:
## @param hooks.installReleaseRunner.enabled set to true to support installation of the Remote Runner after Release installation
enabled: false
## @param hooks.installReleaseRunner.name Name of the resources that will be used during hook execution
name: '{{ include "release.name" . }}-install-runner'
## @param hooks.installReleaseRunner.deletePolicy Helm hook delete policy
deletePolicy: "before-hook-creation,hook-succeeded"
## @param hooks.installReleaseRunner.releaseName The release name for Release Runner installation
releaseName: ""
## @param hooks.installReleaseRunner.answersSecret The secret that will be used during Release Runner installation
answersSecret: ""
## @param hooks.installReleaseRunner.installCommand The command for Release Runner installation
installCommand:
- /opt/xebialabs/xl-client/xl
- kube
- upgrade
- --skip-context-check
- --local-repo
- /opt/xebialabs/xl-op-blueprints
- --answers
- /opt/xebialabs/xl-client/generated_answers.yaml
## @param hooks.installReleaseRunner.image.registry getLicense hook container image registry
## @param hooks.installReleaseRunner.image.repository getLicense hook container image repository
## @param hooks.installReleaseRunner.image.tag getLicense hook container image tag
## @param hooks.installReleaseRunner.image.pullPolicy getLicense hook container image pull policy
## @param hooks.installReleaseRunner.image.pullSecrets Specify docker-registry secret names as an array
##
image:
registry: docker.io
repository: xebialabsunsupported/xl-client
tag: "{{ .Chart.AppVersion }}"
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
##
pullPolicy: IfNotPresent
## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
## Example:
## pullSecrets:
## - myRegistryKeySecretName
##
pullSecrets: []
## @param hooks.installReleaseRunner.containerSecurityContext.enabled Enabled install RR containers' Security Context
## @param hooks.installReleaseRunner.containerSecurityContext.runAsNonRoot Set install RR container's Security Context runAsNonRoot
## @param hooks.installReleaseRunner.containerSecurityContext.allowPrivilegeEscalation Set install RR container's Security Context allowPrivilegeEscalation
## @extra hooks.installReleaseRunner.containerSecurityContext.capabilities Set install RR container's Security Context capabilities
## @skip hooks.installReleaseRunner.containerSecurityContext.capabilities
## @extra hooks.installReleaseRunner.containerSecurityContext.seccompProfile Set install RR container's Security Context seccompProfile
## @skip hooks.installReleaseRunner.containerSecurityContext.seccompProfile
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## Example:
## containerSecurityContext:
## capabilities:
## drop: ["NET_RAW"]
## readOnlyRootFilesystem: true
##
containerSecurityContext:
enabled: true
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
## @section Release security parameters
## Release Authentication parameters
##
auth:
## @param auth.adminPassword Admin password for Release. If user does not provide password, random 10 character alphanumeric string will be generated.
adminPassword:
## @param auth.sessionStorage When enabled it will store session in the DB (it could degrade DB performance).
sessionStorage: false
ssl:
## @param ssl.enabled Enable SSL to be used on Release
enabled: false
## @param ssl.keystorePassword Keystore password with SSL key.
keystorePassword:
## @param ssl.keystoreKeypassword Keystore key password with SSL key.
keystoreKeypassword:
## @param ssl.keystoreType Keystore type, options pkcs12 or jks.
keystoreType: pkcs12
## @extra ssl.keystore Keystore content in base64 format or it can reference the existing secret.
## @param ssl.keystore.valueFrom.secretKeyRef.name Name of the secret where the keystore was stored.
## @param ssl.keystore.valueFrom.secretKeyRef.key Name of the key in the secret where the keystore was stored.
keystore:
valueFrom:
secretKeyRef:
name: '{{ include "common.tplvalues.render" ( dict "value" .Values.hooks.genSelfSigned.name "context" $ ) }}'
key: keystore.{{ .Values.ssl.keystoreType }}
## @section Release external resources
external:
db:
## @param external.db.enabled Enable external database
enabled: false
main:
## @param external.db.main.url Main database URL for Release
url: ""
## @param external.db.main.username Main database username for Release
username:
## @param external.db.main.password Main database password for Release
password:
## @param external.db.main.maxPoolSize Main database max pool size for Release
maxPoolSize: ""
report:
## @param external.db.report.url Report database URL for Release
url: ""
## @param external.db.report.username Report database username for Release
username:
## @param external.db.report.password Report database password for Release
password:
## @param external.db.report.maxPoolSize Report database max pool size for Release
maxPoolSize: ""
mq:
## @param external.mq.enabled Enable external message queue
enabled: false
## @param external.mq.url External message queue broker URL for Release
url: ""
## @param external.mq.queueName External message queue name for Release
queueName: ""
## @param external.mq.username External message queue broker username for Release
username:
## @param external.mq.password External message queue broker password for Release
password:
## @param external.mq.queueType Applies only for external rabbitmq message broker. Can be either classic(default) or quorum
queueType: ""
## @param external.mq.connector Connector type depending on external message queue broker. Can be either rabbitmq-jms(default) or activemq-jms
connector: ""
## @section Release keystore and truststore parameters
keystore:
## @param keystore.passphrase Set passphrase for the keystore
passphrase:
## @param keystore.keystore Use repository-keystore.jceks files content ecoded with base64
# https://docs.xebialabs.com/v.9.8/release/how-to/update-the-xl-release-digital-certificate/#view-the-certificate
# Convert repository-keystore.jceks files content to base64
# ( cat repository-keystore.jceks | base64 -w 0 ) and put the output here
# if empty during initial run, the default keystore will be generated with provided "passphrase"
keystore:
truststore:
## @param truststore.type Type of truststore, possible value jks or jceks or pkcs12
type: "pkcs12"
## @param truststore.password Truststore password
password:
## @param truststore.truststore Truststore file base64 encoded
truststore: {}
## @param truststore.params Truststore params in the command line
params: "{{- if .Values.truststore.truststore }} -Djavax.net.ssl.trustStore=$(TRUSTSTORE) -Djavax.net.ssl.trustStorePassword=$(TRUSTSTORE_PASSWORD) -Djavax.net.ssl.trustStoreType=$(TRUSTSTORE_TYPE){{- end }}"
## @section Release Network Policy configuration
##
## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param networkPolicy.enabled Enable creation of NetworkPolicy resources
##
enabled: false
## @param networkPolicy.allowExternal Don't require client label for connections
## The Policy model to apply. When set to false, only pods with the correct
## client label will have network access to the port Release is listening
## on. When true, Release will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param networkPolicy.additionalRules Additional NetworkPolicy Ingress "from" rules to set. Note that all rules are OR-ed.
## e.g:
## additionalRules:
## - matchLabels:
## - role: frontend
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
additionalRules: []
## @section Metrics Parameters
##
## Metrics
##
metrics:
## @param metrics.enabled Enable exposing Release metrics to be gathered.
## Flag to expose internal and system metrics over Java Management Extensions (JMX).
## This is to enable the use of monitoring systems that can read JMX data, with XL Products.
##
enabled: false
## @section OIDC parameters
##
oidc:
accessToken:
## @param oidc.accessToken.audience Expected audience 'aud' claim value
audience:
## @param oidc.accessToken.enable Enable access token
enable: false
## @param oidc.accessToken.issuer Expected issuer 'iss' claim value
issuer:
## @param oidc.accessToken.jwsAlg Expected JSON Web Algorithm
jwsAlg:
## @param oidc.accessToken.keyRetrievalUri The jwks_uri to retrieve keys for the token
keyRetrievalUri:
## @param oidc.accessToken.secretKey The secret key if MAC based algorithms is used for the token
secretKey:
## @param oidc.accessTokenUri The redirect URI to use for returning the access token
accessTokenUri:
clientAuthJwt:
## @param oidc.clientAuthJwt.enable Enable Client Authentication Using private_key_jwt
enable: false
## @param oidc.clientAuthJwt.jwsAlg Expected JSON Web Algorithm
jwsAlg:
keyStore:
## @param oidc.clientAuthJwt.keyStore.enable Enable keystore
enable: false
## @param oidc.clientAuthJwt.keyStore.path The key store file path
path:
## @param oidc.clientAuthJwt.keyStore.password The key store password
password:
## @param oidc.clientAuthJwt.keyStore.type The type of keystore
type:
key:
## @param oidc.clientAuthJwt.key.alias Private key alias inside the key store
alias:
## @param oidc.clientAuthJwt.key.enable Enable private key
enable: false
## @param oidc.clientAuthJwt.key.password Private key password
password:
## @param oidc.clientAuthJwt.tokenKeyId Token key identifier 'kid' header - set it if your OpenID Connect provider requires it
tokenKeyId:
## @param oidc.clientAuthMethod Client authentication method
clientAuthMethod:
## @param oidc.clientId Client ID
clientId:
## @param oidc.clientSecret Client secret
clientSecret:
## @param oidc.emailClaim Email claim
emailClaim:
## @param oidc.enabled Enable the OIDC configuration
enabled: false
## @param oidc.external Enable the OIDC configuration
external: false
## @param oidc.externalIdClaim A unique external ID such as the user's employee ID or GitHub ID. This is an optional claim.
externalIdClaim:
## @param oidc.fullNameClaim FullName claim
fullNameClaim:
## @param oidc.idTokenJWSAlg The ID token signature verification algorithm
idTokenJWSAlg:
## @param oidc.issuer OpenID Provider Issuer here
issuer:
## @param oidc.keyRetrievalUri The jwks_uri to retrieve keys
keyRetrievalUri:
## @param oidc.logoutUri The logout endpoint to revoke token via the browser
logoutUri:
## @param oidc.postLogoutRedirectUri If you need to redirect to the login page after logout, you can use your redirectUri as the postLogoutRedirectUri
postLogoutRedirectUri:
## @param oidc.proxyHost Proxy host
proxyHost:
## @param oidc.proxyPort Proxy port
proxyPort:
## @param oidc.redirectUri The redirectUri endpoint must always point to the /oidc-login Release endpoint.
## The redirectUri is an endpoint where authentication responses can be sent and received by Release.
## It must exactly match one of the redirect_uris you registered in OKTA and Azure AD portal and it must be URL encoded.
## For Keycloak you can register a pattern for redirect_uri from the Keycloak Admin Panel
## (For example, you can provide a mask such as: http://example.com/mask** that matches http://example.com/mask/ or http://example.com/mask).
redirectUri:
## @param oidc.rolesClaim Roles claim
rolesClaim:
## @param oidc.scopes Fields described here must be present in the scope.
scopes: [ "openid" ]
## @param oidc.userAuthorizationUri The authorize endpoint to request tokens or authorization codes via the browser
userAuthorizationUri:
## @param oidc.userNameClaim A unique username for both internal and external users.
## You cannot sign in with a user if a local account with the same username exists.
userNameClaim:
## @section Common resources parameters
##
## @param nameOverride String to partially override release.fullname template (will maintain the release name)
##
nameOverride: ""
## @param fullnameOverride String to fully override release.fullname template
##
fullnameOverride: ""
## @param namespaceOverride String to fully override common.names.namespace
##
namespaceOverride: ""
## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)
##
kubeVersion: ""
## @param clusterDomain Kubernetes Cluster Domain
##
clusterDomain: cluster.local
## @param extraDeploy Array of extra objects to deploy with the Release
##
extraDeploy: [ ]
## @param commonAnnotations Annotations to add to all deployed objects
##
commonAnnotations: { }
## @param commonLabels Labels to add to all deployed objects
## Eg. app.kubernetes.io/version: "{{ .Chart.AppVersion }}"
##
commonLabels: { }
## @section Release debug parameters
##
## Enable diagnostic mode in the deployment
##
diagnosticMode:
## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
##
enabled: false
## @param diagnosticMode.command Command to override all containers in the deployment
##
command:
- /opt/xebialabs/tini
## @param diagnosticMode.args Args to override all containers in the deployment
##
args:
- --
- sleep
- infinity
## Enable debug mode in the deployment
##
debugMode:
## @param debugMode.enabled Enable debug mode (it starts all process with debug agent)
##
enabled: false
## @param debugMode.remoteJvmParams Agent lib configuration line with port. Do port forwarding to the port you would like to use.
##
remoteJvmParams: "{{- if .Values.debugMode.enabled }} -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=localhost:8001{{- end }}"
## @section Release DNS parameters
##
## @param hostAliases Deployment pod host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
hostAliases: []
## @param dnsPolicy DNS Policy for pod
## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/
## E.g.
## dnsPolicy: ClusterFirst
dnsPolicy: ""
## @param dnsConfig DNS Configuration pod
## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/
## E.g.
## dnsConfig:
## options:
## - name: ndots
## value: "4"
dnsConfig: {}
## @section Release runtime parameters
##
## @param jvmArgs Release JVM arguments
##
jvmArgs: ""
## @param command Override default container command (useful when using custom images)
##
command:
- /opt/xebialabs/tini
## @param args Override default container args (useful when using custom images)
##
args:
- --
- /opt/xebialabs/xl-release-server/bin/run-in-container.sh
## @param lifecycleHooks Overwrite livecycle for the Release container(s) to automate configuration before or after startup
##
lifecycleHooks: {}
## @param terminationGracePeriodSeconds Default duration in seconds k8s waits for container to exit before sending kill signal.
## Any time in excess of 10 seconds will be spent waiting for any synchronization necessary for cluster not to lose data.
##
terminationGracePeriodSeconds: 200
## @param extraEnvVars Extra environment variables to add to Release pods
## E.g:
## extraEnvVars:
## - name: FOO
## value: BAR
##
extraEnvVars: [ ]
## @param extraEnvVarsCM Name of existing ConfigMap containing extra environment variables
##
extraEnvVarsCM: ""
## @param extraEnvVarsSecret Name of existing Secret containing extra environment variables (in case of sensitive data)
##
extraEnvVarsSecret: ""
## Container Ports
## @param containerPorts.releaseHttp Release HTTP port value exposed on the container
## @param containerPorts.releaseHttps Release HTTPS port value exposed on the container
##
containerPorts:
releaseHttp: 5516
releaseHttps: 5543
## @param extraContainerPorts Extra ports to be included in container spec, primarily informational
## E.g:
## extraContainerPorts:
## - name: new_port_name
## containerPort: 1234
##
extraContainerPorts: []
## @extra configuration Release Configuration file content: required cluster configuration
## Do not override unless you know what you are doing.
## To add more configuration, use `extraConfiguration` of `advancedConfiguration` instead
##
configuration:
## @extra configuration.default-conf_xl-release-conf-template The configuration for the xl-release.conf.template file
## @param configuration.default-conf_xl-release-conf-template.path The path for the xl-release.conf.template file
## @param configuration.default-conf_xl-release-conf-template.mode The access mode for the xl-release.conf.template file
## @param configuration.default-conf_xl-release-conf-template.content Content of the xl-release.conf.template file
default-conf_xl-release-conf-template:
path: "default-conf/xl-release.conf.template"
mode: 0660
content: |
xl {
cluster {
# mode: "default", "hot-standby", "full"
mode = ${XL_CLUSTER_MODE}
name = "xl-release_cluster"
pekko {
loglevel = "INFO"
actor.debug.receive = off
remote {
log-received-messages = off
log-sent-messages = off
}
}
}
server {
http2 {
enabled = ${XLR_HTTP2_ENABLED}
}
session {
storage {
enabled = {{ include "common.tplvalues.render" ( dict "value" .Values.auth.sessionStorage "context" $ ) }}
}
}
}
license {
kind = ${XL_LICENSE_KIND}
product = "xl-release"
}
database {
db-driver-classname="${XL_DB_DRIVER}"
db-password="""${XL_DB_PASSWORD}"""
db-url="${XL_DB_URL}"
db-username=${XL_DB_USERNAME}
max-pool-size=${XL_DB_MAX_POOL_SIZE}
}
# TODO Release does not support (H2) running in one schema.
reporting {
db-driver-classname="${XL_DB_DRIVER}"
db-password="""${XL_REPORT_DB_PASSWORD}"""
db-url="${XL_REPORT_DB_URL}"
db-username=${XL_REPORT_DB_USERNAME}
max-pool-size=${XL_REPORT_DB_MAX_POOL_SIZE}
}
# Task queue
queue {
embedded=${ENABLE_EMBEDDED_QUEUE}
connector="${XLR_TASK_QUEUE_CONNECTOR_TYPE}"
password="""${XLR_TASK_QUEUE_PASSWORD}"""
queueName="${XLR_TASK_QUEUE_NAME}"
url="${XLR_TASK_QUEUE_URL}"
username="${XLR_TASK_QUEUE_USERNAME}"
queueType="${XLR_TASK_QUEUE_TYPE}"
}
metrics {
enabled = ${XL_METRICS_ENABLED}
}
{{- if .Values.oidc.enabled }}
security {
auth {
providers {
oidc {
clientId=""
clientId=${?OIDC_CLIENT_ID}
clientSecret=""
clientSecret=${?OIDC_CLIENT_SECRET}
{{- if .Values.oidc.clientAuthMethod }}
clientAuthMethod={{ .Values.oidc.clientAuthMethod | quote }}
{{- end }}
{{- if .Values.oidc.clientAuthJwt.enable }}
clientAuthJwt {
jwsAlg={{ default "" .Values.oidc.clientAuthJwt.jwsAlg | quote }}
tokenKeyId={{ default "" .Values.oidc.clientAuthJwt.tokenKeyId | quote }}
{{- if .Values.oidc.clientAuthJwt.keyStore.enable }}
keyStore {
path={{ default "" .Values.oidc.clientAuthJwt.keyStore.path | quote }}
password=""
password=${?OIDC_CLIENT_AUTH_JWT_KEYSTORE_PASSWORD}
type={{ default "" .Values.oidc.clientAuthJwt.keyStore.type | quote }}
}
{{- end }}
{{- if .Values.oidc.clientAuthJwt.key.enable }}
key {
alias={{ default "" .Values.oidc.clientAuthJwt.key.alias | quote }}
password=""
password=${?OIDC_CLIENT_AUTH_JWT_KEY_PASSWORD}
}
{{- end }}
}
{{- end }}
issuer={{ .Values.oidc.issuer | quote }}
keyRetrievalUri={{ default "" .Values.oidc.keyRetrievalUri | quote }}
accessTokenUri={{ default "" .Values.oidc.accessTokenUri | quote }}
userAuthorizationUri={{ default "" .Values.oidc.userAuthorizationUri | quote }}
logoutUri={{ default "" .Values.oidc.logoutUri | quote }}
redirectUri={{ .Values.oidc.redirectUri | quote }}
postLogoutRedirectUri={{ .Values.oidc.postLogoutRedirectUri | quote }}
userNameClaim={{ default "" .Values.oidc.userNameClaim | quote }}
fullNameClaim={{ default "" .Values.oidc.fullNameClaim | quote }}
emailClaim={{ default "" .Values.oidc.emailClaim | quote }}
{{- if .Values.oidc.externalIdClaim }}
externalIdClaim={{ .Values.oidc.externalIdClaim | quote }}
{{- end }}
rolesClaim={{ default "" .Values.oidc.rolesClaim | quote }}
{{- if .Values.oidc.scopes }}
scopes={{ .Values.oidc.scopes }}
{{- else }}
scopes=["openid"]
{{- end }}
{{- if .Values.oidc.idTokenJWSAlg }}
idTokenJWSAlg={{ .Values.oidc.idTokenJWSAlg | quote }}
{{- end }}
{{- if .Values.oidc.accessToken.enable }}
access-token {
issuer={{ default "" .Values.oidc.accessToken.issuer | quote }}
audience={{ default "" .Values.oidc.accessToken.audience | quote }}
keyRetrievalUri={{ default "" .Values.oidc.accessToken.keyRetrievalUri | quote }}
jwsAlg={{ default "" .Values.oidc.accessToken.jwsAlg | quote }}
secretKey=""
secretKey=${?OIDC_ACCESS_TOKEN_SECRET_KEY}
}
{{- end }}
{{- if .Values.oidc.proxyHost }}
proxyHost={{ .Values.oidc.proxyHost | quote }}
{{- end }}
{{- if .Values.oidc.proxyPort }}
proxyPort={{ .Values.oidc.proxyPort | quote }}
{{- end }}
}
}
}
}
{{- end }}
}
## @param extraConfiguration Configuration file content: extra configuration to be appended to Release configuration
## Use this instead of `configuration` to add more configuration
##
extraConfiguration: {}
## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts
## Examples:
## extraVolumeMounts:
## - name: extras
## mountPath: /usr/share/extras
## readOnly: true
##
extraVolumeMounts: []
## @param extraVolumes Optionally specify extra list of additional volumes .
## Example:
## extraVolumes:
## - name: extras
## emptyDir: {}
##
extraVolumes: []
## @param extraSecrets Optionally specify extra secrets to be created by the chart.
## This can be useful when combined with load_definitions to automatically create the secret containing the definitions to be loaded.
## Example:
## extraSecrets:
## load-definition:
## load_definition.json: |
## {
## ...
## }
##
extraSecrets: {}
## @param extraSecretsPrependReleaseName Set this flag to true if extraSecrets should be created with <release-name> prepended.
##
extraSecretsPrependReleaseName: false
## @section Release Image parameters
## Release image version
## ref: https://hub.docker.com/r/xebialabs/xl-release/tags/
## @param image.registry Release image registry
## @param image.repository Release image repository
## @param image.tag Release image tag (immutable tags are recommended)
## @param image.pullPolicy Release image pull policy
## @param image.pullSecrets Specify docker-registry secret names as an array
##
image:
registry: docker.io
repository: xebialabsunsupported/xl-release
tag: "{{ .Chart.AppVersion }}"
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
##
pullPolicy: IfNotPresent
## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
## Example:
## pullSecrets:
## - myRegistryKeySecretName
##
pullSecrets: []
## @section Ingress parameters
##
## Configure the ingress resource that allows you to access the
## Release installation. Set up the URL
## ref: https://kubernetes.io/docs/user-guide/ingress/
##
ingress:
## @param ingress.enabled Enable ingress resource for Management console
##
enabled: false
## @param ingress.path Path for the default host. You may need to set this to '/*' in order to use this with ALB ingress controllers.
##
path: /
## @param ingress.pathType Ingress path type
##
pathType: ImplementationSpecific
## @param ingress.hostname Default host for the ingress resource
##
hostname: ""
## @param ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.
## For a full list of possible ingress annotations, please see
## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md
## Use this parameter to set the required annotations for cert-manager, see
## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
##
## e.g:
## annotations:
## kubernetes.io/ingress.class: nginx
## cert-manager.io/cluster-issuer: cluster-issuer-name
##
## - generic
## ingress.kubernetes.io/tls-acme: "true"
##
## - nginx
## kubernetes.io/ingress.class: "nginx-dair"
## nginx.ingress.kubernetes.io/ssl-redirect: "false"
## nginx.ingress.kubernetes.io/rewrite-target: /
## nginx.ingress.kubernetes.io/affinity: cookie
## nginx.ingress.kubernetes.io/session-cookie-name: ROUTE
## nginx.ingress.kubernetes.io/proxy-body-size: "0"
## nginx.ingress.kubernetes.io/proxy-connect-timeout: "120"
## nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
## nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
##
## - haproxy
## kubernetes.io/ingress.class: "haproxy-dair"
## haproxy-ingress.github.io/ssl-redirect: "false"
## haproxy-ingress.github.io/rewrite-target: /
## haproxy-ingress.github.io/affinity: cookie
## haproxy-ingress.github.io/session-cookie-name: JSESSIONID
## haproxy-ingress.github.io/session-cookie-strategy: prefix
## haproxy-ingress.github.io/timeout-client: "120s"
## haproxy-ingress.github.io/timeout-http-request: "120s"
##
annotations:
## @param ingress.tls Enable TLS configuration for the hostname defined at `ingress.hostname` parameter
## TLS certificates will be retrieved from a TLS secret with name: {{- printf "%s-ingress-tls" .Values.ingress.hostname }}
## You can:
## - Use the `ingress.secrets` parameter to create this TLS secret
## - Relay on cert-manager to create it by setting the corresponding annotations
## - Relay on Helm to create self-signed certificates by setting `ingress.selfSigned=true`
##
tls: false
## @param ingress.selfSigned Set this to true in order to create a TLS secret for this ingress record
## using self-signed certificates generated by Helm
##
selfSigned: false
## @param ingress.extraHosts The list of additional hostnames to be covered with this ingress record.
## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array
## e.g:
## extraHosts:
## - name: release.local
## path: /
##
extraHosts: []
## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host
## e.g:
## extraPaths:
## - path: /*