Commit new Chart releases for TrueCharts
Signed-off-by: TrueCharts-Bot <bot@truecharts.org>
This commit is contained in:
parent
b5bb871878
commit
5754742d05
|
@ -0,0 +1,99 @@
|
||||||
|
---
|
||||||
|
title: Changelog
|
||||||
|
---
|
||||||
|
|
||||||
|
**Important:**
|
||||||
|
*for the complete changelog, please refer to the website*
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## [authelia-22.1.6](https://github.com/truecharts/charts/compare/authelia-22.1.5...authelia-22.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
||||||
|
|
||||||
|
|
||||||
|
## [authelia-22.1.5](https://github.com/truecharts/charts/compare/authelia-22.1.4...authelia-22.1.5) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- increase common version for oci fixes
|
||||||
|
|
||||||
|
|
||||||
|
## [authelia-22.1.4](https://github.com/truecharts/charts/compare/authelia-22.1.3...authelia-22.1.4) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16734](https://github.com/truecharts/charts/issues/16734))
|
||||||
|
|
||||||
|
- remove non-existent template refs ([#16738](https://github.com/truecharts/charts/issues/16738))
|
||||||
|
|
||||||
|
|
||||||
|
## [authelia-22.1.3](https://github.com/truecharts/charts/compare/authelia-22.1.0...authelia-22.1.3) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.19[@4ebb688](https://github.com/4ebb688) by renovate ([#16733](https://github.com/truecharts/charts/issues/16733))
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
|
||||||
|
|
||||||
|
## [authelia-22.1.2](https://github.com/truecharts/charts/compare/authelia-22.1.0...authelia-22.1.2) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
## [authelia-22.1.0](https://github.com/truecharts/charts/compare/authelia-22.0.2...authelia-22.1.0) (2023-12-30)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general minor by renovate ([#16579](https://github.com/truecharts/charts/issues/16579))
|
||||||
|
|
||||||
|
## [authelia-22.0.2](https://github.com/truecharts/charts/compare/authelia-22.0.1...authelia-22.0.2) (2023-12-27)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16560](https://github.com/truecharts/charts/issues/16560))
|
||||||
|
|
||||||
|
## [authelia-22.0.1](https://github.com/truecharts/charts/compare/authelia-22.0.0...authelia-22.0.1) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16545](https://github.com/truecharts/charts/issues/16545))
|
||||||
|
|
||||||
|
## [authelia-22.0.0](https://github.com/truecharts/charts/compare/authelia-21.0.0...authelia-22.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general major by renovate (major) ([#16547](https://github.com/truecharts/charts/issues/16547))
|
||||||
|
|
||||||
|
## [authelia-22.0.0](https://github.com/truecharts/charts/compare/authelia-21.0.0...authelia-22.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
|
@ -0,0 +1,54 @@
|
||||||
|
kubeVersion: ">=1.24.0-0"
|
||||||
|
apiVersion: v2
|
||||||
|
name: authelia
|
||||||
|
version: 22.1.6
|
||||||
|
appVersion: 4.37.5
|
||||||
|
description: Authelia is a Single Sign-On Multi-Factor portal for web apps
|
||||||
|
home: https://truecharts.org/charts/enterprise/authelia
|
||||||
|
icon: https://truecharts.org/img/hotlink-ok/chart-icons/authelia.png
|
||||||
|
deprecated: false
|
||||||
|
sources:
|
||||||
|
- https://github.com/truecharts/charts/tree/master/charts/enterprise/authelia
|
||||||
|
- https://ghcr.io/authelia/authelia
|
||||||
|
- https://github.com/authelia/authelia
|
||||||
|
- https://github.com/authelia/chartrepo
|
||||||
|
maintainers:
|
||||||
|
- name: TrueCharts
|
||||||
|
email: info@truecharts.org
|
||||||
|
url: https://truecharts.org
|
||||||
|
keywords:
|
||||||
|
- authelia
|
||||||
|
- authentication
|
||||||
|
- login
|
||||||
|
- SSO
|
||||||
|
- Authentication
|
||||||
|
- Security
|
||||||
|
- Two-Factor
|
||||||
|
- U2F
|
||||||
|
- YubiKey
|
||||||
|
- Push Notifications
|
||||||
|
- LDAP
|
||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
version: 17.2.21
|
||||||
|
repository: oci://tccr.io/truecharts
|
||||||
|
condition: ""
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
- name: redis
|
||||||
|
version: 11.1.5
|
||||||
|
repository: https://deps.truecharts.org
|
||||||
|
condition: redis.enabled
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
annotations:
|
||||||
|
max_scale_version: 23.10.2
|
||||||
|
min_scale_version: 23.10.0
|
||||||
|
truecharts.org/SCALE-support: "true"
|
||||||
|
truecharts.org/category: security
|
||||||
|
truecharts.org/max_helm_version: "3.13"
|
||||||
|
truecharts.org/min_helm_version: "3.12"
|
||||||
|
truecharts.org/train: enterprise
|
||||||
|
type: application
|
|
@ -0,0 +1,106 @@
|
||||||
|
Business Source License 1.1
|
||||||
|
|
||||||
|
Parameters
|
||||||
|
|
||||||
|
Licensor: The TrueCharts Project, it's owner and it's contributors
|
||||||
|
Licensed Work: The TrueCharts "Cert-Manager" Helm Chart
|
||||||
|
Additional Use Grant: You may use the licensed work in production, as long
|
||||||
|
as it is directly sourced from a TrueCharts provided
|
||||||
|
official repository, catalog or source. You may also make private
|
||||||
|
modification to the directly sourced licenced work,
|
||||||
|
when used in production.
|
||||||
|
|
||||||
|
The following cases are, due to their nature, also
|
||||||
|
defined as 'production use' and explicitly prohibited:
|
||||||
|
- Bundling, including or displaying the licensed work
|
||||||
|
with(in) another work intended for production use,
|
||||||
|
with the apparent intend of facilitating and/or
|
||||||
|
promoting production use by third parties in
|
||||||
|
violation of this license.
|
||||||
|
|
||||||
|
Change Date: 2050-01-01
|
||||||
|
|
||||||
|
Change License: 3-clause BSD license
|
||||||
|
|
||||||
|
For information about alternative licensing arrangements for the Software,
|
||||||
|
please contact: legal@truecharts.org
|
||||||
|
|
||||||
|
Notice
|
||||||
|
|
||||||
|
The Business Source License (this document, or the “License”) is not an Open
|
||||||
|
Source license. However, the Licensed Work will eventually be made available
|
||||||
|
under an Open Source License, as stated in this License.
|
||||||
|
|
||||||
|
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
||||||
|
“Business Source License” is a trademark of MariaDB Corporation Ab.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Business Source License 1.1
|
||||||
|
|
||||||
|
Terms
|
||||||
|
|
||||||
|
The Licensor hereby grants you the right to copy, modify, create derivative
|
||||||
|
works, redistribute, and make non-production use of the Licensed Work. The
|
||||||
|
Licensor may make an Additional Use Grant, above, permitting limited
|
||||||
|
production use.
|
||||||
|
|
||||||
|
Effective on the Change Date, or the fourth anniversary of the first publicly
|
||||||
|
available distribution of a specific version of the Licensed Work under this
|
||||||
|
License, whichever comes first, the Licensor hereby grants you rights under
|
||||||
|
the terms of the Change License, and the rights granted in the paragraph
|
||||||
|
above terminate.
|
||||||
|
|
||||||
|
If your use of the Licensed Work does not comply with the requirements
|
||||||
|
currently in effect as described in this License, you must purchase a
|
||||||
|
commercial license from the Licensor, its affiliated entities, or authorized
|
||||||
|
resellers, or you must refrain from using the Licensed Work.
|
||||||
|
|
||||||
|
All copies of the original and modified Licensed Work, and derivative works
|
||||||
|
of the Licensed Work, are subject to this License. This License applies
|
||||||
|
separately for each version of the Licensed Work and the Change Date may vary
|
||||||
|
for each version of the Licensed Work released by Licensor.
|
||||||
|
|
||||||
|
You must conspicuously display this License on each original or modified copy
|
||||||
|
of the Licensed Work. If you receive the Licensed Work in original or
|
||||||
|
modified form from a third party, the terms and conditions set forth in this
|
||||||
|
License apply to your use of that work.
|
||||||
|
|
||||||
|
Any use of the Licensed Work in violation of this License will automatically
|
||||||
|
terminate your rights under this License for the current and all other
|
||||||
|
versions of the Licensed Work.
|
||||||
|
|
||||||
|
This License does not grant you any right in any trademark or logo of
|
||||||
|
Licensor or its affiliates (provided that you may use a trademark or logo of
|
||||||
|
Licensor as expressly required by this License).
|
||||||
|
|
||||||
|
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
||||||
|
AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
||||||
|
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
||||||
|
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
||||||
|
TITLE.
|
||||||
|
|
||||||
|
MariaDB hereby grants you permission to use this License’s text to license
|
||||||
|
your works, and to refer to it using the trademark “Business Source License”,
|
||||||
|
as long as you comply with the Covenants of Licensor below.
|
||||||
|
|
||||||
|
Covenants of Licensor
|
||||||
|
|
||||||
|
In consideration of the right to use this License’s text and the “Business
|
||||||
|
Source License” name and trademark, Licensor covenants to MariaDB, and to all
|
||||||
|
other recipients of the licensed work to be provided by Licensor:
|
||||||
|
|
||||||
|
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
||||||
|
or a license that is compatible with GPL Version 2.0 or a later version,
|
||||||
|
where “compatible” means that software provided under the Change License can
|
||||||
|
be included in a program with software provided under GPL Version 2.0 or a
|
||||||
|
later version. Licensor may specify additional Change Licenses without
|
||||||
|
limitation.
|
||||||
|
|
||||||
|
2. To either: (a) specify an additional grant of rights to use that does not
|
||||||
|
impose any additional restriction on the right granted in this License, as
|
||||||
|
the Additional Use Grant; or (b) insert the text “None”.
|
||||||
|
|
||||||
|
3. To specify a Change Date.
|
||||||
|
|
||||||
|
4. Not to modify this License in any other way.
|
|
@ -0,0 +1,28 @@
|
||||||
|
---
|
||||||
|
title: README
|
||||||
|
---
|
||||||
|
|
||||||
|
## General Info
|
||||||
|
|
||||||
|
TrueCharts can be installed as both _normal_ Helm Charts or as Apps on TrueNAS SCALE.
|
||||||
|
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||||
|
|
||||||
|
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/authelia)
|
||||||
|
|
||||||
|
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||||
|
- See the [Website](https://truecharts.org)
|
||||||
|
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||||
|
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Sponsor TrueCharts
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||||
|
|
||||||
|
_All Rights Reserved - The TrueCharts Project_
|
|
@ -0,0 +1,9 @@
|
||||||
|
|
||||||
|
|
||||||
|
## [authelia-22.1.6](https://github.com/truecharts/charts/compare/authelia-22.1.5...authelia-22.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
|
@ -0,0 +1,8 @@
|
||||||
|
Authelia is a Single Sign-On Multi-Factor portal for web apps
|
||||||
|
|
||||||
|
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/enterprise/authelia](https://truecharts.org/charts/enterprise/authelia)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
Binary file not shown.
|
@ -0,0 +1,582 @@
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/authelia/authelia
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: 4.37.5@sha256:25fc5423238b6f3a1fc967fda3f6a9212846aeb4a720327ef61c8ccff52dbbe2
|
||||||
|
manifestManager:
|
||||||
|
enabled: true
|
||||||
|
workload:
|
||||||
|
main:
|
||||||
|
replicas: 2
|
||||||
|
strategy: RollingUpdate
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
command:
|
||||||
|
- authelia
|
||||||
|
args:
|
||||||
|
- --config=/configuration.yaml
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: authelia-paths
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
type: http
|
||||||
|
path: "/api/health"
|
||||||
|
readiness:
|
||||||
|
type: http
|
||||||
|
path: "/api/health"
|
||||||
|
startup:
|
||||||
|
type: http
|
||||||
|
path: "/api/health"
|
||||||
|
service:
|
||||||
|
main:
|
||||||
|
ports:
|
||||||
|
main:
|
||||||
|
port: 9091
|
||||||
|
targetPort: 9091
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
mountPath: "/config"
|
||||||
|
cnpg:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
user: authelia
|
||||||
|
database: authelia
|
||||||
|
# Enabled redis
|
||||||
|
# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis
|
||||||
|
redis:
|
||||||
|
enabled: true
|
||||||
|
domain: example.com
|
||||||
|
##
|
||||||
|
## Server Configuration
|
||||||
|
##
|
||||||
|
server:
|
||||||
|
##
|
||||||
|
## Port sets the configured port for the daemon, service, and the probes.
|
||||||
|
## Default is 9091 and should not need to be changed.
|
||||||
|
##
|
||||||
|
port: 9091
|
||||||
|
## Buffers usually should be configured to be the same value.
|
||||||
|
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
||||||
|
## Read buffer size adjusts the server's max incoming request size in bytes.
|
||||||
|
## Write buffer size does the same for outgoing responses.
|
||||||
|
read_buffer_size: 4096
|
||||||
|
write_buffer_size: 4096
|
||||||
|
## Set the single level path Authelia listens on.
|
||||||
|
## Must be alphanumeric chars and should not contain any slashes.
|
||||||
|
path: ""
|
||||||
|
log:
|
||||||
|
## Level of verbosity for logs: info, debug, trace.
|
||||||
|
level: trace
|
||||||
|
## Format the logs are written as: json, text.
|
||||||
|
format: text
|
||||||
|
## TODO: Statefulness check should check if this is set, and the configMap should enable it.
|
||||||
|
## File path where the logs will be written. If not set logs are written to stdout.
|
||||||
|
# file_path: /config/authelia.log
|
||||||
|
## Default redirection URL
|
||||||
|
##
|
||||||
|
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
|
||||||
|
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
|
||||||
|
## in such a case.
|
||||||
|
##
|
||||||
|
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
|
||||||
|
## Default is https://www.<domain> (value at the top of the values.yaml).
|
||||||
|
default_redirection_url: ""
|
||||||
|
# default_redirection_url: https://example.com
|
||||||
|
|
||||||
|
theme: light
|
||||||
|
##
|
||||||
|
## TOTP Configuration
|
||||||
|
##
|
||||||
|
## Parameters used for TOTP generation
|
||||||
|
totp:
|
||||||
|
## The issuer name displayed in the Authenticator application of your choice
|
||||||
|
## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
|
||||||
|
## Defaults to <domain>.
|
||||||
|
issuer: ""
|
||||||
|
## The period in seconds a one-time password is current for. Changing this will require all users to register
|
||||||
|
## their TOTP applications again. Warning: before changing period read the docs link below.
|
||||||
|
period: 30
|
||||||
|
## The skew controls number of one-time passwords either side of the current one that are valid.
|
||||||
|
## Warning: before changing skew read the docs link below.
|
||||||
|
## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
|
||||||
|
skew: 1
|
||||||
|
##
|
||||||
|
## Password Policy Config
|
||||||
|
##
|
||||||
|
## Parameters used for Password Policies
|
||||||
|
password_policy:
|
||||||
|
## See: https://www.authelia.com/configuration/security/password-policy/
|
||||||
|
standard:
|
||||||
|
enabled: false
|
||||||
|
min_length: 8
|
||||||
|
max_length: 0
|
||||||
|
require_uppercase: false
|
||||||
|
require_lowercase: false
|
||||||
|
require_number: false
|
||||||
|
require_special: false
|
||||||
|
zxcvbn:
|
||||||
|
## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info
|
||||||
|
enabled: false
|
||||||
|
min_score: 3
|
||||||
|
##
|
||||||
|
## Duo Push API Configuration
|
||||||
|
##
|
||||||
|
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
|
||||||
|
## "Partner Auth API" in the management panel.
|
||||||
|
duo_api:
|
||||||
|
enabled: false
|
||||||
|
hostname: api-123456789.example.com
|
||||||
|
integration_key: ABCDEF
|
||||||
|
plain_api_key: ""
|
||||||
|
## NTP settings
|
||||||
|
ntp:
|
||||||
|
address: "time.cloudflare.com:123"
|
||||||
|
version: 4
|
||||||
|
max_desync: 3s
|
||||||
|
disable_startup_check: false
|
||||||
|
disable_failure: true
|
||||||
|
##
|
||||||
|
## Authentication Backend Provider Configuration
|
||||||
|
##
|
||||||
|
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
|
||||||
|
##
|
||||||
|
## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
|
||||||
|
authentication_backend:
|
||||||
|
## Disable both the HTML element and the API for reset password functionality
|
||||||
|
disable_reset_password: false
|
||||||
|
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
|
||||||
|
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
|
||||||
|
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
|
||||||
|
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
|
||||||
|
## See the below documentation for more information.
|
||||||
|
## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
||||||
|
## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
|
||||||
|
refresh_interval: 5m
|
||||||
|
## LDAP backend configuration.
|
||||||
|
##
|
||||||
|
## This backend allows Authelia to be scaled to more
|
||||||
|
## than one instance and therefore is recommended for
|
||||||
|
## production.
|
||||||
|
ldap:
|
||||||
|
## Enable LDAP Backend.
|
||||||
|
enabled: false
|
||||||
|
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
|
||||||
|
## Acceptable options are as follows:
|
||||||
|
## - 'activedirectory' - For Microsoft Active Directory.
|
||||||
|
## - 'custom' - For custom specifications of attributes and filters.
|
||||||
|
## This currently defaults to 'custom' to maintain existing behaviour.
|
||||||
|
##
|
||||||
|
## Depending on the option here certain other values in this section have a default value, notably all of the
|
||||||
|
## attribute mappings have a default value that this config overrides, you can read more about these default values
|
||||||
|
## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
|
||||||
|
implementation: activedirectory
|
||||||
|
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
|
||||||
|
## Scheme can be ldap or ldaps in the format (port optional).
|
||||||
|
url: ldap://openldap.default.svc.cluster.local
|
||||||
|
## Connection Timeout.
|
||||||
|
timeout: 5s
|
||||||
|
## Use StartTLS with the LDAP connection.
|
||||||
|
start_tls: false
|
||||||
|
tls:
|
||||||
|
## Server Name for certificate validation (in case it's not set correctly in the URL).
|
||||||
|
server_name: ""
|
||||||
|
## Skip verifying the server certificate (to allow a self-signed certificate).
|
||||||
|
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
||||||
|
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
||||||
|
skip_verify: false
|
||||||
|
## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
|
||||||
|
minimum_version: TLS1.2
|
||||||
|
## The base dn for every LDAP query.
|
||||||
|
base_dn: DC=example,DC=com
|
||||||
|
## The attribute holding the username of the user. This attribute is used to populate the username in the session
|
||||||
|
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
|
||||||
|
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
|
||||||
|
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
|
||||||
|
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
|
||||||
|
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
|
||||||
|
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
|
||||||
|
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
|
||||||
|
username_attribute: "uid"
|
||||||
|
## An additional dn to define the scope to all users.
|
||||||
|
additional_users_dn: OU=Users
|
||||||
|
## The users filter used in search queries to find the user profile based on input filled in login form.
|
||||||
|
## Various placeholders are available in the user filter:
|
||||||
|
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
||||||
|
## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
|
||||||
|
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
||||||
|
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
||||||
|
## versions, so please don't use it.
|
||||||
|
##
|
||||||
|
## Recommended settings are as follows:
|
||||||
|
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
|
||||||
|
## - OpenLDAP:
|
||||||
|
## - (&({username_attribute}={input})(objectClass=person))
|
||||||
|
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
|
||||||
|
##
|
||||||
|
## To allow sign in both with username and email, one can use a filter like
|
||||||
|
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
|
||||||
|
users_filter: ""
|
||||||
|
## An additional dn to define the scope of groups.
|
||||||
|
additional_groups_dn: OU=Groups
|
||||||
|
## The groups filter used in search queries to find the groups of the user.
|
||||||
|
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
||||||
|
## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
|
||||||
|
## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
|
||||||
|
## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
|
||||||
|
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
||||||
|
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
||||||
|
## versions, so please don't use it.
|
||||||
|
## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
|
||||||
|
## later version, so please don't use it.
|
||||||
|
##
|
||||||
|
## If your groups use the `groupOfUniqueNames` structure use this instead:
|
||||||
|
## (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
|
||||||
|
groups_filter: ""
|
||||||
|
## The attribute holding the name of the group
|
||||||
|
group_name_attribute: "cn"
|
||||||
|
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
||||||
|
## first one returned by the LDAP server is used.
|
||||||
|
mail_attribute: "mail"
|
||||||
|
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
||||||
|
display_name_attribute: "displayname"
|
||||||
|
## The username of the admin user.
|
||||||
|
user: CN=admin,DC=example,DC=com
|
||||||
|
plain_password: ""
|
||||||
|
##
|
||||||
|
## File (Authentication Provider)
|
||||||
|
##
|
||||||
|
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
|
||||||
|
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
|
||||||
|
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
|
||||||
|
## implications it is highly recommended you leave the default values. Before considering changing these settings
|
||||||
|
## please read the docs page below:
|
||||||
|
## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
|
||||||
|
##
|
||||||
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
||||||
|
##
|
||||||
|
file:
|
||||||
|
enabled: true
|
||||||
|
path: /config/users_database.yml
|
||||||
|
password:
|
||||||
|
algorithm: argon2id
|
||||||
|
iterations: 1
|
||||||
|
key_length: 32
|
||||||
|
salt_length: 16
|
||||||
|
memory: 1024
|
||||||
|
parallelism: 8
|
||||||
|
##
|
||||||
|
## Access Control Configuration
|
||||||
|
##
|
||||||
|
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
|
||||||
|
##
|
||||||
|
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
|
||||||
|
## to anyone. Otherwise restrictions follow the rules defined.
|
||||||
|
##
|
||||||
|
## Note: One can use the wildcard * to match any subdomain.
|
||||||
|
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
|
||||||
|
##
|
||||||
|
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
|
||||||
|
##
|
||||||
|
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
|
||||||
|
##
|
||||||
|
## - 'domain' defines which domain or set of domains the rule applies to.
|
||||||
|
##
|
||||||
|
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
|
||||||
|
## provided. If provided, the parameter represents either a user or a group. It should be of the form
|
||||||
|
## 'user:<username>' or 'group:<groupname>'.
|
||||||
|
##
|
||||||
|
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
|
||||||
|
##
|
||||||
|
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
|
||||||
|
## is optional and matches any resource if not provided.
|
||||||
|
##
|
||||||
|
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
|
||||||
|
access_control:
|
||||||
|
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
|
||||||
|
## resource if there is no policy to be applied to the user.
|
||||||
|
default_policy: deny
|
||||||
|
networks_access_control: []
|
||||||
|
# networks_access_control:
|
||||||
|
# - name: private
|
||||||
|
# networks:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# - 172.16.0.0/12
|
||||||
|
# - 192.168.0.0/16
|
||||||
|
# - name: vpn
|
||||||
|
# networks:
|
||||||
|
# - 10.9.0.0/16
|
||||||
|
|
||||||
|
rules: []
|
||||||
|
# rules:
|
||||||
|
# - domain: public.example.com
|
||||||
|
# policy: bypass
|
||||||
|
# - domain: "*.example.com"
|
||||||
|
# policy: bypass
|
||||||
|
# methods:
|
||||||
|
# - OPTIONS
|
||||||
|
# - domain: secure.example.com
|
||||||
|
# policy: one_factor
|
||||||
|
# networks:
|
||||||
|
# - private
|
||||||
|
# - vpn
|
||||||
|
# - 192.168.1.0/24
|
||||||
|
# - 10.0.0.1
|
||||||
|
# - domain:
|
||||||
|
# - secure.example.com
|
||||||
|
# - private.example.com
|
||||||
|
# policy: two_factor
|
||||||
|
# - domain: singlefactor.example.com
|
||||||
|
# policy: one_factor
|
||||||
|
# - domain: "mx2.mail.example.com"
|
||||||
|
# subject: "group:admins"
|
||||||
|
# policy: deny
|
||||||
|
# - domain: "*.example.com"
|
||||||
|
# subject:
|
||||||
|
# - "group:admins"
|
||||||
|
# - "group:moderators"
|
||||||
|
# policy: two_factor
|
||||||
|
# - domain: dev.example.com
|
||||||
|
# resources:
|
||||||
|
# - "^/groups/dev/.*$"
|
||||||
|
# subject: "group:dev"
|
||||||
|
# policy: two_factor
|
||||||
|
# - domain: dev.example.com
|
||||||
|
# resources:
|
||||||
|
# - "^/users/john/.*$"
|
||||||
|
# subject:
|
||||||
|
# - ["group:dev", "user:john"]
|
||||||
|
# - "group:admins"
|
||||||
|
# policy: two_factor
|
||||||
|
# - domain: "{user}.example.com"
|
||||||
|
# policy: bypass
|
||||||
|
##
|
||||||
|
## Session Provider Configuration
|
||||||
|
##
|
||||||
|
## The session cookies identify the user once logged in.
|
||||||
|
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
|
||||||
|
session:
|
||||||
|
## The name of the session cookie. (default: authelia_session).
|
||||||
|
name: authelia_session
|
||||||
|
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
|
||||||
|
## Please read https://www.authelia.com/docs/configuration/session.html#same_site
|
||||||
|
same_site: lax
|
||||||
|
## The time in seconds before the cookie expires and session is reset.
|
||||||
|
expiration: 1h
|
||||||
|
## The inactivity time in seconds before the session is reset.
|
||||||
|
inactivity: 5m
|
||||||
|
## The remember me duration.
|
||||||
|
## Value is in seconds, or duration notation. Value of 0 disables remember me.
|
||||||
|
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
||||||
|
## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
|
||||||
|
## spy or attack. Currently the default is 1M or 1 month.
|
||||||
|
remember_me_duration: 1M
|
||||||
|
##
|
||||||
|
## Redis Provider
|
||||||
|
##
|
||||||
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
||||||
|
##
|
||||||
|
## The redis connection details
|
||||||
|
redisProvider:
|
||||||
|
port: 6379
|
||||||
|
## Optional username to be used with authentication.
|
||||||
|
# username: authelia
|
||||||
|
username: ""
|
||||||
|
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
||||||
|
database_index: 0
|
||||||
|
## The maximum number of concurrent active connections to Redis.
|
||||||
|
maximum_active_connections: 8
|
||||||
|
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
||||||
|
minimum_idle_connections: 0
|
||||||
|
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
||||||
|
tls:
|
||||||
|
enabled: false
|
||||||
|
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
||||||
|
server_name: ""
|
||||||
|
## Skip verifying the server certificate (to allow a self-signed certificate).
|
||||||
|
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
||||||
|
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
||||||
|
skip_verify: false
|
||||||
|
## Minimum TLS version for the connection.
|
||||||
|
minimum_version: TLS1.2
|
||||||
|
## The Redis HA configuration options.
|
||||||
|
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
||||||
|
high_availability:
|
||||||
|
enabled: false
|
||||||
|
enabledSecret: false
|
||||||
|
## Sentinel Name / Master Name
|
||||||
|
sentinel_name: mysentinel
|
||||||
|
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
||||||
|
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
||||||
|
## For high availability to be used you must have either defined; the host above or at least one node below.
|
||||||
|
nodes: []
|
||||||
|
# nodes:
|
||||||
|
# - host: sentinel-0.databases.svc.cluster.local
|
||||||
|
# port: 26379
|
||||||
|
# - host: sentinel-1.databases.svc.cluster.local
|
||||||
|
# port: 26379
|
||||||
|
|
||||||
|
## Choose the host with the lowest latency.
|
||||||
|
route_by_latency: false
|
||||||
|
## Choose the host randomly.
|
||||||
|
route_randomly: false
|
||||||
|
##
|
||||||
|
## Regulation Configuration
|
||||||
|
##
|
||||||
|
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
|
||||||
|
## in a short period of time.
|
||||||
|
regulation:
|
||||||
|
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
|
||||||
|
max_retries: 3
|
||||||
|
## The time range during which the user can attempt login before being banned. The user is banned if the
|
||||||
|
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
|
||||||
|
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
||||||
|
find_time: 2m
|
||||||
|
## The length of time before a banned user can login again. Ban Time accepts duration notation.
|
||||||
|
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
||||||
|
ban_time: 5m
|
||||||
|
##
|
||||||
|
## Storage Provider Configuration
|
||||||
|
##
|
||||||
|
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
||||||
|
storage:
|
||||||
|
##
|
||||||
|
## PostgreSQL (Storage Provider)
|
||||||
|
##
|
||||||
|
postgres:
|
||||||
|
port: 5432
|
||||||
|
database: authelia
|
||||||
|
username: authelia
|
||||||
|
sslmode: disable
|
||||||
|
timeout: 5s
|
||||||
|
##
|
||||||
|
## Notification Provider
|
||||||
|
##
|
||||||
|
##
|
||||||
|
## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
|
||||||
|
## The available providers are: filesystem, smtp. You must use one and only one of these providers.
|
||||||
|
notifier:
|
||||||
|
## You can disable the notifier startup check by setting this to true.
|
||||||
|
disable_startup_check: false
|
||||||
|
##
|
||||||
|
## File System (Notification Provider)
|
||||||
|
##
|
||||||
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
||||||
|
##
|
||||||
|
filesystem:
|
||||||
|
enabled: true
|
||||||
|
filename: /config/notification.txt
|
||||||
|
##
|
||||||
|
## SMTP (Notification Provider)
|
||||||
|
##
|
||||||
|
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
|
||||||
|
## [Security] By default Authelia will:
|
||||||
|
## - force all SMTP connections over TLS including unauthenticated connections
|
||||||
|
## - use the disable_require_tls boolean value to disable this requirement
|
||||||
|
## (only works for unauthenticated connections)
|
||||||
|
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
|
||||||
|
## (configure in tls section)
|
||||||
|
smtp:
|
||||||
|
enabled: false
|
||||||
|
enabledSecret: false
|
||||||
|
host: smtp.mail.svc.cluster.local
|
||||||
|
port: 25
|
||||||
|
timeout: 5s
|
||||||
|
username: test
|
||||||
|
plain_password: test
|
||||||
|
sender: admin@example.com
|
||||||
|
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
|
||||||
|
identifier: localhost
|
||||||
|
## Subject configuration of the emails sent.
|
||||||
|
## {title} is replaced by the text from the notifier
|
||||||
|
subject: "[Authelia] {title}"
|
||||||
|
## This address is used during the startup check to verify the email configuration is correct.
|
||||||
|
## It's not important what it is except if your email server only allows local delivery.
|
||||||
|
startup_check_address: test@authelia.com
|
||||||
|
disable_require_tls: false
|
||||||
|
disable_html_emails: false
|
||||||
|
tls:
|
||||||
|
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
||||||
|
server_name: ""
|
||||||
|
## Skip verifying the server certificate (to allow a self-signed certificate).
|
||||||
|
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
||||||
|
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
||||||
|
skip_verify: false
|
||||||
|
## Minimum TLS version for either StartTLS or SMTPS.
|
||||||
|
minimum_version: TLS1.2
|
||||||
|
identity_providers:
|
||||||
|
oidc:
|
||||||
|
## Enables this in the config map. Currently in beta stage.
|
||||||
|
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
||||||
|
enabled: false
|
||||||
|
access_token_lifespan: 1h
|
||||||
|
authorize_code_lifespan: 1m
|
||||||
|
id_token_lifespan: 1h
|
||||||
|
refresh_token_lifespan: 90m
|
||||||
|
enable_client_debug_messages: false
|
||||||
|
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
||||||
|
## security reasons.
|
||||||
|
minimum_parameter_entropy: 8
|
||||||
|
clients: []
|
||||||
|
# clients:
|
||||||
|
# -
|
||||||
|
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
||||||
|
# id: myapp
|
||||||
|
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
||||||
|
# description: My Application
|
||||||
|
|
||||||
|
## The client secret is a shared secret between Authelia and the consumer of this client.
|
||||||
|
# secret: apple123
|
||||||
|
|
||||||
|
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
||||||
|
# public: false
|
||||||
|
|
||||||
|
## The policy to require for this client; one_factor or two_factor.
|
||||||
|
# authorization_policy: two_factor
|
||||||
|
|
||||||
|
## Configures the consent mode; auto, explicit or implicit
|
||||||
|
# consent_mode: auto
|
||||||
|
|
||||||
|
## Audience this client is allowed to request.
|
||||||
|
# audience: []
|
||||||
|
|
||||||
|
## Scopes this client is allowed to request.
|
||||||
|
# scopes:
|
||||||
|
# - openid
|
||||||
|
# - profile
|
||||||
|
# - email
|
||||||
|
# - groups
|
||||||
|
|
||||||
|
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
||||||
|
# redirect_uris:
|
||||||
|
# - https://oidc.example.com/oauth2/callback
|
||||||
|
|
||||||
|
## Grant Types configures which grants this client can obtain.
|
||||||
|
## It's not recommended to configure this unless you know what you're doing.
|
||||||
|
# grant_types:
|
||||||
|
# - refresh_token
|
||||||
|
# - authorization_code
|
||||||
|
|
||||||
|
## Response Types configures which responses this client can be sent.
|
||||||
|
## It's not recommended to configure this unless you know what you're doing.
|
||||||
|
# response_types:
|
||||||
|
# - code
|
||||||
|
|
||||||
|
## Response Modes configures which response modes this client supports.
|
||||||
|
## It's not recommended to configure this unless you know what you're doing.
|
||||||
|
# response_modes:
|
||||||
|
# - form_post
|
||||||
|
# - query
|
||||||
|
# - fragment
|
||||||
|
|
||||||
|
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
||||||
|
# userinfo_signing_algorithm: none
|
||||||
|
|
||||||
|
portal:
|
||||||
|
open:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
required: true
|
File diff suppressed because it is too large
Load Diff
|
@ -0,0 +1,366 @@
|
||||||
|
{{/* Define the configmap */}}
|
||||||
|
{{- define "authelia.configmap.paths" -}}
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
|
||||||
|
AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
|
||||||
|
AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
|
||||||
|
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/ENCRYPTION_KEY"
|
||||||
|
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
|
||||||
|
{{- if .Values.authentication_backend.ldap.enabled }}
|
||||||
|
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.notifier.smtp.enabled }}
|
||||||
|
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
|
||||||
|
{{- end }}
|
||||||
|
AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
|
||||||
|
{{- if .Values.redisProvider.high_availability.enabled }}
|
||||||
|
AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.duo_api.enabled }}
|
||||||
|
AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.identity_providers.oidc.enabled }}
|
||||||
|
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
|
||||||
|
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- define "authelia.configmap.configfile" -}}
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
configuration.yaml: |
|
||||||
|
---
|
||||||
|
theme: {{ .Values.theme | default "light" }}
|
||||||
|
default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
|
||||||
|
ntp:
|
||||||
|
address: {{ .Values.ntp.address | default "time.cloudflare.com:123" }}
|
||||||
|
version: {{ .Values.ntp.version | default 4 }}
|
||||||
|
max_desync: {{ .Values.ntp.max_desync | default "3s" }}
|
||||||
|
disable_startup_check: {{ .Values.ntp.disable_startup_check | default false }}
|
||||||
|
disable_failure: {{ .Values.ntp.disable_failure | default true }}
|
||||||
|
server:
|
||||||
|
host: 0.0.0.0
|
||||||
|
port: {{ .Values.server.port | default 9091 }}
|
||||||
|
{{- if ne "" (.Values.server.path | default "") }}
|
||||||
|
path: {{ .Values.server.path }}
|
||||||
|
{{- end }}
|
||||||
|
buffers:
|
||||||
|
write: {{ .Values.server.write_buffer_size | default 4096 }}
|
||||||
|
read: {{ .Values.server.read_buffer_size | default 4096 }}
|
||||||
|
enable_pprof: {{ .Values.server.enable_pprof | default false }}
|
||||||
|
enable_expvars: {{ .Values.server.enable_expvars | default false }}
|
||||||
|
log:
|
||||||
|
level: {{ .Values.log.level | default "info" }}
|
||||||
|
format: {{ .Values.log.format | default "text" }}
|
||||||
|
{{- if ne "" (.Values.log.file_path | default "") }}
|
||||||
|
file_path: {{ .Values.log.file_path }}
|
||||||
|
keep_stdout: true
|
||||||
|
{{- end }}
|
||||||
|
totp:
|
||||||
|
issuer: {{ .Values.totp.issuer | default .Values.domain }}
|
||||||
|
period: {{ .Values.totp.period | default 30 }}
|
||||||
|
skew: {{ .Values.totp.skew | default 1 }}
|
||||||
|
{{- if .Values.password_policy.enabled }}
|
||||||
|
password_policy:
|
||||||
|
standard:
|
||||||
|
enabled: {{ .Values.password_policy.standard.enabled | default false }}
|
||||||
|
min_length: {{ .Values.password_policy.standard.min_length | default 8 }}
|
||||||
|
max_length: {{ .Values.password_policy.standard.max_length | default 0 }}
|
||||||
|
require_uppercase: {{ .Values.password_policy.standard.require_uppercase | default false }}
|
||||||
|
require_lowercase: {{ .Values.password_policy.standard.require_lowercase | default false }}
|
||||||
|
require_number: {{ .Values.password_policy.standard.require_number | default false }}
|
||||||
|
require_special: {{ .Values.password_policy.standard.require_special | default false }}
|
||||||
|
zxcvbn:
|
||||||
|
enabled: {{ .Values.password_policy.zxcvbn.enabled | default false }}
|
||||||
|
min_score: {{ .Values.password_policy.zxcvbn.min_score | default 3 }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if .Values.duo_api.enabled }}
|
||||||
|
duo_api:
|
||||||
|
hostname: {{ .Values.duo_api.hostname }}
|
||||||
|
integration_key: {{ .Values.duo_api.integration_key }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with $auth := .Values.authentication_backend }}
|
||||||
|
authentication_backend:
|
||||||
|
password_reset:
|
||||||
|
disable: {{ $auth.disable_reset_password }}
|
||||||
|
{{- if $auth.file.enabled }}
|
||||||
|
file:
|
||||||
|
path: {{ $auth.file.path }}
|
||||||
|
password:
|
||||||
|
{{- $p := $auth.file.password -}}
|
||||||
|
{{- if $p.algorithm }}
|
||||||
|
algorithm: {{ $p.algorithm }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $p.iterations }}
|
||||||
|
iterations: {{ $p.iterations }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $p.key_length }}
|
||||||
|
key_length: {{ $p.key_length }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $p.salt_length }}
|
||||||
|
salt_length: {{ $p.salt_length }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $p.memory }}
|
||||||
|
memory: {{ $p.memory }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $p.parallelism }}
|
||||||
|
parallelism: {{ $p.parallelism }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.enabled }}
|
||||||
|
ldap:
|
||||||
|
implementation: {{ $auth.ldap.implementation | default "custom" }}
|
||||||
|
url: {{ $auth.ldap.url }}
|
||||||
|
timeout: {{ $auth.ldap.timeout | default "5s" }}
|
||||||
|
start_tls: {{ $auth.ldap.start_tls }}
|
||||||
|
tls:
|
||||||
|
{{- if hasKey $auth.ldap.tls "server_name" }}
|
||||||
|
server_name: {{ $auth.ldap.tls.server_name | default $auth.ldap.host }}
|
||||||
|
{{- end }}
|
||||||
|
minimum_version: {{ $auth.ldap.tls.minimum_version | default "TLS1.2" }}
|
||||||
|
skip_verify: {{ $auth.ldap.tls.skip_verify | default false }}
|
||||||
|
{{- if $auth.ldap.base_dn }}
|
||||||
|
base_dn: {{ $auth.ldap.base_dn }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.username_attribute }}
|
||||||
|
username_attribute: {{ $auth.ldap.username_attribute }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.additional_users_dn }}
|
||||||
|
additional_users_dn: {{ $auth.ldap.additional_users_dn }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.users_filter }}
|
||||||
|
users_filter: {{ $auth.ldap.users_filter }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.additional_groups_dn }}
|
||||||
|
additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.groups_filter }}
|
||||||
|
groups_filter: {{ $auth.ldap.groups_filter }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.group_name_attribute }}
|
||||||
|
group_name_attribute: {{ $auth.ldap.group_name_attribute }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.mail_attribute }}
|
||||||
|
mail_attribute: {{ $auth.ldap.mail_attribute }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $auth.ldap.display_name_attribute }}
|
||||||
|
display_name_attribute: {{ $auth.ldap.display_name_attribute }}
|
||||||
|
{{- end }}
|
||||||
|
user: {{ $auth.ldap.user }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with $session := .Values.session }}
|
||||||
|
session:
|
||||||
|
name: {{ $session.name | default "authelia_session" }}
|
||||||
|
domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
|
||||||
|
same_site: {{ $session.same_site | default "lax" }}
|
||||||
|
expiration: {{ $session.expiration | default "1M" }}
|
||||||
|
inactivity: {{ $session.inactivity | default "5m" }}
|
||||||
|
remember_me_duration: {{ $session.remember_me_duration | default "1M" }}
|
||||||
|
{{- end }}
|
||||||
|
redis:
|
||||||
|
host: {{ .Values.redis.creds.plain }}
|
||||||
|
{{- with $redis := .Values.redisProvider }}
|
||||||
|
port: {{ $redis.port | default 6379 }}
|
||||||
|
{{- if not (eq $redis.username "") }}
|
||||||
|
username: {{ $redis.username }}
|
||||||
|
{{- end }}
|
||||||
|
maximum_active_connections: {{ $redis.maximum_active_connections | default 8 }}
|
||||||
|
minimum_idle_connections: {{ $redis.minimum_idle_connections | default 0 }}
|
||||||
|
{{- if $redis.tls.enabled }}
|
||||||
|
tls:
|
||||||
|
server_name: {{ $redis.tls.server_name }}
|
||||||
|
minimum_version: {{ $redis.tls.minimum_version | default "TLS1.2" }}
|
||||||
|
skip_verify: {{ $redis.tls.skip_verify }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $redis.high_availability.enabled }}
|
||||||
|
high_availability:
|
||||||
|
sentinel_name: {{ $redis.high_availability.sentinel_name }}
|
||||||
|
{{- if $redis.high_availability.nodes }}
|
||||||
|
nodes:
|
||||||
|
{{- range $node := $redis.high_availability.nodes }}
|
||||||
|
- host: {{ $node.host }}
|
||||||
|
port: {{ $node.port | default 26379 }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
|
route_by_latency: {{ $redis.high_availability.route_by_latency }}
|
||||||
|
route_randomly: {{ $redis.high_availability.route_randomly }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
regulation:
|
||||||
|
max_retries: {{ .Values.regulation.max_retries | default 3 }}
|
||||||
|
find_time: {{ .Values.regulation.find_time | default "1m" }}
|
||||||
|
ban_time: {{ .Values.regulation.ban_time | default "5m" }}
|
||||||
|
storage:
|
||||||
|
postgres:
|
||||||
|
host: {{ $.Values.cnpg.main.creds.host }}
|
||||||
|
{{- with $storage := .Values.storage }}
|
||||||
|
port: {{ $storage.postgres.port | default 5432 }}
|
||||||
|
database: {{ $storage.postgres.database | default "authelia" }}
|
||||||
|
username: {{ $storage.postgres.username | default "authelia" }}
|
||||||
|
timeout: {{ $storage.postgres.timeout | default "5s" }}
|
||||||
|
ssl:
|
||||||
|
mode: {{ $storage.postgres.sslmode | default "disable" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with $notifier := .Values.notifier }}
|
||||||
|
notifier:
|
||||||
|
disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
|
||||||
|
{{- if $notifier.filesystem.enabled }}
|
||||||
|
filesystem:
|
||||||
|
filename: {{ $notifier.filesystem.filename }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $notifier.smtp.enabled }}
|
||||||
|
smtp:
|
||||||
|
host: {{ $notifier.smtp.host }}
|
||||||
|
port: {{ $notifier.smtp.port | default 25 }}
|
||||||
|
timeout: {{ $notifier.smtp.timeout | default "5s" }}
|
||||||
|
{{- with $notifier.smtp.username }}
|
||||||
|
username: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
sender: {{ $notifier.smtp.sender | quote }}
|
||||||
|
identifier: {{ $notifier.smtp.identifier | quote }}
|
||||||
|
subject: {{ $notifier.smtp.subject | quote }}
|
||||||
|
startup_check_address: {{ $notifier.smtp.startup_check_address | quote }}
|
||||||
|
disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
|
||||||
|
disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
|
||||||
|
tls:
|
||||||
|
server_name: {{ $notifier.smtp.tls.server_name | default $notifier.smtp.host }}
|
||||||
|
minimum_version: {{ $notifier.smtp.tls.minimum_version | default "TLS1.2" }}
|
||||||
|
skip_verify: {{ $notifier.smtp.tls.skip_verify | default false }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.identity_providers.oidc.enabled }}
|
||||||
|
identity_providers:
|
||||||
|
oidc:
|
||||||
|
access_token_lifespan: {{ .Values.identity_providers.oidc.access_token_lifespan | default "1h" }}
|
||||||
|
authorize_code_lifespan: {{ .Values.identity_providers.oidc.authorize_code_lifespan | default "1m" }}
|
||||||
|
id_token_lifespan: {{ .Values.identity_providers.oidc.id_token_lifespan | default "1h" }}
|
||||||
|
refresh_token_lifespan: {{ .Values.identity_providers.oidc.refresh_token_lifespan | default "90m" }}
|
||||||
|
enable_client_debug_messages: {{ .Values.identity_providers.oidc.enable_client_debug_messages | default false }}
|
||||||
|
minimum_parameter_entropy: {{ .Values.identity_providers.oidc.minimum_parameter_entropy | default 8 }}
|
||||||
|
{{- if .Values.identity_providers.oidc.clients }}
|
||||||
|
clients:
|
||||||
|
{{- range $client := .Values.identity_providers.oidc.clients }}
|
||||||
|
- id: {{ $client.id }}
|
||||||
|
description: {{ $client.description | default $client.id }}
|
||||||
|
secret: {{ $client.secret | default (randAlphaNum 128) }}
|
||||||
|
{{- if $client.public }}
|
||||||
|
public: {{ $client.public }}
|
||||||
|
{{- end }}
|
||||||
|
authorization_policy: {{ $client.authorization_policy | default "two_factor" }}
|
||||||
|
consent_mode: {{ $client.consent_mode | default "auto" }}
|
||||||
|
redirect_uris:
|
||||||
|
{{- range $client.redirect_uris }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $client.audience }}
|
||||||
|
audience:
|
||||||
|
{{- range $client.audience }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
scopes:
|
||||||
|
{{- range ($client.scopes | default (list "openid" "profile" "email" "groups")) }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
grant_types:
|
||||||
|
{{- range ($client.grant_types | default (list "refresh_token" "authorization_code")) }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
response_types:
|
||||||
|
{{- range ($client.response_types | default (list "code")) }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $client.response_modes }}
|
||||||
|
response_modes:
|
||||||
|
{{- range $client.response_modes }}
|
||||||
|
- {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
userinfo_signing_algorithm: {{ $client.userinfo_signing_algorithm | default "none" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
access_control:
|
||||||
|
{{- if not .Values.access_control.rules }}
|
||||||
|
{{- if (eq .Values.access_control.default_policy "bypass") }}
|
||||||
|
default_policy: one_factor
|
||||||
|
{{- else if (eq .Values.access_control.default_policy "deny") }}
|
||||||
|
default_policy: two_factor
|
||||||
|
{{- else }}
|
||||||
|
default_policy: {{ .Values.access_control.default_policy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
default_policy: {{ .Values.access_control.default_policy }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.access_control.networks (not .Values.access_control.networks_access_control) -}}
|
||||||
|
{{- fail "Please change [.Values.access_control.networks] to [.Values.access_control.networks_access_control]" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if not .Values.access_control.networks_access_control }}
|
||||||
|
networks: []
|
||||||
|
{{- else }}
|
||||||
|
networks:
|
||||||
|
{{- range $net := .Values.access_control.networks_access_control }}
|
||||||
|
- name: {{ $net.name }}
|
||||||
|
networks:
|
||||||
|
{{- range $net.networks }}
|
||||||
|
- {{ . | squote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if not .Values.access_control.rules }}
|
||||||
|
rules: []
|
||||||
|
{{- else }}
|
||||||
|
rules:
|
||||||
|
{{- range $rule := .Values.access_control.rules }}
|
||||||
|
{{- if $rule.domain }}
|
||||||
|
- domain:
|
||||||
|
{{- if kindIs "string" $rule.domain }}
|
||||||
|
- {{ $rule.domain | squote }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- range $rule.domain }}
|
||||||
|
- {{ . | squote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with $rule.policy }}
|
||||||
|
policy: {{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if $rule.networks }}
|
||||||
|
networks:
|
||||||
|
{{- if kindIs "string" $rule.networks }}
|
||||||
|
- {{ $rule.networks | squote }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- range $rule.networks }}
|
||||||
|
- {{ . | squote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $rule.subject }}
|
||||||
|
subject:
|
||||||
|
{{- if kindIs "string" $rule.subject }}
|
||||||
|
- {{ $rule.subject | squote }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- range $rule.subject }}
|
||||||
|
- {{ . | squote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $rule.resources }}
|
||||||
|
resources:
|
||||||
|
{{- if kindIs "string" $rule.resources }}
|
||||||
|
- {{ $rule.resources | squote }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- range $rule.resources }}
|
||||||
|
- {{ . | squote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
...
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,53 @@
|
||||||
|
{{/* Define the secrets */}}
|
||||||
|
{{- define "authelia.secrets" -}}
|
||||||
|
{{- $basename := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||||
|
{{- $fetchname := printf "%s-authelia-secrets" $basename -}}
|
||||||
|
|
||||||
|
{{/* Initialize all keys */}}
|
||||||
|
{{- $oidckey := genPrivateKey "rsa" }}
|
||||||
|
{{- $oidcsecret := randAlphaNum 32 }}
|
||||||
|
{{- $jwtsecret := randAlphaNum 50 }}
|
||||||
|
{{- $sessionsecret := randAlphaNum 50 }}
|
||||||
|
{{- $encryptionkey := randAlphaNum 100 }}
|
||||||
|
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
{{ with (lookup "v1" "Secret" .Release.Namespace $fetchname) }}
|
||||||
|
{{/* Get previous values and decode */}}
|
||||||
|
{{ $sessionsecret = (index .data "SESSION_ENCRYPTION_KEY") | b64dec }}
|
||||||
|
{{ $jwtsecret = (index .data "JWT_TOKEN") | b64dec }}
|
||||||
|
{{ $encryptionkey = (index .data "ENCRYPTION_KEY") | b64dec }}
|
||||||
|
|
||||||
|
{{/* Check if those keys ever existed. as OIDC is optional */}}
|
||||||
|
{{ if and (hasKey .data "OIDC_PRIVATE_KEY") (hasKey .data "OIDC_HMAC_SECRET") }}
|
||||||
|
{{ $oidckey = (index .data "OIDC_PRIVATE_KEY") | b64dec }}
|
||||||
|
{{ $oidcsecret = (index .data "OIDC_HMAC_SECRET") | b64dec }}
|
||||||
|
{{ end }}
|
||||||
|
{{ end }}
|
||||||
|
SESSION_ENCRYPTION_KEY: {{ $sessionsecret }}
|
||||||
|
JWT_TOKEN: {{ $jwtsecret }}
|
||||||
|
ENCRYPTION_KEY: {{ $encryptionkey }}
|
||||||
|
|
||||||
|
{{- if .Values.authentication_backend.ldap.enabled }}
|
||||||
|
LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }}
|
||||||
|
SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.duo_api.enabled }}
|
||||||
|
DUO_API_KEY: {{ .Values.duo_api.plain_api_key | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
STORAGE_PASSWORD: {{ $.Values.cnpg.main.creds.password | trimAll "\"" }}
|
||||||
|
|
||||||
|
REDIS_PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }}
|
||||||
|
{{- if .Values.redisProvider.high_availability.enabled }}
|
||||||
|
REDIS_SENTINEL_PASSWORD: {{ .Values.redis.sentinelPassword | trimAll "\"" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
OIDC_PRIVATE_KEY: |
|
||||||
|
{{- $oidckey | nindent 4 }}
|
||||||
|
OIDC_HMAC_SECRET: {{ $oidcsecret }}
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,77 @@
|
||||||
|
{{/* Make sure all variables are set properly */}}
|
||||||
|
{{- include "tc.v1.common.loader.init" . }}
|
||||||
|
|
||||||
|
{{/* Render configmap for authelia */}}
|
||||||
|
{{- $configmapPaths := include "authelia.configmap.paths" . | fromYaml -}}
|
||||||
|
{{- if $configmapPaths -}}
|
||||||
|
{{- $_ := set .Values.configmap "authelia-paths" $configmapPaths -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- $configmapFile := include "authelia.configmap.configfile" . | fromYaml -}}
|
||||||
|
{{- if $configmapFile -}}
|
||||||
|
{{- $_ := set .Values.configmap "authelia-configfile" $configmapFile -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Render secrets for authelia */}}
|
||||||
|
{{- $secret := include "authelia.secrets" . | fromYaml -}}
|
||||||
|
{{- if $secret -}}
|
||||||
|
{{- $_ := set .Values.secret "authelia-secrets" $secret -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Append the general configMap volume to the volumes */}}
|
||||||
|
{{- define "authelia.configmapVolume" -}}
|
||||||
|
enabled: true
|
||||||
|
mountPath: /configuration.yaml
|
||||||
|
subPath: configuration.yaml
|
||||||
|
readOnly: true
|
||||||
|
type: "configmap"
|
||||||
|
objectName: authelia-configfile
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Append the general secret volumes to the volumes */}}
|
||||||
|
{{- define "authelia.secretVolumes" -}}
|
||||||
|
enabled: true
|
||||||
|
mountPath: "/secrets"
|
||||||
|
readOnly: true
|
||||||
|
type: "secret"
|
||||||
|
objectName: authelia-secrets
|
||||||
|
items:
|
||||||
|
- key: "JWT_TOKEN"
|
||||||
|
path: JWT_TOKEN
|
||||||
|
- key: "SESSION_ENCRYPTION_KEY"
|
||||||
|
path: SESSION_ENCRYPTION_KEY
|
||||||
|
- key: "ENCRYPTION_KEY"
|
||||||
|
path: ENCRYPTION_KEY
|
||||||
|
- key: "STORAGE_PASSWORD"
|
||||||
|
path: STORAGE_PASSWORD
|
||||||
|
{{- if .Values.authentication_backend.ldap.enabled }}
|
||||||
|
- key: "LDAP_PASSWORD"
|
||||||
|
path: LDAP_PASSWORD
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }}
|
||||||
|
- key: "SMTP_PASSWORD"
|
||||||
|
path: SMTP_PASSWORD
|
||||||
|
{{- end }}
|
||||||
|
- key: "REDIS_PASSWORD"
|
||||||
|
path: REDIS_PASSWORD
|
||||||
|
{{- if .Values.redisProvider.high_availability.enabled}}
|
||||||
|
- key: "REDIS_SENTINEL_PASSWORD"
|
||||||
|
path: REDIS_SENTINEL_PASSWORD
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.duo_api.enabled }}
|
||||||
|
- key: "DUO_API_KEY"
|
||||||
|
path: DUO_API_KEY
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.identity_providers.oidc.enabled }}
|
||||||
|
- key: "OIDC_PRIVATE_KEY"
|
||||||
|
path: OIDC_PRIVATE_KEY
|
||||||
|
- key: "OIDC_HMAC_SECRET"
|
||||||
|
path: OIDC_HMAC_SECRET
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}}
|
||||||
|
{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}}
|
||||||
|
|
||||||
|
{{/* Render the templates */}}
|
||||||
|
{{ include "tc.v1.common.loader.apply" . }}
|
|
@ -0,0 +1,99 @@
|
||||||
|
---
|
||||||
|
title: Changelog
|
||||||
|
---
|
||||||
|
|
||||||
|
**Important:**
|
||||||
|
*for the complete changelog, please refer to the website*
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## [blocky-12.1.6](https://github.com/truecharts/charts/compare/blocky-12.1.5...blocky-12.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
||||||
|
|
||||||
|
|
||||||
|
## [blocky-12.1.5](https://github.com/truecharts/charts/compare/blocky-12.1.4...blocky-12.1.5) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- increase common version for oci fixes
|
||||||
|
|
||||||
|
|
||||||
|
## [blocky-12.1.4](https://github.com/truecharts/charts/compare/blocky-12.1.3...blocky-12.1.4) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16734](https://github.com/truecharts/charts/issues/16734))
|
||||||
|
|
||||||
|
- remove non-existent template refs ([#16738](https://github.com/truecharts/charts/issues/16738))
|
||||||
|
|
||||||
|
|
||||||
|
## [blocky-12.1.3](https://github.com/truecharts/charts/compare/blocky-12.1.0...blocky-12.1.3) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.19[@4ebb688](https://github.com/4ebb688) by renovate ([#16733](https://github.com/truecharts/charts/issues/16733))
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
|
||||||
|
|
||||||
|
## [blocky-12.1.2](https://github.com/truecharts/charts/compare/blocky-12.1.0...blocky-12.1.2) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
## [blocky-12.1.0](https://github.com/truecharts/charts/compare/blocky-12.0.2...blocky-12.1.0) (2023-12-30)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general minor by renovate ([#16579](https://github.com/truecharts/charts/issues/16579))
|
||||||
|
|
||||||
|
## [blocky-12.0.2](https://github.com/truecharts/charts/compare/blocky-12.0.1...blocky-12.0.2) (2023-12-27)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16560](https://github.com/truecharts/charts/issues/16560))
|
||||||
|
|
||||||
|
## [blocky-12.0.1](https://github.com/truecharts/charts/compare/blocky-12.0.0...blocky-12.0.1) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16545](https://github.com/truecharts/charts/issues/16545))
|
||||||
|
|
||||||
|
## [blocky-12.0.0](https://github.com/truecharts/charts/compare/blocky-11.0.0...blocky-12.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general major by renovate (major) ([#16547](https://github.com/truecharts/charts/issues/16547))
|
||||||
|
|
||||||
|
## [blocky-12.0.0](https://github.com/truecharts/charts/compare/blocky-11.0.0...blocky-12.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
|
@ -0,0 +1,46 @@
|
||||||
|
kubeVersion: ">=1.24.0-0"
|
||||||
|
apiVersion: v2
|
||||||
|
name: blocky
|
||||||
|
version: 12.1.6
|
||||||
|
appVersion: "0.22"
|
||||||
|
description: Blocky is a DNS proxy, DNS enhancer and ad-blocker for the local network written in Go
|
||||||
|
home: https://truecharts.org/charts/enterprise/blocky
|
||||||
|
icon: https://truecharts.org/img/hotlink-ok/chart-icons/blocky.png
|
||||||
|
deprecated: false
|
||||||
|
sources:
|
||||||
|
- https://hub.docker.com/r/spx01/blocky
|
||||||
|
- https://github.com/Mozart409/blocky-frontend
|
||||||
|
- https://0xerr0r.github.io/blocky/
|
||||||
|
- https://github.com/0xERR0R/blocky
|
||||||
|
- https://github.com/truecharts/charts/tree/master/charts/enterprise/blocky
|
||||||
|
maintainers:
|
||||||
|
- name: TrueCharts
|
||||||
|
email: info@truecharts.org
|
||||||
|
url: https://truecharts.org
|
||||||
|
keywords:
|
||||||
|
- dns
|
||||||
|
- blocky
|
||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
version: 17.2.21
|
||||||
|
repository: oci://tccr.io/truecharts
|
||||||
|
condition: ""
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
- name: redis
|
||||||
|
version: 11.1.5
|
||||||
|
repository: https://deps.truecharts.org
|
||||||
|
condition: redis.enabled
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
annotations:
|
||||||
|
max_scale_version: 23.10.2
|
||||||
|
min_scale_version: 23.10.0
|
||||||
|
truecharts.org/SCALE-support: "true"
|
||||||
|
truecharts.org/category: network
|
||||||
|
truecharts.org/max_helm_version: "3.13"
|
||||||
|
truecharts.org/min_helm_version: "3.12"
|
||||||
|
truecharts.org/train: enterprise
|
||||||
|
type: application
|
|
@ -0,0 +1,28 @@
|
||||||
|
---
|
||||||
|
title: README
|
||||||
|
---
|
||||||
|
|
||||||
|
## General Info
|
||||||
|
|
||||||
|
TrueCharts can be installed as both _normal_ Helm Charts or as Apps on TrueNAS SCALE.
|
||||||
|
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||||
|
|
||||||
|
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/blocky)
|
||||||
|
|
||||||
|
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||||
|
- See the [Website](https://truecharts.org)
|
||||||
|
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||||
|
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Sponsor TrueCharts
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||||
|
|
||||||
|
_All Rights Reserved - The TrueCharts Project_
|
|
@ -0,0 +1,9 @@
|
||||||
|
|
||||||
|
|
||||||
|
## [blocky-12.1.6](https://github.com/truecharts/charts/compare/blocky-12.1.5...blocky-12.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
|
@ -0,0 +1,8 @@
|
||||||
|
Blocky is a DNS proxy, DNS enhancer and ad-blocker for the local network written in Go
|
||||||
|
|
||||||
|
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/enterprise/blocky](https://truecharts.org/charts/enterprise/blocky)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
Binary file not shown.
|
@ -0,0 +1,345 @@
|
||||||
|
image:
|
||||||
|
repository: spx01/blocky
|
||||||
|
tag: v0.22@sha256:7def473b1b553b730dd38ba0bc436fc732193c15d35681aa0b0eb962dd6350aa
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
k8sgatewayImage:
|
||||||
|
repository: quay.io/oriedge/k8s_gateway
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: v0.4.0@sha256:7bdbd447c0244b8f89de9cd6f4826ed0ac66c9406fac3a4ac80081020c251c6b
|
||||||
|
manifestManager:
|
||||||
|
enabled: true
|
||||||
|
workload:
|
||||||
|
main:
|
||||||
|
replicas: 2
|
||||||
|
strategy: RollingUpdate
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: false
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /app/blocky
|
||||||
|
- healthcheck
|
||||||
|
readiness:
|
||||||
|
enabled: false
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /app/blocky
|
||||||
|
- healthcheck
|
||||||
|
startup:
|
||||||
|
enabled: false
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /app/blocky
|
||||||
|
- healthcheck
|
||||||
|
# -- Blocky Config File content
|
||||||
|
blockyConfig: {}
|
||||||
|
# upstream:
|
||||||
|
# default:
|
||||||
|
# - 1.1.1.1
|
||||||
|
|
||||||
|
# -- some general blocky settings
|
||||||
|
blocky:
|
||||||
|
# -- Enable prometheus annotations
|
||||||
|
enablePrometheus: true
|
||||||
|
service:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
ports:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
port: 4000
|
||||||
|
protocol: http
|
||||||
|
targetPort: 4000
|
||||||
|
dnstcp:
|
||||||
|
enabled: true
|
||||||
|
ports:
|
||||||
|
dnstcp:
|
||||||
|
enabled: true
|
||||||
|
port: 53
|
||||||
|
targetPort: 53
|
||||||
|
dnsudp:
|
||||||
|
enabled: true
|
||||||
|
ports:
|
||||||
|
dnsudp:
|
||||||
|
enabled: true
|
||||||
|
port: 53
|
||||||
|
protocol: udp
|
||||||
|
targetPort: 53
|
||||||
|
dot:
|
||||||
|
enabled: true
|
||||||
|
ports:
|
||||||
|
dot:
|
||||||
|
enabled: true
|
||||||
|
port: 853
|
||||||
|
protocol: tcp
|
||||||
|
targetPort: 853
|
||||||
|
https:
|
||||||
|
enabled: true
|
||||||
|
ports:
|
||||||
|
https:
|
||||||
|
enabled: true
|
||||||
|
port: 4443
|
||||||
|
protocol: https
|
||||||
|
targetPort: 4443
|
||||||
|
k8sgateway:
|
||||||
|
enabled: true
|
||||||
|
ports:
|
||||||
|
k8sgateway:
|
||||||
|
enabled: true
|
||||||
|
port: 5353
|
||||||
|
protocol: udp
|
||||||
|
targetPort: 5353
|
||||||
|
## TODO Add support for SCALE certificates and certificates secrets here
|
||||||
|
certFile: ""
|
||||||
|
keyFile: ""
|
||||||
|
logLevel: info
|
||||||
|
logFormat: text
|
||||||
|
logTimestamp: true
|
||||||
|
logPrivacy: false
|
||||||
|
dohUserAgent: ""
|
||||||
|
minTlsServeVersion: 1.2
|
||||||
|
# -- set the default DNS upstream servers
|
||||||
|
# Primarily designed for inclusion in the TrueNAS SCALE GUI
|
||||||
|
defaultUpstreams:
|
||||||
|
- 1.1.1.1
|
||||||
|
- 1.0.0.1
|
||||||
|
- 8.8.8.8
|
||||||
|
- 8.8.4.4
|
||||||
|
- 9.9.9.9
|
||||||
|
- 149.112.112.112
|
||||||
|
- 208.67.222.222
|
||||||
|
- 208.67.220.220
|
||||||
|
- 8.26.56.26
|
||||||
|
- 8.20.247.20
|
||||||
|
- 185.228.168.9
|
||||||
|
- 185.228.169.9
|
||||||
|
- 76.76.19.19
|
||||||
|
- 76.223.122.150
|
||||||
|
- 76.76.2.0
|
||||||
|
- 76.76.10.0
|
||||||
|
# -- set additional upstreams
|
||||||
|
# Primarily designed for inclusion in the TrueNAS SCALE GUI
|
||||||
|
upstreams:
|
||||||
|
# - name: group2
|
||||||
|
# dnsservers:
|
||||||
|
# - 1.1.1.1
|
||||||
|
|
||||||
|
# -- set bootstrap dns (not needed)
|
||||||
|
# Ensures bootstrap encryption and ensure it doesn't use k8s dns
|
||||||
|
bootstrapDns:
|
||||||
|
# -- Upstream
|
||||||
|
upstream: ""
|
||||||
|
# -- IP's linked to upstream DoT/DoH DNS name
|
||||||
|
ips: []
|
||||||
|
# -- set additional bootstrap dns (not needed, only used if bootstrapDns is set)
|
||||||
|
additionalBootstrapDns: []
|
||||||
|
# - upstream: ""
|
||||||
|
# ips: []
|
||||||
|
|
||||||
|
# -- Return empty answer for these queries
|
||||||
|
filtering:
|
||||||
|
# -- Ensures filtering by query type
|
||||||
|
queryTypes: []
|
||||||
|
# -- Set manual custom DNS resolution
|
||||||
|
customDNS:
|
||||||
|
customTTL: 1h
|
||||||
|
filterUnmappedTypes: true
|
||||||
|
rewrite: []
|
||||||
|
# - in: something.com
|
||||||
|
# out: somethingelse.com
|
||||||
|
mapping: []
|
||||||
|
# - domain: something.com
|
||||||
|
# dnsserver: 192.168.178.1
|
||||||
|
# -- Setup client-name lookup
|
||||||
|
clientLookup:
|
||||||
|
# -- upstream used for client-name lookup
|
||||||
|
upstream: ""
|
||||||
|
singleNameOrder: []
|
||||||
|
clients:
|
||||||
|
# - domain: laptop
|
||||||
|
# ips: []
|
||||||
|
# -- Setup caching
|
||||||
|
caching:
|
||||||
|
minTime: 5m
|
||||||
|
maxTime: 30m
|
||||||
|
maxItemsCount: 0
|
||||||
|
prefetching: false
|
||||||
|
prefetchExpires: 2h
|
||||||
|
prefetchThreshold: 5
|
||||||
|
prefetchMaxItemsCount: 0
|
||||||
|
cacheTimeNegative: 30m
|
||||||
|
# -- set conditional settings
|
||||||
|
# Primarily designed for inclusion in the TrueNAS SCALE GUI
|
||||||
|
conditional:
|
||||||
|
rewrite: []
|
||||||
|
# - in: something.com
|
||||||
|
# out: somethingelse.com
|
||||||
|
mapping: []
|
||||||
|
# - domain: something.com
|
||||||
|
# dnsserver: 192.168.178.1
|
||||||
|
# -- set blocking settings using Lists
|
||||||
|
# Primarily designed for inclusion in the TrueNAS SCALE GUI
|
||||||
|
blocking:
|
||||||
|
# -- Sets the blocktype
|
||||||
|
blockType: nxDomain
|
||||||
|
# -- Sets the block ttl
|
||||||
|
blockTTL: 6h
|
||||||
|
# -- Sets the block refreshPeriod
|
||||||
|
refreshPeriod: 4h
|
||||||
|
# -- Sets the block download timeout
|
||||||
|
downloadTimeout: 60s
|
||||||
|
# -- Sets the block download attempt count
|
||||||
|
downloadAttempts: 3
|
||||||
|
# -- Sets the block download cooldown
|
||||||
|
downloadCooldown: 2s
|
||||||
|
# -- Set the start strategy (blocking | failOnError | fast)
|
||||||
|
startStrategy: blocking
|
||||||
|
# -- Sets how many list-groups can be processed at the same time
|
||||||
|
processingConcurrency: 4
|
||||||
|
# -- Add blocky whitelists
|
||||||
|
whitelist: []
|
||||||
|
# - name: ads
|
||||||
|
# lists:
|
||||||
|
# - https://someurl.com/list.txt
|
||||||
|
# - /somefile.txt
|
||||||
|
|
||||||
|
# -- Blocky blacklists
|
||||||
|
blacklist: []
|
||||||
|
# - name: ads
|
||||||
|
# lists:
|
||||||
|
# - https://someurl.com/list.txt
|
||||||
|
# - /somefile.txt
|
||||||
|
|
||||||
|
# -- Blocky clientGroupsBlock
|
||||||
|
clientGroupsBlock: []
|
||||||
|
# - name: default
|
||||||
|
# groups:
|
||||||
|
# - ads
|
||||||
|
# -- configure using hostsfile for lookups
|
||||||
|
# Allows for using the hosts configured in kubernetes and such
|
||||||
|
hostsFile:
|
||||||
|
enabled: false
|
||||||
|
filePath: /etc/hosts
|
||||||
|
hostsTTL: 60m
|
||||||
|
refreshPeriod: 30m
|
||||||
|
## TODO: add this with postgresql support as well
|
||||||
|
# queryLog:
|
||||||
|
# type: csv
|
||||||
|
# target: /logs
|
||||||
|
# logRetentionDays: 0
|
||||||
|
# creationAttempts: 3
|
||||||
|
# CreationCooldown: 2
|
||||||
|
podOptions:
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
portal:
|
||||||
|
open:
|
||||||
|
enabled: false
|
||||||
|
serviceAccount:
|
||||||
|
main:
|
||||||
|
# -- Specifies whether a service account should be created
|
||||||
|
enabled: true
|
||||||
|
primary: true
|
||||||
|
# -- Create a ClusterRole and ClusterRoleBinding
|
||||||
|
# @default -- See below
|
||||||
|
rbac:
|
||||||
|
main:
|
||||||
|
# -- Enables or disables the ClusterRole and ClusterRoleBinding
|
||||||
|
enabled: true
|
||||||
|
primary: true
|
||||||
|
clusterWide: true
|
||||||
|
# -- Set Rules on the ClusterRole
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- extensions
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
k8sgateway:
|
||||||
|
enabled: true
|
||||||
|
# -- TTL for non-apex responses (in seconds)
|
||||||
|
ttl: 300
|
||||||
|
# -- Limit what kind of resources to watch, e.g. watchedResources: ["Ingress"]
|
||||||
|
watchedResources: []
|
||||||
|
# -- Service name of a secondary DNS server (should be `serviceName.namespace`)
|
||||||
|
secondary: ""
|
||||||
|
# -- Override the default `serviceName.namespace` domain apex
|
||||||
|
apex: ""
|
||||||
|
# -- list of processed domains
|
||||||
|
domains: []
|
||||||
|
# -- Delegated domain
|
||||||
|
# - domain: "example.com"
|
||||||
|
# # -- Optional configuration option for DNS01 challenge that will redirect all acme
|
||||||
|
# # challenge requests to external cloud domain (e.g. managed by cert-manager)
|
||||||
|
# # See: https://cert-manager.io/docs/configuration/acme/dns01/
|
||||||
|
# dnsChallenge:
|
||||||
|
# enabled: false
|
||||||
|
# domain: dns01.clouddns.com
|
||||||
|
|
||||||
|
forward:
|
||||||
|
enabled: false
|
||||||
|
primary: tls://1.1.1.1
|
||||||
|
secondary: tls://1.0.0.1
|
||||||
|
options:
|
||||||
|
- name: tls_servername
|
||||||
|
value: cloudflare-dns.com
|
||||||
|
metrics:
|
||||||
|
main:
|
||||||
|
# -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
|
||||||
|
# @default -- See values.yaml
|
||||||
|
enabled: false
|
||||||
|
type: "servicemonitor"
|
||||||
|
endpoints:
|
||||||
|
- port: main
|
||||||
|
path: /metrics
|
||||||
|
# -- Enable and configure Prometheus Rules for the chart under this key.
|
||||||
|
# @default -- See values.yaml
|
||||||
|
prometheusRule:
|
||||||
|
enabled: false
|
||||||
|
labels: {}
|
||||||
|
# -- Configure additionial rules for the chart under this key.
|
||||||
|
# @default -- See prometheusrules.yaml
|
||||||
|
rules: []
|
||||||
|
# - alert: UnifiPollerAbsent
|
||||||
|
# annotations:
|
||||||
|
# description: Unifi Poller has disappeared from Prometheus service discovery.
|
||||||
|
# summary: Unifi Poller is down.
|
||||||
|
# expr: |
|
||||||
|
# absent(up{job=~".*unifi-poller.*"} == 1)
|
||||||
|
# for: 5m
|
||||||
|
# labels:
|
||||||
|
# severity: critical
|
||||||
|
redis:
|
||||||
|
enabled: true
|
||||||
|
# CANNOT be defined in above yaml section
|
||||||
|
queryLog:
|
||||||
|
# optional one of: mysql, postgresql, csv, csv-client. If empty, log to console
|
||||||
|
type: ""
|
||||||
|
# directory (should be mounted as volume in docker) for csv, db connection string for mysql, ignored for included postgresql
|
||||||
|
# target: /var/log/something
|
||||||
|
# postgresql target: postgres://user:password@db_host_or_ip:5432/db_name
|
||||||
|
# if > 0, deletes log files which are older than ... days
|
||||||
|
logRetentionDays: 0
|
||||||
|
# optional: Max attempts to create specific query log writer, default: 3
|
||||||
|
creationAttempts: 3
|
||||||
|
# optional: Time between the creation attempts, default: 2s
|
||||||
|
creationCooldown: 2s
|
||||||
|
cnpg:
|
||||||
|
main:
|
||||||
|
enabled: false
|
||||||
|
user: blocky
|
||||||
|
database: blocky
|
||||||
|
updated: true
|
File diff suppressed because it is too large
Load Diff
|
@ -0,0 +1,231 @@
|
||||||
|
{{/* Define the config */}}
|
||||||
|
{{- define "blocky.configmap" -}}
|
||||||
|
{{- $config := mustMerge ( include "blocky.config" . | fromYaml ) ( .Values.blockyConfig ) }}
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
config.yml: |
|
||||||
|
{{ $config | toYaml | indent 4 }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- define "blocky.config" -}}
|
||||||
|
redis:
|
||||||
|
address: {{ printf "%v-%v" .Release.Name "redis" }}:6379
|
||||||
|
password: {{ .Values.redis.creds.redisPassword | trimAll "\"" }}
|
||||||
|
database: 0
|
||||||
|
required: true
|
||||||
|
connectionAttempts: 10
|
||||||
|
connectionCooldown: 3s
|
||||||
|
prometheus:
|
||||||
|
enable: true
|
||||||
|
path: /metrics
|
||||||
|
queryLog:
|
||||||
|
# optional one of: postgresql, csv, csv-client. If empty, log to console
|
||||||
|
type: {{ .Values.queryLog.type }}
|
||||||
|
# directory (should be mounted as volume in docker) for csv, db connection string for mysql/postgresql
|
||||||
|
#postgresql target: postgres://user:password@db_host_or_ip:5432/db_name
|
||||||
|
{{- if eq .Values.queryLog.type "postgresql" }}
|
||||||
|
target: {{ .Values.cnpg.main.creds.std }}
|
||||||
|
{{- else }}
|
||||||
|
target: {{ .Values.queryLog.target }}
|
||||||
|
{{- end }}
|
||||||
|
# if > 0, deletes log files which are older than ... days
|
||||||
|
logRetentionDays: {{ .Values.queryLog.logRetentionDays | default 0 }}
|
||||||
|
# optional: Max attempts to create specific query log writer
|
||||||
|
creationAttempts: {{ .Values.queryLog.creationAttempts | default 3 }}
|
||||||
|
# optional: Time between the creation attempts
|
||||||
|
creationCooldown: {{ .Values.queryLog.creationAttempts | default "2s" }}
|
||||||
|
|
||||||
|
upstream:
|
||||||
|
default:
|
||||||
|
{{- .Values.defaultUpstreams | toYaml | nindent 8 }}
|
||||||
|
{{- range $id, $value := .Values.upstreams }}
|
||||||
|
{{ $value.name }}:
|
||||||
|
{{- $value.dnsservers | toYaml | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
ports:
|
||||||
|
{{- if .Values.service.dnsudp.enabled }}
|
||||||
|
dns: {{ .Values.service.dnsudp.ports.dnsudp.targetPort }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.dot.enabled }}
|
||||||
|
tls: {{ .Values.service.dot.ports.dot.targetPort }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.main.enabled }}
|
||||||
|
http: {{ .Values.service.main.ports.main.targetPort }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.service.https.enabled }}
|
||||||
|
https: {{ .Values.service.https.ports.https.targetPort }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.certFile }}
|
||||||
|
certFile: {{ .Values.certFile }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.keyFile }}
|
||||||
|
keyFile: {{ .Values.keyFile }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
log:
|
||||||
|
{{- if .Values.logLevel }}
|
||||||
|
level: {{ .Values.logLevel }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.logTimestamp }}
|
||||||
|
timestamp: {{ .Values.logTimestamp }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.logPrivacy }}
|
||||||
|
privacy: {{ .Values.logPrivacy }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.dohUserAgent }}
|
||||||
|
dohUserAgent: {{ .Values.dohUserAgent }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.minTlsServeVersion }}
|
||||||
|
minTlsServeVersion: {{ .Values.minTlsServeVersion }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
caching:
|
||||||
|
{{ toYaml .Values.caching | indent 2 }}
|
||||||
|
|
||||||
|
{{- if .Values.hostsFile.enabled }}
|
||||||
|
{{ $hostsfile := omit .Values.hostsFile "enabled" }}
|
||||||
|
hostsFile:
|
||||||
|
{{ toYaml $hostsfile | indent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.bootstrapDns.upstream .Values.bootstrapDns.ips }}
|
||||||
|
bootstrapDns:
|
||||||
|
{{- if .Values.bootstrapDns.upstream }}
|
||||||
|
- upstream: {{ .Values.bootstrapDns.upstream }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.bootstrapDns.ips }}
|
||||||
|
ips:
|
||||||
|
{{- range $id, $value := .Values.bootstrapDns.ips }}
|
||||||
|
- {{ $value }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{/* Add additional Bootstrap DNS */}}
|
||||||
|
{{- range .Values.additionalBootstrapDns }}
|
||||||
|
{{- with .upstream }}
|
||||||
|
- upstream: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .ips }}
|
||||||
|
ips:
|
||||||
|
{{- range $id, $value := .ips }}
|
||||||
|
- {{ $value }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.filtering.filtering }}
|
||||||
|
filtering:
|
||||||
|
{{- if .Values.filtering.ips }}
|
||||||
|
queryTypes:
|
||||||
|
{{- range $id, $value := .Values.filtering.ips }}
|
||||||
|
- {{ $value }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.customDNS.filterUnmappedTypes .Values.customDNS.customTTL .Values.customDNS.rewrite .Values.customDNS.mapping }}
|
||||||
|
customDNS:
|
||||||
|
{{- if .Values.customDNS.upstream }}
|
||||||
|
upstream: {{ .Values.customDNS.upstream }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.customDNS.customTTL }}
|
||||||
|
customTTL: {{ .Values.customDNS.customTTL }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.customDNS.rewrite }}
|
||||||
|
rewrite:
|
||||||
|
{{- range $id, $value := .Values.customDNS.rewrite }}
|
||||||
|
{{ $value.in }}: {{ $value.out }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.customDNS.mapping }}
|
||||||
|
mapping:
|
||||||
|
{{- range $id, $value := .Values.customDNS.mapping }}
|
||||||
|
{{ $value.domain }}: {{ $value.dnsserver }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.clientLookup.upstream .Values.clientLookup.ips }}
|
||||||
|
clientLookup:
|
||||||
|
{{- if .Values.clientLookup.upstream }}
|
||||||
|
upstream: {{ .Values.clientLookup.upstream }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.clientLookup.ips }}
|
||||||
|
singleNameOrder:
|
||||||
|
{{- range $id, $value := .Values.clientLookup.ips }}
|
||||||
|
- {{ $value }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.clientLookup.clients }}
|
||||||
|
clients:
|
||||||
|
{{- range $id, $value := .Values.clientLookup.clients }}
|
||||||
|
{{ $value.domain }}:
|
||||||
|
{{- range $id, $value := .ips }}
|
||||||
|
- {{ $value }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.conditional.rewrite .Values.conditional.mapping ( and .Values.k8sgateway.enabled .Values.k8sgateway.domains ) }}
|
||||||
|
conditional:
|
||||||
|
{{- if .Values.conditional.rewrite }}
|
||||||
|
rewrite:
|
||||||
|
{{- range $id, $value := .Values.conditional.rewrite }}
|
||||||
|
{{ $value.in }}: {{ $value.out }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.conditional.mapping ( and .Values.k8sgateway.enabled .Values.k8sgateway.domains ) }}
|
||||||
|
mapping:
|
||||||
|
{{- if and .Values.k8sgateway.enabled .Values.k8sgateway.domains }}
|
||||||
|
{{- range $id, $value := .Values.k8sgateway.domains }}
|
||||||
|
{{ .domain }}: 127.0.0.1:{{ $.Values.service.k8sgateway.ports.k8sgateway.targetPort }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $id, $value := .Values.conditional.mapping }}
|
||||||
|
{{ $value.domain }}: {{ $value.dnsserver }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
blocking:
|
||||||
|
blockType: {{ .Values.blocking.blockType }}
|
||||||
|
blockTTL: {{ .Values.blocking.blockTTL }}
|
||||||
|
refreshPeriod: {{ .Values.blocking.refreshPeriod }}
|
||||||
|
downloadTimeout: {{ .Values.blocking.downloadTimeout }}
|
||||||
|
downloadAttempts: {{ .Values.blocking.downloadAttempts }}
|
||||||
|
downloadCooldown: {{ .Values.blocking.downloadCooldown }}
|
||||||
|
startStrategy: {{ .Values.blocking.startStrategy }}
|
||||||
|
processingConcurrency: {{ .Values.blocking.processingConcurrency }}
|
||||||
|
{{- if .Values.blocking.whitelist }}
|
||||||
|
whiteLists:
|
||||||
|
{{- range $id, $value := .Values.blocking.whitelist }}
|
||||||
|
{{ $value.name }}:
|
||||||
|
{{- $value.lists | toYaml | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.blocking.blacklist }}
|
||||||
|
blackLists:
|
||||||
|
{{- range $id, $value := .Values.blocking.blacklist }}
|
||||||
|
{{ $value.name }}:
|
||||||
|
{{- $value.lists | toYaml | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if .Values.blocking.clientGroupsBlock }}
|
||||||
|
clientGroupsBlock:
|
||||||
|
{{- range $id, $value := .Values.blocking.clientGroupsBlock }}
|
||||||
|
{{ $value.name }}:
|
||||||
|
{{- $value.groups | toYaml | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,90 @@
|
||||||
|
{{- define "k8sgateway.container" -}}
|
||||||
|
enabled: true
|
||||||
|
imageSelector: k8sgatewayImage
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 0
|
||||||
|
runAsGroup: 0
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
args: ["-conf", "/etc/coredns/Corefile"]
|
||||||
|
probes:
|
||||||
|
readiness:
|
||||||
|
enabled: true
|
||||||
|
path: /ready
|
||||||
|
port: 8181
|
||||||
|
liveness:
|
||||||
|
enabled: true
|
||||||
|
path: /health
|
||||||
|
port: 8080
|
||||||
|
startup:
|
||||||
|
enabled: true
|
||||||
|
path: /ready
|
||||||
|
port: 8181
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the matchable regex from domain
|
||||||
|
*/}}
|
||||||
|
{{- define "k8sgateway.configmap.regex" -}}
|
||||||
|
{{- if .dnsChallenge.domain }}
|
||||||
|
{{- .dnsChallenge.domain | replace "." "[.]" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{ "unset" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Define the configmap */}}
|
||||||
|
{{- define "k8sgateway.configmap" -}}
|
||||||
|
{{- $values := .Values.k8sgateway }}
|
||||||
|
{{- $fqdn := ( include "tc.v1.common.lib.chart.names.fqdn" . ) }}
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
Corefile: |
|
||||||
|
.:{{ .Values.service.k8sgateway.ports.k8sgateway.targetPort }} {
|
||||||
|
errors
|
||||||
|
log
|
||||||
|
health {
|
||||||
|
lameduck 5s
|
||||||
|
}
|
||||||
|
ready
|
||||||
|
{{- range .Values.k8sgateway.domains }}
|
||||||
|
{{- if .dnsChallenge.enabled }}
|
||||||
|
{{- if not .dnsChallenge.domain -}}
|
||||||
|
{{- fail "DNS01 challenge domain is mandatory" -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
template IN ANY {{ required "Delegated domain ('domain') is mandatory" .domain }} {
|
||||||
|
match "_acme-challenge[.](.*)[.]{{ include "k8sgateway.configmap.regex" . }}"
|
||||||
|
{{- $name := "{{ \"{{ .Name }}\" }}" }}
|
||||||
|
{{- $index := "{{ \"{{ index .Match 1 }}\" }}" }}
|
||||||
|
answer "{{ $name }} 5 IN CNAME {{ $index }}.{{ .dnsChallenge.domain }}"
|
||||||
|
fallthrough
|
||||||
|
}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
k8s_gateway {{ range .Values.k8sgateway.domains }}"{{ required "Delegated domain ('domain') is mandatory " .domain }}"{{ end }} {
|
||||||
|
apex {{ $values.apex | default $fqdn }}
|
||||||
|
ttl {{ $values.ttl }}
|
||||||
|
{{- if $values.secondary }}
|
||||||
|
secondary {{ $values.secondary }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $values.watchedResources }}
|
||||||
|
resources {{ join " " $values.watchedResources }}
|
||||||
|
{{- end }}
|
||||||
|
fallthrough
|
||||||
|
}
|
||||||
|
|
||||||
|
prometheus 0.0.0.0:9153
|
||||||
|
{{- if .Values.k8sgateway.forward.enabled }}
|
||||||
|
forward . {{ .Values.k8sgateway.forward.primary }} {{ .Values.k8sgateway.forward.secondary }} {
|
||||||
|
{{- range .Values.k8sgateway.forward.options }}
|
||||||
|
{{ .name }} {{ .value }}
|
||||||
|
{{- end }}
|
||||||
|
}
|
||||||
|
{{- else }}
|
||||||
|
forward . 1.1.1.1
|
||||||
|
{{- end }}
|
||||||
|
loop
|
||||||
|
reload
|
||||||
|
loadbalance
|
||||||
|
}
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,106 @@
|
||||||
|
{{/* Make sure all variables are set properly */}}
|
||||||
|
{{- if eq .Values.queryLog.type "postgresql" -}}
|
||||||
|
{{- $_ := set .Values.cnpg.main "enabled" true -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "tc.v1.common.loader.init" . }}
|
||||||
|
|
||||||
|
{{/* Render configmap for blocky */}}
|
||||||
|
{{- $configmapFile := include "blocky.configmap" . | fromYaml -}}
|
||||||
|
{{- if $configmapFile -}}
|
||||||
|
{{- $_ := set .Values.configmap "config" $configmapFile -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- $gatewayconfig := include "k8sgateway.configmap" . | fromYaml -}}
|
||||||
|
{{- if $gatewayconfig -}}
|
||||||
|
{{- $_ := set .Values.configmap "corefile" $gatewayconfig -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Always mount the configmap, with the basic config, plus the 'blockyConfig' */}}
|
||||||
|
{{- define "blocky.configmap.mount" -}}
|
||||||
|
enabled: true
|
||||||
|
type: configmap
|
||||||
|
mountPath: /app/config.yml
|
||||||
|
objectName: config
|
||||||
|
readOnly: true
|
||||||
|
subPath: config.yml
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Append the general configMap volume to the volumes */}}
|
||||||
|
{{- define "k8sgateway.configvolume" -}}
|
||||||
|
enabled: true
|
||||||
|
type: configmap
|
||||||
|
objectName: corefile
|
||||||
|
items:
|
||||||
|
- key: Corefile
|
||||||
|
path: Corefile
|
||||||
|
targetSelector:
|
||||||
|
main:
|
||||||
|
k8sgateway:
|
||||||
|
mountPath: "/etc/coredns"
|
||||||
|
readOnly: true
|
||||||
|
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- $_ := set .Values.persistence "tc-config" (include "blocky.configmap.mount" . | fromYaml) -}}
|
||||||
|
|
||||||
|
{{- if and .Values.k8sgateway.enabled .Values.k8sgateway.domains -}}
|
||||||
|
{{- $_ := set .Values.persistence "config-volume" (include "k8sgateway.configvolume" . | fromYaml) -}}
|
||||||
|
{{- $_ := set .Values.workload.main.podSpec.containers "k8sgateway" (include "k8sgateway.container" . | fromYaml) -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Define path for api */}}
|
||||||
|
{{- define "blocky.api" -}}
|
||||||
|
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" . -}}
|
||||||
|
path: "/api"
|
||||||
|
# -- Ignored if not kubeVersion >= 1.14-0
|
||||||
|
pathType: Prefix
|
||||||
|
service:
|
||||||
|
# -- Overrides the service name reference for this path
|
||||||
|
name: {{ printf "%s-main" $fullname }}
|
||||||
|
port: {{ .Values.service.main.ports.main.port }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* inject websocket path to all main ingress hosts*/}}
|
||||||
|
{{- define "blocky.apiinjector" -}}
|
||||||
|
{{- $path := list (include "blocky.api" . | fromYaml) -}}
|
||||||
|
{{- if .Values.ingress.main.enabled }}
|
||||||
|
{{- range .Values.ingress.main.hosts }}
|
||||||
|
{{- $newpaths := list }}
|
||||||
|
{{- $newpaths := concat .paths $path }}
|
||||||
|
{{- $_ := set . "paths" ( deepCopy $newpaths ) -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* inject api paths in ingress */}}
|
||||||
|
{{- include "blocky.apiinjector" . }}
|
||||||
|
|
||||||
|
{{/* Define path for DoH */}}
|
||||||
|
{{- define "blocky.doh" -}}
|
||||||
|
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" . -}}
|
||||||
|
path: "/dns-query"
|
||||||
|
# -- Ignored if not kubeVersion >= 1.14-0
|
||||||
|
pathType: Prefix
|
||||||
|
service:
|
||||||
|
# -- Overrides the service name reference for this path
|
||||||
|
name: {{ printf "%s-main" $fullname }}
|
||||||
|
port: {{ .Values.service.main.ports.main.port }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* inject websocket path to all main ingress hosts*/}}
|
||||||
|
{{- define "blocky.dohinjector" -}}
|
||||||
|
{{- $path := list (include "blocky.doh" . | fromYaml) -}}
|
||||||
|
{{- if .Values.ingress.main.enabled }}
|
||||||
|
{{- range .Values.ingress.main.hosts }}
|
||||||
|
{{- $newpaths := list }}
|
||||||
|
{{- $newpaths := concat .paths $path }}
|
||||||
|
{{- $_ := set . "paths" ( deepCopy $newpaths ) -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* inject api paths in ingress */}}
|
||||||
|
{{- include "blocky.dohinjector" . }}
|
||||||
|
|
||||||
|
{{/* Render the templates */}}
|
||||||
|
{{ include "tc.v1.common.loader.apply" . }}
|
|
@ -0,0 +1,99 @@
|
||||||
|
---
|
||||||
|
title: Changelog
|
||||||
|
---
|
||||||
|
|
||||||
|
**Important:**
|
||||||
|
*for the complete changelog, please refer to the website*
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## [prometheus-16.1.6](https://github.com/truecharts/charts/compare/prometheus-16.1.5...prometheus-16.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
||||||
|
|
||||||
|
|
||||||
|
## [prometheus-16.1.5](https://github.com/truecharts/charts/compare/prometheus-16.1.4...prometheus-16.1.5) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- increase common version for oci fixes
|
||||||
|
|
||||||
|
|
||||||
|
## [prometheus-16.1.4](https://github.com/truecharts/charts/compare/prometheus-16.1.3...prometheus-16.1.4) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16734](https://github.com/truecharts/charts/issues/16734))
|
||||||
|
|
||||||
|
- remove non-existent template refs ([#16738](https://github.com/truecharts/charts/issues/16738))
|
||||||
|
|
||||||
|
|
||||||
|
## [prometheus-16.1.3](https://github.com/truecharts/charts/compare/prometheus-16.1.0...prometheus-16.1.3) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.19[@4ebb688](https://github.com/4ebb688) by renovate ([#16733](https://github.com/truecharts/charts/issues/16733))
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
|
||||||
|
|
||||||
|
## [prometheus-16.1.2](https://github.com/truecharts/charts/compare/prometheus-16.1.0...prometheus-16.1.2) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
## [prometheus-16.1.0](https://github.com/truecharts/charts/compare/prometheus-16.0.2...prometheus-16.1.0) (2023-12-30)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general minor by renovate ([#16579](https://github.com/truecharts/charts/issues/16579))
|
||||||
|
|
||||||
|
## [prometheus-16.0.2](https://github.com/truecharts/charts/compare/prometheus-16.0.1...prometheus-16.0.2) (2023-12-27)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16560](https://github.com/truecharts/charts/issues/16560))
|
||||||
|
|
||||||
|
## [prometheus-16.0.1](https://github.com/truecharts/charts/compare/prometheus-16.0.0...prometheus-16.0.1) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16545](https://github.com/truecharts/charts/issues/16545))
|
||||||
|
|
||||||
|
## [prometheus-16.0.0](https://github.com/truecharts/charts/compare/prometheus-15.0.0...prometheus-16.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general major by renovate (major) ([#16547](https://github.com/truecharts/charts/issues/16547))
|
||||||
|
|
||||||
|
## [prometheus-16.0.0](https://github.com/truecharts/charts/compare/prometheus-15.0.0...prometheus-16.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
|
@ -0,0 +1,51 @@
|
||||||
|
kubeVersion: ">=1.24.0-0"
|
||||||
|
apiVersion: v2
|
||||||
|
name: prometheus
|
||||||
|
version: 16.1.6
|
||||||
|
appVersion: 2.48.1
|
||||||
|
description: kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
|
||||||
|
home: https://truecharts.org/charts/enterprise/prometheus
|
||||||
|
icon: https://truecharts.org/img/hotlink-ok/chart-icons/prometheus.png
|
||||||
|
deprecated: false
|
||||||
|
sources:
|
||||||
|
- https://github.com/prometheus-community/helm-charts
|
||||||
|
- https://github.com/truecharts/charts/tree/master/charts/enterprise/prometheus
|
||||||
|
- https://hub.docker.com/r/bitnami/alertmanager
|
||||||
|
- https://github.com/prometheus-operator/kube-prometheus
|
||||||
|
maintainers:
|
||||||
|
- name: TrueCharts
|
||||||
|
email: info@truecharts.org
|
||||||
|
url: https://truecharts.org
|
||||||
|
keywords:
|
||||||
|
- metrics
|
||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
version: 17.2.21
|
||||||
|
repository: oci://tccr.io/truecharts
|
||||||
|
condition: ""
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
- name: node-exporter
|
||||||
|
version: 6.1.5
|
||||||
|
repository: https://deps.truecharts.org
|
||||||
|
condition: exporters.enabled,exporters.node-exporter.enabled
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
- name: kube-state-metrics
|
||||||
|
version: 6.1.5
|
||||||
|
repository: https://deps.truecharts.org
|
||||||
|
condition: exporters.enabled,exporters.kube-state-metrics.enabled
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
annotations:
|
||||||
|
max_scale_version: 23.10.2
|
||||||
|
min_scale_version: 23.10.0
|
||||||
|
truecharts.org/SCALE-support: "true"
|
||||||
|
truecharts.org/category: metrics
|
||||||
|
truecharts.org/max_helm_version: "3.13"
|
||||||
|
truecharts.org/min_helm_version: "3.12"
|
||||||
|
truecharts.org/train: enterprise
|
||||||
|
type: application
|
|
@ -0,0 +1,106 @@
|
||||||
|
Business Source License 1.1
|
||||||
|
|
||||||
|
Parameters
|
||||||
|
|
||||||
|
Licensor: The TrueCharts Project, it's owner and it's contributors
|
||||||
|
Licensed Work: The TrueCharts "Prometheus" Helm Chart
|
||||||
|
Additional Use Grant: You may use the licensed work in production, as long
|
||||||
|
as it is directly sourced from a TrueCharts provided
|
||||||
|
official repository, catalog or source. You may also make private
|
||||||
|
modification to the directly sourced licenced work,
|
||||||
|
when used in production.
|
||||||
|
|
||||||
|
The following cases are, due to their nature, also
|
||||||
|
defined as 'production use' and explicitly prohibited:
|
||||||
|
- Bundling, including or displaying the licensed work
|
||||||
|
with(in) another work intended for production use,
|
||||||
|
with the apparent intend of facilitating and/or
|
||||||
|
promoting production use by third parties in
|
||||||
|
violation of this license.
|
||||||
|
|
||||||
|
Change Date: 2050-01-01
|
||||||
|
|
||||||
|
Change License: 3-clause BSD license
|
||||||
|
|
||||||
|
For information about alternative licensing arrangements for the Software,
|
||||||
|
please contact: legal@truecharts.org
|
||||||
|
|
||||||
|
Notice
|
||||||
|
|
||||||
|
The Business Source License (this document, or the “License”) is not an Open
|
||||||
|
Source license. However, the Licensed Work will eventually be made available
|
||||||
|
under an Open Source License, as stated in this License.
|
||||||
|
|
||||||
|
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
||||||
|
“Business Source License” is a trademark of MariaDB Corporation Ab.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Business Source License 1.1
|
||||||
|
|
||||||
|
Terms
|
||||||
|
|
||||||
|
The Licensor hereby grants you the right to copy, modify, create derivative
|
||||||
|
works, redistribute, and make non-production use of the Licensed Work. The
|
||||||
|
Licensor may make an Additional Use Grant, above, permitting limited
|
||||||
|
production use.
|
||||||
|
|
||||||
|
Effective on the Change Date, or the fourth anniversary of the first publicly
|
||||||
|
available distribution of a specific version of the Licensed Work under this
|
||||||
|
License, whichever comes first, the Licensor hereby grants you rights under
|
||||||
|
the terms of the Change License, and the rights granted in the paragraph
|
||||||
|
above terminate.
|
||||||
|
|
||||||
|
If your use of the Licensed Work does not comply with the requirements
|
||||||
|
currently in effect as described in this License, you must purchase a
|
||||||
|
commercial license from the Licensor, its affiliated entities, or authorized
|
||||||
|
resellers, or you must refrain from using the Licensed Work.
|
||||||
|
|
||||||
|
All copies of the original and modified Licensed Work, and derivative works
|
||||||
|
of the Licensed Work, are subject to this License. This License applies
|
||||||
|
separately for each version of the Licensed Work and the Change Date may vary
|
||||||
|
for each version of the Licensed Work released by Licensor.
|
||||||
|
|
||||||
|
You must conspicuously display this License on each original or modified copy
|
||||||
|
of the Licensed Work. If you receive the Licensed Work in original or
|
||||||
|
modified form from a third party, the terms and conditions set forth in this
|
||||||
|
License apply to your use of that work.
|
||||||
|
|
||||||
|
Any use of the Licensed Work in violation of this License will automatically
|
||||||
|
terminate your rights under this License for the current and all other
|
||||||
|
versions of the Licensed Work.
|
||||||
|
|
||||||
|
This License does not grant you any right in any trademark or logo of
|
||||||
|
Licensor or its affiliates (provided that you may use a trademark or logo of
|
||||||
|
Licensor as expressly required by this License).
|
||||||
|
|
||||||
|
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
||||||
|
AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
||||||
|
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
||||||
|
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
||||||
|
TITLE.
|
||||||
|
|
||||||
|
MariaDB hereby grants you permission to use this License’s text to license
|
||||||
|
your works, and to refer to it using the trademark “Business Source License”,
|
||||||
|
as long as you comply with the Covenants of Licensor below.
|
||||||
|
|
||||||
|
Covenants of Licensor
|
||||||
|
|
||||||
|
In consideration of the right to use this License’s text and the “Business
|
||||||
|
Source License” name and trademark, Licensor covenants to MariaDB, and to all
|
||||||
|
other recipients of the licensed work to be provided by Licensor:
|
||||||
|
|
||||||
|
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
||||||
|
or a license that is compatible with GPL Version 2.0 or a later version,
|
||||||
|
where “compatible” means that software provided under the Change License can
|
||||||
|
be included in a program with software provided under GPL Version 2.0 or a
|
||||||
|
later version. Licensor may specify additional Change Licenses without
|
||||||
|
limitation.
|
||||||
|
|
||||||
|
2. To either: (a) specify an additional grant of rights to use that does not
|
||||||
|
impose any additional restriction on the right granted in this License, as
|
||||||
|
the Additional Use Grant; or (b) insert the text “None”.
|
||||||
|
|
||||||
|
3. To specify a Change Date.
|
||||||
|
|
||||||
|
4. Not to modify this License in any other way.
|
|
@ -0,0 +1,28 @@
|
||||||
|
---
|
||||||
|
title: README
|
||||||
|
---
|
||||||
|
|
||||||
|
## General Info
|
||||||
|
|
||||||
|
TrueCharts can be installed as both _normal_ Helm Charts or as Apps on TrueNAS SCALE.
|
||||||
|
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||||
|
|
||||||
|
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/prometheus)
|
||||||
|
|
||||||
|
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||||
|
- See the [Website](https://truecharts.org)
|
||||||
|
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||||
|
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Sponsor TrueCharts
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||||
|
|
||||||
|
_All Rights Reserved - The TrueCharts Project_
|
|
@ -0,0 +1,9 @@
|
||||||
|
|
||||||
|
|
||||||
|
## [prometheus-16.1.6](https://github.com/truecharts/charts/compare/prometheus-16.1.5...prometheus-16.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
|
@ -0,0 +1,8 @@
|
||||||
|
kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.
|
||||||
|
|
||||||
|
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/enterprise/prometheus](https://truecharts.org/charts/enterprise/prometheus)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
Binary file not shown.
Binary file not shown.
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
@ -0,0 +1,210 @@
|
||||||
|
{{/* Name suffixed with operator */}}
|
||||||
|
{{- define "kube-prometheus.fullname" -}}
|
||||||
|
{{- printf "%s" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Name suffixed with operator */}}
|
||||||
|
{{- define "kube-prometheus.name" -}}
|
||||||
|
{{- printf "%s" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Name suffixed with operator */}}
|
||||||
|
{{- define "kube-prometheus.operator.name" -}}
|
||||||
|
{{- printf "%s-operator" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Name suffixed with prometheus */}}
|
||||||
|
{{- define "kube-prometheus.prometheus.name" -}}
|
||||||
|
{{- printf "%s-prometheus" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Name suffixed with alertmanager */}}
|
||||||
|
{{- define "kube-prometheus.alertmanager.name" -}}
|
||||||
|
{{- printf "%s-alertmanager" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Name suffixed with thanos */}}
|
||||||
|
{{- define "kube-prometheus.thanos.name" -}}
|
||||||
|
{{- printf "%s-thanos" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Fullname suffixed with operator */}}
|
||||||
|
{{- define "kube-prometheus.operator.fullname" -}}
|
||||||
|
{{- printf "%s-operator" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Fullname suffixed with prometheus */}}
|
||||||
|
{{- define "kube-prometheus.prometheus.fullname" -}}
|
||||||
|
{{- printf "%s-prometheus" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Fullname suffixed with alertmanager */}}
|
||||||
|
{{- define "kube-prometheus.alertmanager.fullname" -}}
|
||||||
|
{{- printf "%s-alertmanager" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Fullname suffixed with thanos */}}
|
||||||
|
{{- define "kube-prometheus.thanos.fullname" -}}
|
||||||
|
{{- printf "%s-thanos" (include "kube-prometheus.prometheus.fullname" .) -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "kube-prometheus.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common Labels
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.labels" -}}
|
||||||
|
{{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml) -}}
|
||||||
|
{{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
|
||||||
|
{{- . | nindent 0 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.global.labels }}
|
||||||
|
{{ toYaml .Values.global.labels }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Labels for operator
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.operator.labels" -}}
|
||||||
|
{{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml) -}}
|
||||||
|
{{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
|
||||||
|
{{- . | nindent 0 }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/component: operator
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Labels for prometheus
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.prometheus.labels" -}}
|
||||||
|
{{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml) -}}
|
||||||
|
{{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
|
||||||
|
{{- . | nindent 0 }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/component: prometheus
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Labels for alertmanager
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.alertmanager.labels" -}}
|
||||||
|
{{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml) -}}
|
||||||
|
{{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
|
||||||
|
{{- . | nindent 0 }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/component: alertmanager
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
matchLabels for operator
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.operator.matchLabels" -}}
|
||||||
|
{{ include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ )}}
|
||||||
|
app.kubernetes.io/component: operator
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
matchLabels for prometheus
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.prometheus.matchLabels" -}}
|
||||||
|
{{ include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ )}}
|
||||||
|
app.kubernetes.io/component: prometheus
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
matchLabels for alertmanager
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.alertmanager.matchLabels" -}}
|
||||||
|
{{ include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ )}}
|
||||||
|
app.kubernetes.io/component: alertmanager
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Prometheus Operator image name
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.image" -}}
|
||||||
|
{{ printf "%s:%s" .Values.image.repository (default .Chart.AppVersion .Values.image.tag) | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Prometheus Operator Reloader image name
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.prometheusConfigReloader.image" -}}
|
||||||
|
{{- include "kube-prometheus.image" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Prometheus Image name
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.prometheus.image" -}}
|
||||||
|
{{ printf "%s:%s" .Values.image.repository (default .Chart.AppVersion .Values.image.tag) | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Thanos Image name
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.prometheus.thanosImage" -}}
|
||||||
|
{{ printf "%s:%s" .Values.thanosImage.repository (default .Chart.AppVersion .Values.thanosImage.tag) | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Alertmanager Image name
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.alertmanager.image" -}}
|
||||||
|
{{ printf "%s:%s" .Values.alertmanagerImage.repository (default .Chart.AppVersion .Values.alertmanagerImage.tag) | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Return the proper Docker Image Registry Secret Names
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.imagePullSecrets" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the operator service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.operator.serviceAccountName" -}}
|
||||||
|
{{- if .Values.operator.serviceAccount.create -}}
|
||||||
|
{{ default (include "kube-prometheus.operator.fullname" .) .Values.operator.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.operator.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the prometheus service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.prometheus.serviceAccountName" -}}
|
||||||
|
{{- if .Values.prometheus.serviceAccount.create -}}
|
||||||
|
{{ default (include "kube-prometheus.prometheus.fullname" .) .Values.prometheus.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.prometheus.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the alertmanager service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.alertmanager.serviceAccountName" -}}
|
||||||
|
{{- if .Values.alertmanager.serviceAccount.create -}}
|
||||||
|
{{ default (include "kube-prometheus.alertmanager.fullname" .) .Values.alertmanager.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.alertmanager.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Compile all warnings into a single message, and call fail.
|
||||||
|
*/}}
|
||||||
|
{{- define "kube-prometheus.validateValues" -}}
|
||||||
|
{{- $messages := list -}}
|
||||||
|
{{- $messages := without $messages "" -}}
|
||||||
|
{{- $message := join "\n" $messages -}}
|
||||||
|
|
||||||
|
{{- if $message -}}
|
||||||
|
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,174 @@
|
||||||
|
{{- define "prometheus.alertmanager.alertmanager" -}}
|
||||||
|
{{- if .Values.alertmanager.enabled }}
|
||||||
|
---
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: Alertmanager
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.alertmanager.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.alertmanager.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.alertmanager.replicaCount }}
|
||||||
|
serviceAccountName: {{ template "kube-prometheus.alertmanager.serviceAccountName" . }}
|
||||||
|
{{- if .Values.alertmanager.image }}
|
||||||
|
image: {{ template "kube-prometheus.alertmanager.image" . }}
|
||||||
|
{{- end }}
|
||||||
|
listenLocal: {{ .Values.alertmanager.listenLocal }}
|
||||||
|
{{- if index .Values.alertmanager "externalUrl" }}
|
||||||
|
externalUrl: "{{ .Values.alertmanager.externalUrl }}"
|
||||||
|
{{- else if and .Values.ingress.alertmanager.enabled .Values.ingress.alertmanager.hosts }}
|
||||||
|
externalUrl: {{ if .Values.ingress.alertmanager.tls }}https{{else}}http{{ end }}://{{ (index .Values.ingress.alertmanager.hosts 0).name }}{{ .Values.alertmanager.routePrefix }}
|
||||||
|
{{- else }}
|
||||||
|
externalUrl: http://{{ template "kube-prometheus.alertmanager.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.alertmanager.ports.alertmanager.port }}{{ .Values.alertmanager.routePrefix }}
|
||||||
|
{{- end }}
|
||||||
|
portName: "{{ .Values.alertmanager.portName }}"
|
||||||
|
paused: {{ .Values.alertmanager.paused }}
|
||||||
|
logFormat: {{ .Values.alertmanager.logFormat }}
|
||||||
|
logLevel: {{ .Values.alertmanager.logLevel }}
|
||||||
|
retention: {{ .Values.alertmanager.retention }}
|
||||||
|
{{- if .Values.alertmanager.secrets }}
|
||||||
|
secrets: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.secrets "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.configMaps }}
|
||||||
|
configMaps: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.configMaps "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
resources: {{- toYaml .Values.alertmanager.resources | nindent 4 }}
|
||||||
|
routePrefix: "{{ .Values.alertmanager.routePrefix }}"
|
||||||
|
{{- if .Values.alertmanager.podSecurityContext.enabled }}
|
||||||
|
securityContext: {{- omit .Values.alertmanager.podSecurityContext "enabled" | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.storageSpec }}
|
||||||
|
storage: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.storageSpec "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
{{- if .Values.alertmanager.persistence.enabled }}
|
||||||
|
storage:
|
||||||
|
volumeClaimTemplate:
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
{{- range .Values.alertmanager.persistence.accessModes }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.alertmanager.persistence.size | quote }}
|
||||||
|
{{- with (include "tc.v1.common.lib.storage.storageClassName" ( dict "rootCtx" . "objectData" .Values.prometheus.persistence )) | trim }}
|
||||||
|
storageClassName: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.alertmanager.podMetadata.labels .Values.alertmanager.podMetadata.annotations (eq .Values.alertmanager.podAntiAffinityPreset "soft") (eq .Values.alertmanager.podAntiAffinityPreset "hard") }}
|
||||||
|
podMetadata:
|
||||||
|
labels:
|
||||||
|
{{- if .Values.alertmanager.podMetadata.labels }}
|
||||||
|
{{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.podMetadata.labels "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or (eq .Values.alertmanager.podAntiAffinityPreset "soft") (eq .Values.alertmanager.podAntiAffinityPreset "hard") }}
|
||||||
|
{{- include "kube-prometheus.alertmanager.matchLabels" . | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.podMetadata.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.podMetadata.annotations "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.affinity }}
|
||||||
|
affinity: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.affinity "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.nodeSelector }}
|
||||||
|
nodeSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.nodeSelector "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.tolerations }}
|
||||||
|
tolerations: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.tolerations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.volumes }}
|
||||||
|
volumes: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.volumes "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.volumeMounts }}
|
||||||
|
volumeMounts: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.volumeMounts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "kube-prometheus.imagePullSecrets" . | indent 2 }}
|
||||||
|
{{- if or .Values.alertmanager.containers .Values.alertmanager.containerSecurityContext.enabled .Values.operator.prometheusConfigReloader.containerSecurityContext.enabled }}
|
||||||
|
containers:
|
||||||
|
{{- if or .Values.alertmanager.containerSecurityContext.enabled .Values.alertmanager.livenessProbe.enabled .Values.alertmanager.readinessProbe.enabled }}
|
||||||
|
## This monkey patching is needed until the securityContexts are
|
||||||
|
## directly patchable via the CRD.
|
||||||
|
## ref: https://github.com/prometheus-operator/prometheus-operator/issues/3947
|
||||||
|
## currently implemented with strategic merge
|
||||||
|
## ref: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/strategic-merge-patch.md
|
||||||
|
- name: alertmanager
|
||||||
|
{{- if .Values.alertmanager.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- omit .Values.alertmanager.containerSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.livenessProbe.enabled }}
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: {{ .Values.alertmanager.livenessProbe.path }}
|
||||||
|
port: alertmanager
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .Values.alertmanager.livenessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.alertmanager.livenessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.alertmanager.livenessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.alertmanager.livenessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.alertmanager.livenessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.readinessProbe.enabled }}
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: {{ .Values.alertmanager.readinessProbe.path }}
|
||||||
|
port: alertmanager
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .Values.alertmanager.readinessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.alertmanager.readinessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.alertmanager.readinessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.alertmanager.readinessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.alertmanager.readinessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.operator.prometheusConfigReloader.containerSecurityContext.enabled .Values.operator.prometheusConfigReloader.livenessProbe.enabled .Values.operator.prometheusConfigReloader.readinessProbe.enabled }}
|
||||||
|
## This monkey patching is needed until the securityContexts are
|
||||||
|
## directly patchable via the CRD.
|
||||||
|
## ref: https://github.com/prometheus-operator/prometheus-operator/issues/3947
|
||||||
|
## currently implemented with strategic merge
|
||||||
|
## ref: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/strategic-merge-patch.md
|
||||||
|
- name: config-reloader
|
||||||
|
{{- if .Values.operator.prometheusConfigReloader.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- omit .Values.operator.prometheusConfigReloader.containerSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.prometheusConfigReloader.livenessProbe.enabled }}
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: reloader-web
|
||||||
|
initialDelaySeconds: {{ .Values.operator.prometheusConfigReloader.livenessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.operator.prometheusConfigReloader.livenessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.operator.prometheusConfigReloader.livenessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.operator.prometheusConfigReloader.livenessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.operator.prometheusConfigReloader.livenessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.prometheusConfigReloader.readinessProbe.enabled }}
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: reloader-web
|
||||||
|
initialDelaySeconds: {{ .Values.operator.prometheusConfigReloader.readinessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.operator.prometheusConfigReloader.readinessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.operator.prometheusConfigReloader.readinessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.operator.prometheusConfigReloader.readinessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.operator.prometheusConfigReloader.readinessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.containers }}
|
||||||
|
{{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.containers "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.alertmanager.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.additionalPeers }}
|
||||||
|
additionalPeers: {{ .Values.alertmanager.additionalPeers }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.configNamespaceSelector }}
|
||||||
|
alertmanagerConfigNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.configNamespaceSelector "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.configSelector }}
|
||||||
|
alertmanagerConfigSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.configSelector "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,13 @@
|
||||||
|
{{- if (and .Values.alertmanager.enabled (not .Values.alertmanager.externalConfig) ) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: alertmanager-{{ template "kube-prometheus.alertmanager.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.alertmanager.labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
alertmanager.yaml: {{ toYaml .Values.alertmanager.config | b64enc | quote }}
|
||||||
|
{{- range $key, $val := .Values.alertmanager.templateFiles }}
|
||||||
|
{{ $key }}: {{ $val | b64enc | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,12 @@
|
||||||
|
{{- if and .Values.alertmanager.enabled .Values.alertmanager.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.alertmanager.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.alertmanager.labels" . | nindent 4 }}
|
||||||
|
{{- if index .Values.alertmanager.serviceAccount "annotations" }}
|
||||||
|
annotations: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.serviceAccount.annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "kube-prometheus.imagePullSecrets" . }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,26 @@
|
||||||
|
{{- if and .Values.alertmanager.enabled .Values.alertmanager.serviceMonitor.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.alertmanager.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.alertmanager.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "kube-prometheus.alertmanager.matchLabels" . | nindent 6 }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ .Release.Namespace }}
|
||||||
|
endpoints:
|
||||||
|
- port: http
|
||||||
|
{{- if .Values.alertmanager.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.alertmanager.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
path: {{ trimSuffix "/" .Values.alertmanager.routePrefix }}/metrics
|
||||||
|
{{- if .Values.alertmanager.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.alertmanager.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.alertmanager.serviceMonitor.relabelings }}
|
||||||
|
relabelings: {{- toYaml .Values.alertmanager.serviceMonitor.relabelings | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,13 @@
|
||||||
|
{{/* Make sure all variables are set properly */}}
|
||||||
|
{{- include "tc.v1.common.loader.init" . }}
|
||||||
|
|
||||||
|
{{- include "prometheus.prometheus.prometheus" . }}
|
||||||
|
{{- include "prometheus.prometheus.additionalprometheusrules" . }}
|
||||||
|
{{- include "prometheus.prometheus.additionalscrapejobs" . }}
|
||||||
|
{{- include "prometheus.prometheus.servicemonitor" . }}
|
||||||
|
|
||||||
|
{{- include "prometheus.alertmanager.alertmanager" . }}
|
||||||
|
|
||||||
|
|
||||||
|
{{/* Render the templates */}}
|
||||||
|
{{ include "tc.v1.common.loader.apply" . }}
|
|
@ -0,0 +1,22 @@
|
||||||
|
{{- if and .Values.coreDns.enabled .Values.coreDns.service.enabled }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-coredns
|
||||||
|
namespace: {{ .Values.coreDns.namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-coredns
|
||||||
|
spec:
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: http-metrics
|
||||||
|
port: {{ .Values.coreDns.service.port }}
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: {{ .Values.coreDns.service.targetPort }}
|
||||||
|
selector:
|
||||||
|
{{- if .Values.coreDns.service.selector }}
|
||||||
|
{{ toYaml .Values.coreDns.service.selector | indent 4 }}
|
||||||
|
{{- else}}
|
||||||
|
k8s-app: kube-dns
|
||||||
|
{{- end}}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,29 @@
|
||||||
|
{{- if .Values.coreDns.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-coredns
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-coredns
|
||||||
|
spec:
|
||||||
|
jobLabel: k8s-app
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-coredns
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ .Values.coreDns.namespace }}
|
||||||
|
endpoints:
|
||||||
|
- port: http-metrics
|
||||||
|
{{- if .Values.coreDns.serviceMonitor.interval}}
|
||||||
|
interval: {{ .Values.coreDns.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||||
|
{{- if .Values.coreDns.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.coreDns.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.coreDns.serviceMonitor.relabelings }}
|
||||||
|
relabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.coreDns.serviceMonitor.relabelings "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,35 @@
|
||||||
|
{{- if .Values.kubeApiServer.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-apiserver
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: apiserver
|
||||||
|
spec:
|
||||||
|
jobLabel: component
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
component: apiserver
|
||||||
|
provider: kubernetes
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- default
|
||||||
|
endpoints:
|
||||||
|
- port: https
|
||||||
|
scheme: https
|
||||||
|
tlsConfig:
|
||||||
|
caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||||
|
serverName: kubernetes
|
||||||
|
insecureSkipVerify: true
|
||||||
|
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||||
|
{{- if .Values.kubeApiServer.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.kubeApiServer.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubeApiServer.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubeApiServer.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubeApiServer.serviceMonitor.relabelings }}
|
||||||
|
relabelings: {{- toYaml .Values.kubeApiServer.serviceMonitor.relabelings | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,18 @@
|
||||||
|
{{- if and .Values.kubeControllerManager.enabled .Values.kubeControllerManager.endpoints }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Endpoints
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-kube-controller-manager
|
||||||
|
namespace: {{ .Values.kubeControllerManager.namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: kube-controller-manager
|
||||||
|
subsets:
|
||||||
|
- addresses:
|
||||||
|
{{- range .Values.kubeControllerManager.endpoints }}
|
||||||
|
- ip: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: http-metrics
|
||||||
|
port: {{ .Values.kubeControllerManager.service.port }}
|
||||||
|
protocol: TCP
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,25 @@
|
||||||
|
{{- if and .Values.kubeControllerManager.enabled .Values.kubeControllerManager.service.enabled }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-kube-controller-manager
|
||||||
|
namespace: {{ .Values.kubeControllerManager.namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-kube-controller-manager
|
||||||
|
spec:
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: http-metrics
|
||||||
|
port: {{ .Values.kubeControllerManager.service.port }}
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: {{ .Values.kubeControllerManager.service.targetPort }}
|
||||||
|
{{- if .Values.kubeControllerManager.endpoints }}{{- else }}
|
||||||
|
selector:
|
||||||
|
{{- if .Values.kubeControllerManager.service.selector }}
|
||||||
|
{{ toYaml .Values.kubeControllerManager.service.selector | indent 4 }}
|
||||||
|
{{- else}}
|
||||||
|
component: kube-controller-manager
|
||||||
|
{{- end}}
|
||||||
|
{{- end }}
|
||||||
|
type: ClusterIP
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,40 @@
|
||||||
|
{{- if .Values.kubeControllerManager.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-kube-controller-manager
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-kube-controller-manager
|
||||||
|
spec:
|
||||||
|
jobLabel: component
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-kube-controller-manager
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ .Values.kubeControllerManager.namespace }}
|
||||||
|
endpoints:
|
||||||
|
- port: http-metrics
|
||||||
|
{{- if .Values.kubeControllerManager.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.kubeControllerManager.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||||
|
{{- if .Values.kubeControllerManager.serviceMonitor.https }}
|
||||||
|
scheme: https
|
||||||
|
tlsConfig:
|
||||||
|
caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||||
|
{{- if .Values.kubeControllerManager.serviceMonitor.insecureSkipVerify }}
|
||||||
|
insecureSkipVerify: {{ .Values.kubeControllerManager.serviceMonitor.insecureSkipVerify }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubeControllerManager.serviceMonitor.serverName }}
|
||||||
|
serverName: {{ .Values.kubeControllerManager.serviceMonitor.serverName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubeControllerManager.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.kubeControllerManager.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubeControllerManager.serviceMonitor.relabelings }}
|
||||||
|
relabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.kubeControllerManager.serviceMonitor.relabelings "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,18 @@
|
||||||
|
{{- if and .Values.kubeScheduler.enabled .Values.kubeScheduler.endpoints }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Endpoints
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-kube-scheduler
|
||||||
|
namespace: {{ .Values.kubeScheduler.namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: kube-scheduler
|
||||||
|
subsets:
|
||||||
|
- addresses:
|
||||||
|
{{- range .Values.kubeScheduler.endpoints }}
|
||||||
|
- ip: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: http-metrics
|
||||||
|
port: {{ .Values.kubeScheduler.service.port }}
|
||||||
|
protocol: TCP
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,25 @@
|
||||||
|
{{- if and .Values.kubeScheduler.enabled .Values.kubeScheduler.service.enabled }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-kube-scheduler
|
||||||
|
namespace: {{ .Values.kubeScheduler.namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-kube-scheduler
|
||||||
|
spec:
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: http-metrics
|
||||||
|
port: {{ .Values.kubeScheduler.service.port}}
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: {{ .Values.kubeScheduler.service.targetPort}}
|
||||||
|
{{- if .Values.kubeScheduler.endpoints }}{{- else }}
|
||||||
|
selector:
|
||||||
|
{{- if .Values.kubeScheduler.service.selector }}
|
||||||
|
{{ toYaml .Values.kubeScheduler.service.selector | indent 4 }}
|
||||||
|
{{- else}}
|
||||||
|
component: kube-scheduler
|
||||||
|
{{- end}}
|
||||||
|
{{- end }}
|
||||||
|
type: ClusterIP
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,40 @@
|
||||||
|
{{- if .Values.kubeScheduler.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-kube-scheduler
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-kube-scheduler
|
||||||
|
spec:
|
||||||
|
jobLabel: component
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: {{ template "kube-prometheus.fullname" . }}-kube-scheduler
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ .Values.kubeScheduler.namespace }}
|
||||||
|
endpoints:
|
||||||
|
- port: http-metrics
|
||||||
|
{{- if .Values.kubeScheduler.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.kubeScheduler.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||||
|
{{- if .Values.kubeScheduler.serviceMonitor.https }}
|
||||||
|
scheme: https
|
||||||
|
tlsConfig:
|
||||||
|
caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||||
|
{{- if .Values.kubeScheduler.serviceMonitor.insecureSkipVerify }}
|
||||||
|
insecureSkipVerify: {{ .Values.kubeScheduler.serviceMonitor.insecureSkipVerify }}
|
||||||
|
{{- end}}
|
||||||
|
{{- if .Values.kubeScheduler.serviceMonitor.serverName }}
|
||||||
|
serverName: {{ .Values.kubeScheduler.serviceMonitor.serverName }}
|
||||||
|
{{- end}}
|
||||||
|
{{- end}}
|
||||||
|
{{- if .Values.kubeScheduler.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.kubeScheduler.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubeScheduler.serviceMonitor.relabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.kubeScheduler.serviceMonitor.relabelings "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,85 @@
|
||||||
|
{{- if .Values.kubelet.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.fullname" . }}-kubelet
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: kubelet
|
||||||
|
spec:
|
||||||
|
jobLabel: k8s-app
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
k8s-app: kubelet
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ .Values.kubelet.namespace }}
|
||||||
|
endpoints:
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.https }}
|
||||||
|
- port: https-metrics
|
||||||
|
scheme: https
|
||||||
|
tlsConfig:
|
||||||
|
caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||||
|
serverName: kubernetes
|
||||||
|
insecureSkipVerify: true
|
||||||
|
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||||
|
honorLabels: true
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.kubelet.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.relabelings }}
|
||||||
|
relabelings: {{- toYaml .Values.kubelet.serviceMonitor.relabelings | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
- port: https-metrics
|
||||||
|
path: /metrics/cadvisor
|
||||||
|
scheme: https
|
||||||
|
tlsConfig:
|
||||||
|
caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||||
|
serverName: kubernetes
|
||||||
|
insecureSkipVerify: true
|
||||||
|
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||||
|
honorLabels: true
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.kubelet.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.cAdvisorRelabelings }}
|
||||||
|
relabelings: {{- toYaml .Values.kubelet.serviceMonitor.cAdvisorRelabelings | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
- port: http-metrics
|
||||||
|
scheme: http
|
||||||
|
tlsConfig:
|
||||||
|
insecureSkipVerify: false
|
||||||
|
honorLabels: true
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.kubelet.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.relabelings }}
|
||||||
|
relabelings: {{- toYaml .Values.kubelet.serviceMonitor.relabelings | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
- port: http-metrics
|
||||||
|
path: /metrics/cadvisor
|
||||||
|
scheme: http
|
||||||
|
tlsConfig:
|
||||||
|
insecureSkipVerify: false
|
||||||
|
honorLabels: true
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.kubelet.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kubelet.serviceMonitor.cAdvisorRelabelings }}
|
||||||
|
relabelings: {{- toYaml .Values.kubelet.serviceMonitor.cAdvisorRelabelings | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,15 @@
|
||||||
|
{{- define "prometheus.prometheus.additionalprometheusrules" -}}
|
||||||
|
{{- if and .Values.prometheus.enabled .Values.prometheus.additionalPrometheusRules}}
|
||||||
|
{{- range .Values.prometheus.additionalPrometheusRules }}
|
||||||
|
---
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: PrometheusRule
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.name" $ }}-{{ .name }}
|
||||||
|
namespace: {{ $.Release.Namespace }}
|
||||||
|
labels: {{ include "kube-prometheus.prometheus.labels" $ | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
groups: {{- toYaml .groups | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,13 @@
|
||||||
|
{{- define "prometheus.prometheus.additionalscrapejobs" -}}
|
||||||
|
{{- if (and .Values.prometheus.additionalScrapeConfigs.enabled (eq .Values.prometheus.additionalScrapeConfigs.type "internal") ) }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: additional-scrape-jobs-{{ template "kube-prometheus.prometheus.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.prometheus.labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
scrape-jobs.yaml: {{ include "tc.v1.common.tplvalues.render" ( dict "value" .Values.prometheus.additionalScrapeConfigs.internal.jobList "context" $ ) | b64enc | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,363 @@
|
||||||
|
{{- define "prometheus.prometheus.prometheus" -}}
|
||||||
|
{{- if .Values.prometheus.enabled }}
|
||||||
|
---
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: Prometheus
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.prometheus.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.prometheus.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.prometheus.replicaCount }}
|
||||||
|
serviceAccountName: {{ template "kube-prometheus.prometheus.serviceAccountName" . }}
|
||||||
|
{{- if .Values.prometheus.serviceMonitorSelector }}
|
||||||
|
serviceMonitorSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.serviceMonitorSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
serviceMonitorSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.podMonitorSelector }}
|
||||||
|
podMonitorSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.podMonitorSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
podMonitorSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.probeSelector }}
|
||||||
|
probeSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.probeSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
probeSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.scrapeConfigSelector }}
|
||||||
|
scrapeConfigSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.scrapeConfigSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
scrapeConfigSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
alerting:
|
||||||
|
alertmanagers:
|
||||||
|
{{- if .Values.prometheus.alertingEndpoints }}
|
||||||
|
{{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.alertingEndpoints "context" $) | nindent 6 }}
|
||||||
|
{{- else if .Values.alertmanager.enabled }}
|
||||||
|
- namespace: {{ .Release.Namespace }}
|
||||||
|
name: {{ template "kube-prometheus.alertmanager.fullname" . }}
|
||||||
|
port: http
|
||||||
|
pathPrefix: "{{ .Values.alertmanager.routePrefix }}"
|
||||||
|
{{- else }}
|
||||||
|
[]
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.image }}
|
||||||
|
image: {{ template "kube-prometheus.prometheus.image" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.externalLabels }}
|
||||||
|
externalLabels: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.externalLabels "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.prometheusExternalLabelNameClear }}
|
||||||
|
prometheusExternalLabelName: ""
|
||||||
|
{{- else if .Values.prometheus.prometheusExternalLabelName }}
|
||||||
|
prometheusExternalLabelName: "{{ .Values.prometheus.prometheusExternalLabelName }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.replicaExternalLabelNameClear }}
|
||||||
|
replicaExternalLabelName: ""
|
||||||
|
{{- else if .Values.prometheus.replicaExternalLabelName }}
|
||||||
|
replicaExternalLabelName: "{{ .Values.prometheus.replicaExternalLabelName }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- if index .Values.prometheus "externalUrl" }}
|
||||||
|
externalUrl: "{{ .Values.prometheus.externalUrl }}"
|
||||||
|
{{- else if and .Values.ingress.main.enabled .Values.ingress.main.hosts }}
|
||||||
|
externalUrl: {{ if .Values.ingress.main.tls }}https{{else}}http{{ end }}://{{ (index .Values.ingress.main.hosts 0).name }}{{ .Values.prometheus.routePrefix }}
|
||||||
|
{{- else }}
|
||||||
|
externalUrl: http://{{ template "kube-prometheus.prometheus.fullname" . }}.{{ .Release.Namespace }}:9090{{ .Values.prometheus.routePrefix }}
|
||||||
|
{{- end }}
|
||||||
|
paused: {{ .Values.prometheus.paused }}
|
||||||
|
logLevel: {{ .Values.prometheus.logLevel }}
|
||||||
|
logFormat: {{ .Values.prometheus.logFormat }}
|
||||||
|
listenLocal: {{ .Values.prometheus.listenLocal }}
|
||||||
|
enableAdminAPI: {{ .Values.prometheus.enableAdminAPI }}
|
||||||
|
{{- if .Values.prometheus.enableFeatures }}
|
||||||
|
enableFeatures:
|
||||||
|
{{- range .Values.prometheus.enableFeatures }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.scrapeInterval }}
|
||||||
|
scrapeInterval: {{ .Values.prometheus.scrapeInterval }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.evaluationInterval }}
|
||||||
|
evaluationInterval: {{ .Values.prometheus.evaluationInterval }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.resources }}
|
||||||
|
resources: {{- toYaml .Values.prometheus.resources | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
retention: {{ .Values.prometheus.retention }}
|
||||||
|
{{- if .Values.prometheus.retentionSize }}
|
||||||
|
retentionSize: {{ .Values.prometheus.retentionSize }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.disableCompaction }}
|
||||||
|
disableCompaction: {{ .Values.prometheus.disableCompaction }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.walCompression }}
|
||||||
|
walCompression: {{ .Values.prometheus.walCompression }}
|
||||||
|
{{- end }}
|
||||||
|
portName: "{{ .Values.prometheus.portName }}"
|
||||||
|
routePrefix: "{{ .Values.prometheus.routePrefix }}"
|
||||||
|
{{- if .Values.prometheus.secrets }}
|
||||||
|
secrets: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.secrets "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.configMaps }}
|
||||||
|
configMaps: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.configMaps "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.serviceMonitorNamespaceSelector }}
|
||||||
|
serviceMonitorNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.serviceMonitorNamespaceSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
serviceMonitorNamespaceSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.podMonitorNamespaceSelector }}
|
||||||
|
podMonitorNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.podMonitorNamespaceSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
podMonitorNamespaceSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.probeNamespaceSelector }}
|
||||||
|
probeNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.probeNamespaceSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
probeNamespaceSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.scrapeConfigNamespaceSelector }}
|
||||||
|
scrapeConfigNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.scrapeConfigNamespaceSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
scrapeConfigNamespaceSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.remoteRead }}
|
||||||
|
remoteRead: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.remoteRead "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.prometheus.remoteWrite }}
|
||||||
|
remoteWrite:
|
||||||
|
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.podSecurityContext.enabled }}
|
||||||
|
securityContext: {{- omit .Values.prometheus.podSecurityContext "enabled" | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.ruleNamespaceSelector }}
|
||||||
|
ruleNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.ruleNamespaceSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
ruleNamespaceSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.ruleSelector }}
|
||||||
|
ruleSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.ruleSelector "context" $) | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
ruleSelector: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.storageSpec }}
|
||||||
|
storage: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.storageSpec "context" $) | nindent 4 }}
|
||||||
|
{{- else if .Values.prometheus.persistence.enabled }}
|
||||||
|
storage:
|
||||||
|
volumeClaimTemplate:
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
{{- range .Values.prometheus.persistence.accessModes }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.prometheus.persistence.size | quote }}
|
||||||
|
{{- with (include "tc.v1.common.lib.storage.storageClassName" ( dict "rootCtx" . "objectData" .Values.prometheus.persistence )) | trim }}
|
||||||
|
storageClassName: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.prometheus.podMetadata.labels .Values.prometheus.podMetadata.annotations (eq .Values.prometheus.podAntiAffinityPreset "soft") (eq .Values.prometheus.podAntiAffinityPreset "hard") }}
|
||||||
|
podMetadata:
|
||||||
|
labels:
|
||||||
|
{{- if .Values.prometheus.podMetadata.labels }}
|
||||||
|
{{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.podMetadata.labels "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or (eq .Values.prometheus.podAntiAffinityPreset "soft") (eq .Values.prometheus.podAntiAffinityPreset "hard") }}
|
||||||
|
{{- include "kube-prometheus.prometheus.matchLabels" . | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.podMetadata.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.podMetadata.annotations "context" $) | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.querySpec }}
|
||||||
|
query: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.querySpec "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.affinity }}
|
||||||
|
affinity: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.affinity "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.nodeSelector }}
|
||||||
|
nodeSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.nodeSelector "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.tolerations }}
|
||||||
|
tolerations: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.tolerations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.volumes }}
|
||||||
|
volumes: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.volumes "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.volumeMounts }}
|
||||||
|
volumeMounts: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.volumeMounts "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.prometheus.additionalScrapeConfigs.enabled .Values.prometheus.additionalScrapeConfigsExternal.enabled }}
|
||||||
|
additionalScrapeConfigs:
|
||||||
|
{{- if and .Values.prometheus.additionalScrapeConfigs.enabled (eq .Values.prometheus.additionalScrapeConfigs.type "external") }}
|
||||||
|
name: {{ .Values.prometheus.additionalScrapeConfigs.external.name }}
|
||||||
|
key: {{ .Values.prometheus.additionalScrapeConfigs.external.key }}
|
||||||
|
{{- else if and .Values.prometheus.additionalScrapeConfigs.enabled (eq .Values.prometheus.additionalScrapeConfigs.type "internal") }}
|
||||||
|
name: additional-scrape-jobs-{{ template "kube-prometheus.prometheus.fullname" . }}
|
||||||
|
key: scrape-jobs.yaml
|
||||||
|
{{- else if and (not .Values.prometheus.additionalScrapeConfigs.enabled) .Values.prometheus.additionalScrapeConfigsExternal.enabled }}
|
||||||
|
name: {{ .Values.prometheus.additionalScrapeConfigsExternal.name }}
|
||||||
|
key: {{ .Values.prometheus.additionalScrapeConfigsExternal.key }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.additionalAlertRelabelConfigsExternal.enabled }}
|
||||||
|
additionalAlertRelabelConfigs:
|
||||||
|
name: {{ .Values.prometheus.additionalAlertRelabelConfigsExternal.name }}
|
||||||
|
key: {{ .Values.prometheus.additionalAlertRelabelConfigsExternal.key }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "kube-prometheus.imagePullSecrets" . | indent 2 }}
|
||||||
|
{{- if or .Values.prometheus.containers .Values.prometheus.thanos.create .Values.prometheus.containerSecurityContext.enabled .Values.prometheus.containerSecurityContext.enabled .Values.operator.prometheusConfigReloader.containerSecurityContext.enabled }}
|
||||||
|
containers:
|
||||||
|
{{- if .Values.prometheus.thanos.create }}
|
||||||
|
- name: thanos-sidecar
|
||||||
|
image: {{ template "kube-prometheus.prometheus.thanosImage" . }}
|
||||||
|
imagePullPolicy: {{ .Values.prometheus.thanos.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
- sidecar
|
||||||
|
- --prometheus.url={{ default "http://localhost:9090" .Values.prometheus.thanos.prometheusUrl }}
|
||||||
|
- --grpc-address=0.0.0.0:10901
|
||||||
|
- --http-address=0.0.0.0:10902
|
||||||
|
- --tsdb.path=/prometheus/
|
||||||
|
{{- if .Values.prometheus.thanos.objectStorageConfig }}
|
||||||
|
- --objstore.config=$(OBJSTORE_CONFIG)
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.thanos.extraArgs }}
|
||||||
|
{{ toYaml .Values.prometheus.thanos.extraArgs | indent 8 | trim }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.thanos.objectStorageConfig }}
|
||||||
|
env:
|
||||||
|
- name: OBJSTORE_CONFIG
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ .Values.prometheus.thanos.objectStorageConfig.secretName }}
|
||||||
|
key: {{ .Values.prometheus.thanos.objectStorageConfig.secretKey | default "thanos.yaml" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.thanos.resources }}
|
||||||
|
resources: {{- toYaml .Values.prometheus.thanos.resources | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: thanos
|
||||||
|
containerPort: 10901
|
||||||
|
protocol: TCP
|
||||||
|
- name: http
|
||||||
|
containerPort: 10902
|
||||||
|
protocol: TCP
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /prometheus
|
||||||
|
name: prometheus-{{ template "kube-prometheus.prometheus.fullname" . }}-db
|
||||||
|
{{- if not (.Values.prometheus.storageSpec.disableMountSubPath | default (not .Values.prometheus.persistence.enabled)) }}
|
||||||
|
subPath: prometheus-db
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.thanos.extraVolumeMounts }}
|
||||||
|
{{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.thanos.extraVolumeMounts "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.thanos.containerSecurityContext.enabled }}
|
||||||
|
# yamllint disable rule:indentation
|
||||||
|
securityContext: {{- omit .Values.prometheus.thanos.containerSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||||
|
# yamllint enable rule:indentation
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.thanos.livenessProbe.enabled }}
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: {{ .Values.prometheus.thanos.livenessProbe.path }}
|
||||||
|
port: http
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .Values.prometheus.thanos.livenessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.prometheus.thanos.livenessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.prometheus.thanos.livenessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.prometheus.thanos.livenessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.prometheus.thanos.livenessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.thanos.readinessProbe.enabled }}
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: {{ .Values.prometheus.thanos.readinessProbe.path }}
|
||||||
|
port: http
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .Values.prometheus.thanos.readinessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.prometheus.thanos.readinessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.prometheus.thanos.readinessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.prometheus.thanos.readinessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.prometheus.thanos.readinessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.prometheus.containerSecurityContext.enabled .Values.prometheus.livenessProbe.enabled .Values.prometheus.readinessProbe.enabled }}
|
||||||
|
## This monkey patching is needed until the securityContexts are
|
||||||
|
## directly patchable via the CRD.
|
||||||
|
## ref: https://github.com/prometheus-operator/prometheus-operator/issues/3947
|
||||||
|
## currently implemented with strategic merge
|
||||||
|
## ref: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/strategic-merge-patch.md
|
||||||
|
- name: prometheus
|
||||||
|
{{- if .Values.prometheus.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- omit .Values.prometheus.containerSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.livenessProbe.enabled }}
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: {{ .Values.prometheus.livenessProbe.path }}
|
||||||
|
port: main
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .Values.prometheus.livenessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.prometheus.livenessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.prometheus.livenessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.prometheus.livenessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.prometheus.livenessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.readinessProbe.enabled }}
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: {{ .Values.prometheus.readinessProbe.path }}
|
||||||
|
port: main
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .Values.prometheus.readinessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.prometheus.readinessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.prometheus.readinessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.prometheus.readinessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.prometheus.readinessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.operator.prometheusConfigReloader.containerSecurityContext.enabled .Values.operator.prometheusConfigReloader.livenessProbe.enabled .Values.operator.prometheusConfigReloader.readinessProbe.enabled }}
|
||||||
|
## This monkey patching is needed until the securityContexts are
|
||||||
|
## directly patchable via the CRD.
|
||||||
|
## ref: https://github.com/prometheus-operator/prometheus-operator/issues/3947
|
||||||
|
## currently implemented with strategic merge
|
||||||
|
## ref: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/strategic-merge-patch.md
|
||||||
|
- name: config-reloader
|
||||||
|
{{- if .Values.operator.prometheusConfigReloader.containerSecurityContext.enabled }}
|
||||||
|
securityContext: {{- omit .Values.operator.prometheusConfigReloader.containerSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.prometheusConfigReloader.livenessProbe.enabled }}
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: reloader-web
|
||||||
|
initialDelaySeconds: {{ .Values.operator.prometheusConfigReloader.livenessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.operator.prometheusConfigReloader.livenessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.operator.prometheusConfigReloader.livenessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.operator.prometheusConfigReloader.livenessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.operator.prometheusConfigReloader.livenessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.prometheusConfigReloader.readinessProbe.enabled }}
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: reloader-web
|
||||||
|
initialDelaySeconds: {{ .Values.operator.prometheusConfigReloader.readinessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.operator.prometheusConfigReloader.readinessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.operator.prometheusConfigReloader.readinessProbe.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.operator.prometheusConfigReloader.readinessProbe.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.operator.prometheusConfigReloader.readinessProbe.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.containers }}
|
||||||
|
{{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.containers "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.prometheus.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,29 @@
|
||||||
|
{{- define "prometheus.prometheus.servicemonitor" -}}
|
||||||
|
{{- if and .Values.prometheus.enabled .Values.prometheus.serviceMonitor.enabled }}
|
||||||
|
---
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.prometheus.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.prometheus.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels: {{- include "kube-prometheus.prometheus.matchLabels" . | nindent 6 }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ .Release.Namespace }}
|
||||||
|
endpoints:
|
||||||
|
- port: http
|
||||||
|
{{- if .Values.prometheus.serviceMonitor.interval }}
|
||||||
|
interval: {{ .Values.prometheus.serviceMonitor.interval }}
|
||||||
|
{{- end }}
|
||||||
|
path: {{ trimSuffix "/" .Values.prometheus.routePrefix }}/metrics
|
||||||
|
{{- if .Values.prometheus.serviceMonitor.metricRelabelings }}
|
||||||
|
metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.prometheus.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.serviceMonitor.relabelings }}
|
||||||
|
relabelings: {{- toYaml .Values.prometheus.serviceMonitor.relabelings | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,41 @@
|
||||||
|
{{- if .Values.prometheus.enabled -}}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.prometheus.fullname" . }}
|
||||||
|
labels: {{- include "kube-prometheus.prometheus.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes/metrics
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
- nodes/proxy
|
||||||
|
- services
|
||||||
|
- endpoints
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- "get"
|
||||||
|
- "list"
|
||||||
|
- "watch"
|
||||||
|
- apiGroups:
|
||||||
|
- extensions
|
||||||
|
- "networking.k8s.io"
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- nonResourceURLs:
|
||||||
|
- "/metrics"
|
||||||
|
verbs:
|
||||||
|
- "get"
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,15 @@
|
||||||
|
{{- if .Values.prometheus.enabled }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.prometheus.fullname" . }}
|
||||||
|
labels: {{- include "kube-prometheus.prometheus.labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "kube-prometheus.prometheus.fullname" . }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "kube-prometheus.prometheus.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,12 @@
|
||||||
|
{{- if and .Values.prometheus.enabled .Values.prometheus.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ template "kube-prometheus.prometheus.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels: {{- include "kube-prometheus.prometheus.labels" . | nindent 4 }}
|
||||||
|
{{- if index .Values.prometheus.serviceAccount "annotations" }}
|
||||||
|
annotations: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.serviceAccount.annotations "context" $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "kube-prometheus.imagePullSecrets" . }}
|
||||||
|
{{- end }}
|
|
@ -0,0 +1,99 @@
|
||||||
|
---
|
||||||
|
title: Changelog
|
||||||
|
---
|
||||||
|
|
||||||
|
**Important:**
|
||||||
|
*for the complete changelog, please refer to the website*
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## [anonaddy-19.1.7](https://github.com/truecharts/charts/compare/anonaddy-19.1.6...anonaddy-19.1.7) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
||||||
|
|
||||||
|
|
||||||
|
## [anonaddy-19.1.6](https://github.com/truecharts/charts/compare/anonaddy-19.1.5...anonaddy-19.1.6) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- increase common version for oci fixes
|
||||||
|
|
||||||
|
|
||||||
|
## [anonaddy-19.1.5](https://github.com/truecharts/charts/compare/anonaddy-19.1.4...anonaddy-19.1.5) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16734](https://github.com/truecharts/charts/issues/16734))
|
||||||
|
|
||||||
|
- remove non-existent template refs ([#16738](https://github.com/truecharts/charts/issues/16738))
|
||||||
|
|
||||||
|
|
||||||
|
## [anonaddy-19.1.4](https://github.com/truecharts/charts/compare/anonaddy-19.1.1...anonaddy-19.1.4) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.19[@4ebb688](https://github.com/4ebb688) by renovate ([#16733](https://github.com/truecharts/charts/issues/16733))
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
|
||||||
|
## [anonaddy-19.1.3](https://github.com/truecharts/charts/compare/anonaddy-19.1.1...anonaddy-19.1.3) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
## [anonaddy-19.1.1](https://github.com/truecharts/charts/compare/anonaddy-19.1.0...anonaddy-19.1.1) (2023-12-31)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update container image anonaddy/anonaddy to 1.0.4[@bb9d130](https://github.com/bb9d130) by renovate ([#16590](https://github.com/truecharts/charts/issues/16590))
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
|
||||||
|
## [anonaddy-19.1.0](https://github.com/truecharts/charts/compare/anonaddy-19.0.2...anonaddy-19.1.0) (2023-12-30)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general minor by renovate ([#16579](https://github.com/truecharts/charts/issues/16579))
|
||||||
|
|
||||||
|
## [anonaddy-19.0.2](https://github.com/truecharts/charts/compare/anonaddy-19.0.1...anonaddy-19.0.2) (2023-12-27)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16560](https://github.com/truecharts/charts/issues/16560))
|
||||||
|
|
||||||
|
## [anonaddy-19.0.1](https://github.com/truecharts/charts/compare/anonaddy-19.0.0...anonaddy-19.0.1) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16545](https://github.com/truecharts/charts/issues/16545))
|
||||||
|
|
||||||
|
## [anonaddy-19.0.0](https://github.com/truecharts/charts/compare/anonaddy-18.0.0...anonaddy-19.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general major by renovate (major) ([#16547](https://github.com/truecharts/charts/issues/16547))
|
||||||
|
|
|
@ -0,0 +1,50 @@
|
||||||
|
kubeVersion: ">=1.24.0-0"
|
||||||
|
apiVersion: v2
|
||||||
|
name: anonaddy
|
||||||
|
version: 19.1.7
|
||||||
|
appVersion: 1.0.4
|
||||||
|
description: Protect your email from spam using disposable addresses.
|
||||||
|
home: https://truecharts.org/charts/stable/anonaddy
|
||||||
|
icon: https://truecharts.org/img/hotlink-ok/chart-icons/anonaddy.png
|
||||||
|
deprecated: false
|
||||||
|
sources:
|
||||||
|
- https://hub.docker.com/r/anonaddy/anonaddy
|
||||||
|
- https://github.com/anonaddy/docker
|
||||||
|
- https://github.com/truecharts/charts/tree/master/charts/stable/anonaddy
|
||||||
|
maintainers:
|
||||||
|
- name: TrueCharts
|
||||||
|
email: info@truecharts.org
|
||||||
|
url: https://truecharts.org
|
||||||
|
keywords:
|
||||||
|
- anonaddy
|
||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
version: 17.2.21
|
||||||
|
repository: oci://tccr.io/truecharts
|
||||||
|
condition: ""
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
- name: mariadb
|
||||||
|
version: 12.1.5
|
||||||
|
repository: https://deps.truecharts.org/
|
||||||
|
condition: mariadb.enabled
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
- name: redis
|
||||||
|
version: 11.1.5
|
||||||
|
repository: https://deps.truecharts.org
|
||||||
|
condition: redis.enabled
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
annotations:
|
||||||
|
max_scale_version: 23.10.2
|
||||||
|
min_scale_version: 23.10.0
|
||||||
|
truecharts.org/SCALE-support: "true"
|
||||||
|
truecharts.org/category: email
|
||||||
|
truecharts.org/max_helm_version: "3.13"
|
||||||
|
truecharts.org/min_helm_version: "3.12"
|
||||||
|
truecharts.org/train: stable
|
||||||
|
type: application
|
|
@ -0,0 +1,28 @@
|
||||||
|
---
|
||||||
|
title: README
|
||||||
|
---
|
||||||
|
|
||||||
|
## General Info
|
||||||
|
|
||||||
|
TrueCharts can be installed as both _normal_ Helm Charts or as Apps on TrueNAS SCALE.
|
||||||
|
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||||
|
|
||||||
|
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/anonaddy)
|
||||||
|
|
||||||
|
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||||
|
- See the [Website](https://truecharts.org)
|
||||||
|
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||||
|
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Sponsor TrueCharts
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||||
|
|
||||||
|
_All Rights Reserved - The TrueCharts Project_
|
|
@ -0,0 +1,9 @@
|
||||||
|
|
||||||
|
|
||||||
|
## [anonaddy-19.1.7](https://github.com/truecharts/charts/compare/anonaddy-19.1.6...anonaddy-19.1.7) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
|
@ -0,0 +1,8 @@
|
||||||
|
Protect your email from spam using disposable addresses.
|
||||||
|
|
||||||
|
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/stable/anonaddy](https://truecharts.org/charts/stable/anonaddy)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
Binary file not shown.
Binary file not shown.
|
@ -0,0 +1,94 @@
|
||||||
|
image:
|
||||||
|
repository: anonaddy/anonaddy
|
||||||
|
tag: 1.0.4@sha256:bb9d13028c5d33c071d7e04749a899236a34a96fe88232bbc8224d8b397f14ba
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
securityContext:
|
||||||
|
container:
|
||||||
|
runAsNonRoot: false
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
runAsUser: 0
|
||||||
|
runAsGroup: 0
|
||||||
|
service:
|
||||||
|
main:
|
||||||
|
ports:
|
||||||
|
main:
|
||||||
|
port: 10110
|
||||||
|
targetPort: 8000
|
||||||
|
smtp:
|
||||||
|
enabled: true
|
||||||
|
ports:
|
||||||
|
smtp:
|
||||||
|
enabled: true
|
||||||
|
port: 25
|
||||||
|
targetPort: 25
|
||||||
|
workload:
|
||||||
|
main:
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
type: tcp
|
||||||
|
readiness:
|
||||||
|
type: tcp
|
||||||
|
startup:
|
||||||
|
type: tcp
|
||||||
|
env:
|
||||||
|
ANONADDY_DOMAIN: "chart-example.local"
|
||||||
|
APP_URL: "http://localhost:10110"
|
||||||
|
# The from name to be used for outgoing email notifications from AnonAddy
|
||||||
|
MAIL_FROM_NAME: Example
|
||||||
|
# The from address to be used for outgoing email notifications from AnonAddy
|
||||||
|
MAIL_FROM_ADDRESS: mailer@example.com
|
||||||
|
# just smtp is configurable
|
||||||
|
MAIL_DRIVER: smtp
|
||||||
|
MAIL_HOST: mail.example.com
|
||||||
|
MAIL_PORT: 25
|
||||||
|
MAIL_ENCRYPTION: tls
|
||||||
|
MAIL_EHLO_DOMAIN: mail.example.com
|
||||||
|
MAIL_VERIFY_PEER: false
|
||||||
|
DB_DATABASE: "{{ .Values.mariadb.mariadbDatabase }}"
|
||||||
|
DB_USERNAME: "{{ .Values.mariadb.mariadbUsername }}"
|
||||||
|
DB_HOST:
|
||||||
|
secretKeyRef:
|
||||||
|
expandObjectName: false
|
||||||
|
name: '{{ printf "%s-%s" .Release.Name "mariadbcreds" }}'
|
||||||
|
key: plainhost
|
||||||
|
DB_PASSWORD:
|
||||||
|
secretKeyRef:
|
||||||
|
expandObjectName: false
|
||||||
|
name: '{{ printf "%s-%s" .Release.Name "mariadbcreds" }}'
|
||||||
|
key: mariadb-password
|
||||||
|
REDIS_HOST:
|
||||||
|
secretKeyRef:
|
||||||
|
expandObjectName: false
|
||||||
|
name: '{{ printf "%s-%s" .Release.Name "rediscreds" }}'
|
||||||
|
key: plainhost
|
||||||
|
REDIS_PASSWORD:
|
||||||
|
secretKeyRef:
|
||||||
|
expandObjectName: false
|
||||||
|
name: '{{ printf "%s-%s" .Release.Name "rediscreds" }}'
|
||||||
|
key: redis-password
|
||||||
|
APP_KEY:
|
||||||
|
secretKeyRef:
|
||||||
|
name: anonaddy-secrets
|
||||||
|
key: APP_KEY
|
||||||
|
ANONADDY_SECRET:
|
||||||
|
secretKeyRef:
|
||||||
|
name: anonaddy-secrets
|
||||||
|
key: ANONADDY_SECRET
|
||||||
|
persistence:
|
||||||
|
config:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /config
|
||||||
|
redis:
|
||||||
|
enabled: true
|
||||||
|
mariadb:
|
||||||
|
enabled: true
|
||||||
|
mariadbUsername: anonaddy
|
||||||
|
mariadbDatabase: anonaddy
|
||||||
|
portal:
|
||||||
|
open:
|
||||||
|
enabled: true
|
File diff suppressed because it is too large
Load Diff
|
@ -0,0 +1,19 @@
|
||||||
|
{{/* Define the secrets */}}
|
||||||
|
{{- define "anonaddy.secrets" -}}
|
||||||
|
{{- $secretName := (printf "%s-anonaddy-secrets" (include "tc.v1.common.lib.chart.names.fullname" $)) }}
|
||||||
|
|
||||||
|
# Anonaddy requires APP_KEY to be in base 64 format presented in the container, so this b64enc here is intentional
|
||||||
|
# https://github.com/anonaddy/docker/blob/master/README.md#app
|
||||||
|
{{- $appKey := (printf "base64:%v" (randAlphaNum 32 | b64enc)) -}}
|
||||||
|
{{- $secretKey := randAlphaNum 32 -}}
|
||||||
|
|
||||||
|
{{- with lookup "v1" "Secret" .Release.Namespace $secretName -}}
|
||||||
|
{{- $appKey = index .data "APP_KEY" | b64dec -}}
|
||||||
|
{{- $secretKey = index .data "ANONADDY_SECRET" | b64dec -}}
|
||||||
|
{{- end }}
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
APP_KEY: {{ $appKey }}
|
||||||
|
# Anonaddy requires ANONADDY_SECRET to be a long string
|
||||||
|
ANONADDY_SECRET: {{ $secretKey }}
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,11 @@
|
||||||
|
{{/* Make sure all variables are set properly */}}
|
||||||
|
{{- include "tc.v1.common.loader.init" . -}}
|
||||||
|
|
||||||
|
{{/* Render secrets for anonaddy */}}
|
||||||
|
{{- $secrets := include "anonaddy.secrets" . | fromYaml -}}
|
||||||
|
{{- if $secrets -}}
|
||||||
|
{{- $_ := set .Values.secret "anonaddy-secrets" $secrets -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Render the templates */}}
|
||||||
|
{{- include "tc.v1.common.loader.apply" . -}}
|
|
@ -0,0 +1,99 @@
|
||||||
|
---
|
||||||
|
title: Changelog
|
||||||
|
---
|
||||||
|
|
||||||
|
**Important:**
|
||||||
|
*for the complete changelog, please refer to the website*
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## [authentik-19.1.6](https://github.com/truecharts/charts/compare/authentik-19.1.5...authentik-19.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
||||||
|
|
||||||
|
|
||||||
|
## [authentik-19.1.5](https://github.com/truecharts/charts/compare/authentik-19.1.4...authentik-19.1.5) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- increase common version for oci fixes
|
||||||
|
|
||||||
|
|
||||||
|
## [authentik-19.1.4](https://github.com/truecharts/charts/compare/authentik-19.1.3...authentik-19.1.4) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16734](https://github.com/truecharts/charts/issues/16734))
|
||||||
|
|
||||||
|
- remove non-existent template refs ([#16738](https://github.com/truecharts/charts/issues/16738))
|
||||||
|
|
||||||
|
|
||||||
|
## [authentik-19.1.3](https://github.com/truecharts/charts/compare/authentik-19.1.0...authentik-19.1.3) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.19[@4ebb688](https://github.com/4ebb688) by renovate ([#16733](https://github.com/truecharts/charts/issues/16733))
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
|
||||||
|
|
||||||
|
## [authentik-19.1.2](https://github.com/truecharts/charts/compare/authentik-19.1.0...authentik-19.1.2) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
## [authentik-19.1.0](https://github.com/truecharts/charts/compare/authentik-19.0.5...authentik-19.1.0) (2023-12-30)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general minor by renovate ([#16579](https://github.com/truecharts/charts/issues/16579))
|
||||||
|
|
||||||
|
## [authentik-19.0.5](https://github.com/truecharts/charts/compare/authentik-19.0.4...authentik-19.0.5) (2023-12-27)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16560](https://github.com/truecharts/charts/issues/16560))
|
||||||
|
|
||||||
|
## [authentik-19.0.4](https://github.com/truecharts/charts/compare/authentik-19.0.1...authentik-19.0.4) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update authentik to v2023.10.5[@4f0722d](https://github.com/4f0722d) by renovate (patch) ([#16456](https://github.com/truecharts/charts/issues/16456))
|
||||||
|
|
||||||
|
## [authentik-19.0.1](https://github.com/truecharts/charts/compare/authentik-19.0.0...authentik-19.0.1) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16545](https://github.com/truecharts/charts/issues/16545))
|
||||||
|
|
||||||
|
## [authentik-19.0.0](https://github.com/truecharts/charts/compare/authentik-18.0.0...authentik-19.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
|
@ -0,0 +1,44 @@
|
||||||
|
kubeVersion: ">=1.24.0-0"
|
||||||
|
apiVersion: v2
|
||||||
|
name: authentik
|
||||||
|
version: 19.1.6
|
||||||
|
appVersion: 2023.10.4
|
||||||
|
description: Authentik is an open-source Identity Provider focused on flexibility and versatility.
|
||||||
|
home: https://truecharts.org/charts/stable/authentik
|
||||||
|
icon: https://truecharts.org/img/hotlink-ok/chart-icons/authentik.png
|
||||||
|
deprecated: false
|
||||||
|
sources:
|
||||||
|
- https://goauthentik.io/docs/
|
||||||
|
- https://github.com/goauthentik/authentik
|
||||||
|
- https://github.com/truecharts/charts/tree/master/charts/stable/authentik
|
||||||
|
- https://ghcr.io/goauthentik/proxy
|
||||||
|
maintainers:
|
||||||
|
- name: TrueCharts
|
||||||
|
email: info@truecharts.org
|
||||||
|
url: https://truecharts.org
|
||||||
|
keywords:
|
||||||
|
- authentik
|
||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
version: 17.2.21
|
||||||
|
repository: oci://tccr.io/truecharts
|
||||||
|
condition: ""
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
- name: redis
|
||||||
|
version: 11.1.5
|
||||||
|
repository: https://deps.truecharts.org
|
||||||
|
condition: redis.enabled
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
annotations:
|
||||||
|
max_scale_version: 23.10.2
|
||||||
|
min_scale_version: 23.10.0
|
||||||
|
truecharts.org/SCALE-support: "true"
|
||||||
|
truecharts.org/category: authentication
|
||||||
|
truecharts.org/max_helm_version: "3.13"
|
||||||
|
truecharts.org/min_helm_version: "3.12"
|
||||||
|
truecharts.org/train: stable
|
||||||
|
type: application
|
|
@ -0,0 +1,106 @@
|
||||||
|
Business Source License 1.1
|
||||||
|
|
||||||
|
Parameters
|
||||||
|
|
||||||
|
Licensor: The TrueCharts Project, it's owner and it's contributors
|
||||||
|
Licensed Work: The TrueCharts "Blocky" Helm Chart
|
||||||
|
Additional Use Grant: You may use the licensed work in production, as long
|
||||||
|
as it is directly sourced from a TrueCharts provided
|
||||||
|
official repository, catalog or source. You may also make private
|
||||||
|
modification to the directly sourced licenced work,
|
||||||
|
when used in production.
|
||||||
|
|
||||||
|
The following cases are, due to their nature, also
|
||||||
|
defined as 'production use' and explicitly prohibited:
|
||||||
|
- Bundling, including or displaying the licensed work
|
||||||
|
with(in) another work intended for production use,
|
||||||
|
with the apparent intend of facilitating and/or
|
||||||
|
promoting production use by third parties in
|
||||||
|
violation of this license.
|
||||||
|
|
||||||
|
Change Date: 2050-01-01
|
||||||
|
|
||||||
|
Change License: 3-clause BSD license
|
||||||
|
|
||||||
|
For information about alternative licensing arrangements for the Software,
|
||||||
|
please contact: legal@truecharts.org
|
||||||
|
|
||||||
|
Notice
|
||||||
|
|
||||||
|
The Business Source License (this document, or the “License”) is not an Open
|
||||||
|
Source license. However, the Licensed Work will eventually be made available
|
||||||
|
under an Open Source License, as stated in this License.
|
||||||
|
|
||||||
|
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
||||||
|
“Business Source License” is a trademark of MariaDB Corporation Ab.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Business Source License 1.1
|
||||||
|
|
||||||
|
Terms
|
||||||
|
|
||||||
|
The Licensor hereby grants you the right to copy, modify, create derivative
|
||||||
|
works, redistribute, and make non-production use of the Licensed Work. The
|
||||||
|
Licensor may make an Additional Use Grant, above, permitting limited
|
||||||
|
production use.
|
||||||
|
|
||||||
|
Effective on the Change Date, or the fourth anniversary of the first publicly
|
||||||
|
available distribution of a specific version of the Licensed Work under this
|
||||||
|
License, whichever comes first, the Licensor hereby grants you rights under
|
||||||
|
the terms of the Change License, and the rights granted in the paragraph
|
||||||
|
above terminate.
|
||||||
|
|
||||||
|
If your use of the Licensed Work does not comply with the requirements
|
||||||
|
currently in effect as described in this License, you must purchase a
|
||||||
|
commercial license from the Licensor, its affiliated entities, or authorized
|
||||||
|
resellers, or you must refrain from using the Licensed Work.
|
||||||
|
|
||||||
|
All copies of the original and modified Licensed Work, and derivative works
|
||||||
|
of the Licensed Work, are subject to this License. This License applies
|
||||||
|
separately for each version of the Licensed Work and the Change Date may vary
|
||||||
|
for each version of the Licensed Work released by Licensor.
|
||||||
|
|
||||||
|
You must conspicuously display this License on each original or modified copy
|
||||||
|
of the Licensed Work. If you receive the Licensed Work in original or
|
||||||
|
modified form from a third party, the terms and conditions set forth in this
|
||||||
|
License apply to your use of that work.
|
||||||
|
|
||||||
|
Any use of the Licensed Work in violation of this License will automatically
|
||||||
|
terminate your rights under this License for the current and all other
|
||||||
|
versions of the Licensed Work.
|
||||||
|
|
||||||
|
This License does not grant you any right in any trademark or logo of
|
||||||
|
Licensor or its affiliates (provided that you may use a trademark or logo of
|
||||||
|
Licensor as expressly required by this License).
|
||||||
|
|
||||||
|
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
||||||
|
AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
||||||
|
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
||||||
|
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
||||||
|
TITLE.
|
||||||
|
|
||||||
|
MariaDB hereby grants you permission to use this License’s text to license
|
||||||
|
your works, and to refer to it using the trademark “Business Source License”,
|
||||||
|
as long as you comply with the Covenants of Licensor below.
|
||||||
|
|
||||||
|
Covenants of Licensor
|
||||||
|
|
||||||
|
In consideration of the right to use this License’s text and the “Business
|
||||||
|
Source License” name and trademark, Licensor covenants to MariaDB, and to all
|
||||||
|
other recipients of the licensed work to be provided by Licensor:
|
||||||
|
|
||||||
|
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
||||||
|
or a license that is compatible with GPL Version 2.0 or a later version,
|
||||||
|
where “compatible” means that software provided under the Change License can
|
||||||
|
be included in a program with software provided under GPL Version 2.0 or a
|
||||||
|
later version. Licensor may specify additional Change Licenses without
|
||||||
|
limitation.
|
||||||
|
|
||||||
|
2. To either: (a) specify an additional grant of rights to use that does not
|
||||||
|
impose any additional restriction on the right granted in this License, as
|
||||||
|
the Additional Use Grant; or (b) insert the text “None”.
|
||||||
|
|
||||||
|
3. To specify a Change Date.
|
||||||
|
|
||||||
|
4. Not to modify this License in any other way.
|
|
@ -0,0 +1,28 @@
|
||||||
|
---
|
||||||
|
title: README
|
||||||
|
---
|
||||||
|
|
||||||
|
## General Info
|
||||||
|
|
||||||
|
TrueCharts can be installed as both _normal_ Helm Charts or as Apps on TrueNAS SCALE.
|
||||||
|
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||||
|
|
||||||
|
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/authentik)
|
||||||
|
|
||||||
|
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||||
|
- See the [Website](https://truecharts.org)
|
||||||
|
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||||
|
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Sponsor TrueCharts
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||||
|
|
||||||
|
_All Rights Reserved - The TrueCharts Project_
|
|
@ -0,0 +1,9 @@
|
||||||
|
|
||||||
|
|
||||||
|
## [authentik-19.1.6](https://github.com/truecharts/charts/compare/authentik-19.1.5...authentik-19.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
|
@ -0,0 +1,8 @@
|
||||||
|
Authentik is an open-source Identity Provider focused on flexibility and versatility.
|
||||||
|
|
||||||
|
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/stable/authentik](https://truecharts.org/charts/stable/authentik)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
Binary file not shown.
|
@ -0,0 +1,502 @@
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/goauthentik/server
|
||||||
|
tag: 2023.10.5@sha256:f019439323ae8ffb88771584641072ffb64079a895d8d15ee7ada2da210de2a1
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
geoipImage:
|
||||||
|
repository: ghcr.io/maxmind/geoipupdate
|
||||||
|
tag: v6.0.0@sha256:e0d5c1dee7379d360e0f355557542d9672c616215dfdd5aaf917382de84cb84c
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
ldapImage:
|
||||||
|
repository: ghcr.io/goauthentik/ldap
|
||||||
|
tag: 2023.10.5@sha256:4f0722da4bd67e4bd261154556bc93d461c0b0f3784ab907c4177504140e5322
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
radiusImage:
|
||||||
|
repository: ghcr.io/goauthentik/radius
|
||||||
|
tag: 2023.10.5@sha256:ff441574d4a8a46eeb43c588349e73e8c6d9280cab45fb2370e4ce8a3d88b359
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
proxyImage:
|
||||||
|
repository: ghcr.io/goauthentik/proxy
|
||||||
|
tag: 2023.10.5@sha256:9c6b34471c38380a559e409e02ec860f43b599eba7487949be5dd9cafa9b8db3
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
authentik:
|
||||||
|
credentials:
|
||||||
|
# Only works on initial install
|
||||||
|
email: my-mail@example.com
|
||||||
|
password: my-password
|
||||||
|
# Optional, only set if you want to use it
|
||||||
|
bootstrapToken: ""
|
||||||
|
general:
|
||||||
|
disableUpdateCheck: false
|
||||||
|
disableStartupAnalytics: true
|
||||||
|
allowUserChangeName: true
|
||||||
|
allowUserChangeEmail: true
|
||||||
|
allowUserChangeUsername: true
|
||||||
|
overwriteDefaultBlueprints: false
|
||||||
|
gdprCompliance: true
|
||||||
|
tokenLength: 128
|
||||||
|
impersonation: true
|
||||||
|
avatars:
|
||||||
|
- gravatar
|
||||||
|
- initials
|
||||||
|
footerLinks:
|
||||||
|
- name: Authentik
|
||||||
|
href: https://goauthentik.io
|
||||||
|
email:
|
||||||
|
host: ""
|
||||||
|
port: 587
|
||||||
|
username:
|
||||||
|
password:
|
||||||
|
useTLS: true
|
||||||
|
useSSL: false
|
||||||
|
timeout: 10
|
||||||
|
from: ""
|
||||||
|
ldap:
|
||||||
|
tlsCiphers: "null"
|
||||||
|
taskTimeoutHours: 2
|
||||||
|
logging:
|
||||||
|
# info, debug, warning, error, trace
|
||||||
|
logLevel: info
|
||||||
|
errorReporting:
|
||||||
|
enabled: false
|
||||||
|
sendPII: false
|
||||||
|
environment: customer
|
||||||
|
sentryDSN: ""
|
||||||
|
geoip:
|
||||||
|
enabled: false
|
||||||
|
# Ignored if enabled is true
|
||||||
|
# If enabled is false, and this is true, the
|
||||||
|
# built-in GeoIP database will be wiped
|
||||||
|
wipeBuiltInDb: false
|
||||||
|
editionID: GeoLite2-City
|
||||||
|
frequency: 8
|
||||||
|
accountID: ""
|
||||||
|
licenseKey: ""
|
||||||
|
outposts:
|
||||||
|
proxy:
|
||||||
|
enabled: false
|
||||||
|
token: ""
|
||||||
|
radius:
|
||||||
|
enabled: false
|
||||||
|
token: ""
|
||||||
|
ldap:
|
||||||
|
enabled: false
|
||||||
|
token: ""
|
||||||
|
# ===== DO NOT EDIT BELOW THIS LINE =====
|
||||||
|
workload:
|
||||||
|
# ===== Server =====
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
type: Deployment
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
primary: true
|
||||||
|
imageSelector: image
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
# readOnlyRootFilesystem: false
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: server
|
||||||
|
- secretRef:
|
||||||
|
name: server-worker
|
||||||
|
- configMapRef:
|
||||||
|
name: server-worker
|
||||||
|
args:
|
||||||
|
- server
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /lifecycle/ak
|
||||||
|
- healthcheck
|
||||||
|
readiness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /lifecycle/ak
|
||||||
|
- healthcheck
|
||||||
|
startup:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /lifecycle/ak
|
||||||
|
- healthcheck
|
||||||
|
# ===== Worker =====
|
||||||
|
worker:
|
||||||
|
enabled: true
|
||||||
|
type: Deployment
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
worker:
|
||||||
|
enabled: true
|
||||||
|
primary: true
|
||||||
|
imageSelector: image
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
# readOnlyRootFilesystem: false
|
||||||
|
envFrom:
|
||||||
|
- secretRef:
|
||||||
|
name: server-worker
|
||||||
|
- configMapRef:
|
||||||
|
name: server-worker
|
||||||
|
args:
|
||||||
|
- worker
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /lifecycle/ak
|
||||||
|
- healthcheck
|
||||||
|
readiness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /lifecycle/ak
|
||||||
|
- healthcheck
|
||||||
|
startup:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /lifecycle/ak
|
||||||
|
- healthcheck
|
||||||
|
# ===== PROXY =====
|
||||||
|
proxy:
|
||||||
|
enabled: true
|
||||||
|
type: Deployment
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
proxy:
|
||||||
|
enabled: true
|
||||||
|
primary: true
|
||||||
|
imageSelector: proxyImage
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: proxy
|
||||||
|
- secretRef:
|
||||||
|
name: proxy
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /proxy
|
||||||
|
- healthcheck
|
||||||
|
readiness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /proxy
|
||||||
|
- healthcheck
|
||||||
|
startup:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /proxy
|
||||||
|
- healthcheck
|
||||||
|
# ===== RADIUS =====
|
||||||
|
radius:
|
||||||
|
enabled: true
|
||||||
|
type: Deployment
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
radius:
|
||||||
|
enabled: true
|
||||||
|
primary: true
|
||||||
|
imageSelector: radiusImage
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: radius
|
||||||
|
- secretRef:
|
||||||
|
name: radius
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /radius
|
||||||
|
- healthcheck
|
||||||
|
readiness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /radius
|
||||||
|
- healthcheck
|
||||||
|
startup:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /radius
|
||||||
|
- healthcheck
|
||||||
|
# ===== LDAP =====
|
||||||
|
ldap:
|
||||||
|
enabled: true
|
||||||
|
type: Deployment
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
ldap:
|
||||||
|
enabled: true
|
||||||
|
primary: true
|
||||||
|
imageSelector: ldapImage
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: ldap
|
||||||
|
- secretRef:
|
||||||
|
name: ldap
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /ldap
|
||||||
|
- healthcheck
|
||||||
|
readiness:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /ldap
|
||||||
|
- healthcheck
|
||||||
|
startup:
|
||||||
|
enabled: true
|
||||||
|
type: exec
|
||||||
|
command:
|
||||||
|
- /ldap
|
||||||
|
- healthcheck
|
||||||
|
# ===== GeoIP Updater =====
|
||||||
|
geoip:
|
||||||
|
enabled: true
|
||||||
|
type: Deployment
|
||||||
|
podSpec:
|
||||||
|
containers:
|
||||||
|
geoip:
|
||||||
|
enabled: true
|
||||||
|
primary: true
|
||||||
|
imageSelector: geoipImage
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 0
|
||||||
|
runAsGroup: 0
|
||||||
|
capabilities:
|
||||||
|
disableS6Caps: true
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: geoip
|
||||||
|
- secretRef:
|
||||||
|
name: geoip
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: false
|
||||||
|
readiness:
|
||||||
|
enabled: false
|
||||||
|
startup:
|
||||||
|
enabled: false
|
||||||
|
service:
|
||||||
|
# Server HTTPS
|
||||||
|
main:
|
||||||
|
ports:
|
||||||
|
main:
|
||||||
|
protocol: https
|
||||||
|
port: 10229
|
||||||
|
# Server HTTP
|
||||||
|
http:
|
||||||
|
enabled: true
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
http:
|
||||||
|
enabled: true
|
||||||
|
protocol: http
|
||||||
|
port: 10230
|
||||||
|
# Proxy
|
||||||
|
proxy:
|
||||||
|
enabled: true
|
||||||
|
targetSelector: proxy
|
||||||
|
ports:
|
||||||
|
http:
|
||||||
|
enabled: true
|
||||||
|
protocol: http
|
||||||
|
port: 10227
|
||||||
|
targetSelector: proxy
|
||||||
|
https:
|
||||||
|
enabled: true
|
||||||
|
protocol: https
|
||||||
|
port: 10228
|
||||||
|
targetSelector: proxy
|
||||||
|
# Radius
|
||||||
|
radius:
|
||||||
|
enabled: true
|
||||||
|
targetSelector: radius
|
||||||
|
ports:
|
||||||
|
radius:
|
||||||
|
enabled: true
|
||||||
|
protocol: udp
|
||||||
|
targetSelector: radius
|
||||||
|
port: 1812
|
||||||
|
# LDAP
|
||||||
|
ldap:
|
||||||
|
enabled: true
|
||||||
|
targetSelector: ldap
|
||||||
|
ports:
|
||||||
|
ldap:
|
||||||
|
enabled: true
|
||||||
|
port: 389
|
||||||
|
targetSelector: ldap
|
||||||
|
# LDAPS
|
||||||
|
ldaps:
|
||||||
|
enabled: true
|
||||||
|
targetSelector: ldap
|
||||||
|
ports:
|
||||||
|
ldaps:
|
||||||
|
enabled: true
|
||||||
|
port: 636
|
||||||
|
targetSelector: ldap
|
||||||
|
# Server Metrics
|
||||||
|
servermetrics:
|
||||||
|
enabled: true
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
servermetrics:
|
||||||
|
enabled: true
|
||||||
|
protocol: http
|
||||||
|
port: 10231
|
||||||
|
# Radius Metrics
|
||||||
|
radiusmetrics:
|
||||||
|
enabled: true
|
||||||
|
type: ClusterIP
|
||||||
|
targetSelector: radius
|
||||||
|
ports:
|
||||||
|
radiusmetrics:
|
||||||
|
enabled: true
|
||||||
|
protocol: http
|
||||||
|
port: 10232
|
||||||
|
targetSelector: radius
|
||||||
|
# LDAP Metrics
|
||||||
|
ldapmetrics:
|
||||||
|
enabled: true
|
||||||
|
type: ClusterIP
|
||||||
|
targetSelector: ldap
|
||||||
|
ports:
|
||||||
|
ldapmetrics:
|
||||||
|
enabled: true
|
||||||
|
protocol: http
|
||||||
|
port: 10233
|
||||||
|
targetSelector: ldap
|
||||||
|
# Proxy Metrics
|
||||||
|
proxymetrics:
|
||||||
|
enabled: true
|
||||||
|
type: ClusterIP
|
||||||
|
targetSelector: proxy
|
||||||
|
ports:
|
||||||
|
proxymetrics:
|
||||||
|
enabled: true
|
||||||
|
protocol: http
|
||||||
|
port: 10234
|
||||||
|
targetSelector: proxy
|
||||||
|
persistence:
|
||||||
|
media:
|
||||||
|
enabled: true
|
||||||
|
targetSelector:
|
||||||
|
main:
|
||||||
|
main:
|
||||||
|
mountPath: /media
|
||||||
|
worker:
|
||||||
|
worker:
|
||||||
|
mountPath: /media
|
||||||
|
templates:
|
||||||
|
enabled: true
|
||||||
|
targetSelector:
|
||||||
|
main:
|
||||||
|
main:
|
||||||
|
mountPath: /templates
|
||||||
|
worker:
|
||||||
|
worker:
|
||||||
|
mountPath: /templates
|
||||||
|
blueprints:
|
||||||
|
enabled: true
|
||||||
|
targetSelector:
|
||||||
|
worker:
|
||||||
|
worker:
|
||||||
|
# This will automatically change to `/blueprints`
|
||||||
|
# if `overwriteDefaultBlueprints` is set to `true
|
||||||
|
# Otherwise it will respect the value specified here
|
||||||
|
mountPath: /blueprints/custom
|
||||||
|
certs:
|
||||||
|
enabled: true
|
||||||
|
mountPath: /certs
|
||||||
|
targetSelector:
|
||||||
|
worker:
|
||||||
|
worker:
|
||||||
|
mountPath: /certs
|
||||||
|
geoip:
|
||||||
|
enabled: true
|
||||||
|
targetSelector:
|
||||||
|
main:
|
||||||
|
main:
|
||||||
|
mountPath: /geoip
|
||||||
|
worker:
|
||||||
|
worker:
|
||||||
|
mountPath: /geoip
|
||||||
|
geoip:
|
||||||
|
geoip:
|
||||||
|
mountPath: /usr/share/GeoIP
|
||||||
|
cnpg:
|
||||||
|
main:
|
||||||
|
enabled: true
|
||||||
|
user: authentik
|
||||||
|
database: authentik
|
||||||
|
redis:
|
||||||
|
enabled: true
|
||||||
|
portal:
|
||||||
|
open:
|
||||||
|
enabled: true
|
||||||
|
metrics:
|
||||||
|
# FIXME: Metrics do not work yet
|
||||||
|
servermetrics:
|
||||||
|
enabled: true
|
||||||
|
type: servicemonitor
|
||||||
|
endpoints:
|
||||||
|
- port: "{{ .Values.service.servermetrics.ports.servermetrics.port }}"
|
||||||
|
path: /metrics
|
||||||
|
prometheusRule:
|
||||||
|
enabled: false
|
||||||
|
radiusmetrics:
|
||||||
|
enabled: true
|
||||||
|
type: servicemonitor
|
||||||
|
endpoints:
|
||||||
|
- port: "{{ .Values.service.radiusmetrics.ports.radiusmetrics.port }}"
|
||||||
|
path: /metrics
|
||||||
|
prometheusRule:
|
||||||
|
enabled: false
|
||||||
|
ldapmetrics:
|
||||||
|
enabled: true
|
||||||
|
type: servicemonitor
|
||||||
|
endpoints:
|
||||||
|
- port: "{{ .Values.service.ldapmetrics.ports.ldapmetrics.port }}"
|
||||||
|
path: /metrics
|
||||||
|
prometheusRule:
|
||||||
|
enabled: false
|
||||||
|
proxymetrics:
|
||||||
|
enabled: true
|
||||||
|
type: servicemonitor
|
||||||
|
endpoints:
|
||||||
|
- port: "{{ .Values.service.proxymetrics.ports.proxymetrics.port }}"
|
||||||
|
path: /metrics
|
||||||
|
prometheusRule:
|
||||||
|
enabled: false
|
||||||
|
updated: true
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
main:
|
||||||
|
required: true
|
File diff suppressed because it is too large
Load Diff
|
@ -0,0 +1,128 @@
|
||||||
|
{{/* Define the configmaps */}}
|
||||||
|
{{- define "authentik.configmaps" -}}
|
||||||
|
|
||||||
|
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||||
|
{{- $serverHost := printf "https://%v:%v" $fullname .Values.service.main.ports.main.port -}}
|
||||||
|
{{- $host := .Values.chartContext.appUrl }}
|
||||||
|
server:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.main.ports.main.port | quote }}
|
||||||
|
AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.http.ports.http.port | quote }}
|
||||||
|
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.servermetrics.ports.servermetrics.port | quote }}
|
||||||
|
|
||||||
|
server-worker:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
{{/* Dependencies */}}
|
||||||
|
AUTHENTIK_POSTGRESQL__NAME: {{ .Values.cnpg.main.database }}
|
||||||
|
AUTHENTIK_POSTGRESQL__USER: {{ .Values.cnpg.main.user }}
|
||||||
|
AUTHENTIK_POSTGRESQL__HOST: {{ .Values.cnpg.main.creds.host }}
|
||||||
|
AUTHENTIK_POSTGRESQL__PORT: "5432"
|
||||||
|
AUTHENTIK_REDIS__HOST: {{ .Values.redis.creds.plain }}
|
||||||
|
AUTHENTIK_REDIS__PORT: "6379"
|
||||||
|
|
||||||
|
{{/* Outposts */}}
|
||||||
|
AUTHENTIK_OUTPOSTS__DISCOVER: "false"
|
||||||
|
|
||||||
|
{{/* GeoIP */}}
|
||||||
|
{{- $geoipPath := (printf "/geoip/%v.mmdb" .Values.authentik.geoip.editionID) -}}
|
||||||
|
{{- if not .Values.authentik.geoip.enabled -}}
|
||||||
|
{{- $geoipPath = "/tmp/non-existent-file" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if or .Values.authentik.geoip.enabled .Values.authentik.geoip.wipeBuiltInDb }}
|
||||||
|
AUTHENTIK_GEOIP: {{ $geoipPath }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Mail */}}
|
||||||
|
AUTHENTIK_EMAIL__USE_TLS: {{ .Values.authentik.email.useTLS | quote }}
|
||||||
|
AUTHENTIK_EMAIL__USE_SSL: {{ .Values.authentik.email.useSSL | quote }}
|
||||||
|
{{- with .Values.authentik.email.port }}
|
||||||
|
AUTHENTIK_EMAIL__PORT: {{ . | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Values.authentik.email.timeout }}
|
||||||
|
AUTHENTIK_EMAIL__TIMEOUT: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* LDAP */}}
|
||||||
|
AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS: {{ .Values.authentik.ldap.taskTimeoutHours | quote }}
|
||||||
|
AUTHENTIK_LDAP__TLS__CIPHERS: {{ .Values.authentik.ldap.tlsCiphers | quote }}
|
||||||
|
|
||||||
|
{{/* Logging */}}
|
||||||
|
AUTHENTIK_LOG_LEVEL: {{ .Values.authentik.logging.logLevel }}
|
||||||
|
|
||||||
|
{{/* Error Reporting */}}
|
||||||
|
AUTHENTIK_ERROR_REPORTING__ENABLED: {{ .Values.authentik.errorReporting.enabled | quote }}
|
||||||
|
AUTHENTIK_ERROR_REPORTING__SEND_PII: {{ .Values.authentik.errorReporting.sendPII | quote }}
|
||||||
|
{{- with .Values.authentik.errorReporting.environment }}
|
||||||
|
AUTHENTIK_ERROR_REPORTING__ENVIRONMENT: {{ . | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Values.authentik.errorReporting.sentryDSN }}
|
||||||
|
AUTHENTIK_ERROR_REPORTING__SENTRY_DSN: {{ . | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Values.authentik.general.avatars }}
|
||||||
|
AUTHENTIK_AVATARS: {{ join "," . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Values.authentik.general.footerLinks }}
|
||||||
|
AUTHENTIK_FOOTER_LINKS: {{ toJson . | squote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* General */}}
|
||||||
|
AUTHENTIK_DISABLE_UPDATE_CHECK: {{ .Values.authentik.general.disableUpdateCheck | quote }}
|
||||||
|
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: {{ .Values.authentik.general.disableStartupAnalytics | quote }}
|
||||||
|
AUTHENTIK_DEFAULT_USER_CHANGE_NAME: {{ .Values.authentik.general.allowUserChangeName | quote }}
|
||||||
|
AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL: {{ .Values.authentik.general.allowUserChangeEmail | quote }}
|
||||||
|
AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: {{ .Values.authentik.general.allowUserChangeUsername | quote }}
|
||||||
|
AUTHENTIK_GDPR_COMPLIANCE: {{ .Values.authentik.general.gdprCompliance | quote }}
|
||||||
|
AUTHENTIK_DEFAULT_TOKEN_LENGTH: {{ .Values.authentik.general.tokenLength | quote }}
|
||||||
|
AUTHENTIK_IMPERSONATION: {{ .Values.authentik.general.impersonation | quote }}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.proxy.enabled }}
|
||||||
|
proxy:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.http.port | quote }}
|
||||||
|
AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.https.port | quote }}
|
||||||
|
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.proxymetrics.ports.proxymetrics.port | quote }}
|
||||||
|
AUTHENTIK_HOST: {{ $serverHost }}
|
||||||
|
AUTHENTIK_INSECURE: "true"
|
||||||
|
# TODO: node ip or ingress host
|
||||||
|
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.radius.enabled }}
|
||||||
|
radius:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
AUTHENTIK_LISTEN__RADIUS: {{ printf "0.0.0.0:%v" .Values.service.radius.ports.radius.port | quote }}
|
||||||
|
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.radiusmetrics.ports.radiusmetrics.port | quote }}
|
||||||
|
AUTHENTIK_HOST: {{ $serverHost }}
|
||||||
|
AUTHENTIK_INSECURE: "true"
|
||||||
|
# TODO: node ip or ingress host
|
||||||
|
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.ldap.enabled }}
|
||||||
|
ldap:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
AUTHENTIK_LISTEN__LDAP: {{ printf "0.0.0.0:%v" .Values.service.ldap.ports.ldap.port | quote }}
|
||||||
|
AUTHENTIK_LISTEN__LDAPS: {{ printf "0.0.0.0:%v" .Values.service.ldaps.ports.ldaps.port | quote }}
|
||||||
|
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.ldapmetrics.ports.ldapmetrics.port | quote }}
|
||||||
|
AUTHENTIK_HOST: {{ $serverHost }}
|
||||||
|
AUTHENTIK_INSECURE: "true"
|
||||||
|
# TODO: node ip or ingress host
|
||||||
|
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.geoip.enabled }}
|
||||||
|
geoip:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
GEOIPUPDATE_EDITION_IDS: {{ .Values.authentik.geoip.editionID }}
|
||||||
|
GEOIPUPDATE_FREQUENCY: {{ .Values.authentik.geoip.frequency | quote }}
|
||||||
|
GEOIPUPDATE_DB_DIR: {{ .Values.persistence.geoip.targetSelector.geoip.geoip.mountPath | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,74 @@
|
||||||
|
{{/* Define the secrets */}}
|
||||||
|
{{- define "authentik.secrets" -}}
|
||||||
|
|
||||||
|
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||||
|
{{- $fetchname := printf "%v-server-worker" $fullname -}}
|
||||||
|
|
||||||
|
{{- $secretKey := randAlphaNum 32 -}}
|
||||||
|
{{- with (lookup "v1" "Secret" .Release.Namespace $fetchname) -}}
|
||||||
|
{{- $secretKey = index .data "AUTHENTIK_SECRET_KEY" | b64dec -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
server-worker:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
{{/* Dependencies */}}
|
||||||
|
AUTHENTIK_POSTGRESQL__PASSWORD: {{ .Values.cnpg.main.creds.password | trimAll "\"" }}
|
||||||
|
AUTHENTIK_REDIS__PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }}
|
||||||
|
|
||||||
|
{{/* Secret Key */}}
|
||||||
|
AUTHENTIK_SECRET_KEY: {{ $secretKey }}
|
||||||
|
|
||||||
|
{{/* Initial credentials */}}
|
||||||
|
AUTHENTIK_BOOTSTRAP_EMAIL: {{ .Values.authentik.credentials.email | quote }}
|
||||||
|
AUTHENTIK_BOOTSTRAP_PASSWORD: {{ .Values.authentik.credentials.password | quote }}
|
||||||
|
{{- with .Values.authentik.credentials.bootstrapToken }}
|
||||||
|
AUTHENTIK_BOOTSTRAP_TOKEN: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Mail */}}
|
||||||
|
{{- with .Values.authentik.email.host }}
|
||||||
|
AUTHENTIK_EMAIL__HOST: {{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Values.authentik.email.username }}
|
||||||
|
AUTHENTIK_EMAIL__USERNAME: {{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Values.authentik.email.password }}
|
||||||
|
AUTHENTIK_EMAIL__PASSWORD: {{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Values.authentik.email.from }}
|
||||||
|
AUTHENTIK_EMAIL__FROM: {{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.geoip.enabled }}
|
||||||
|
geoip:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
GEOIPUPDATE_VERBOSE: "0"
|
||||||
|
GEOIPUPDATE_PRESERVE_FILE_TIMES: "1"
|
||||||
|
GEOIPUPDATE_ACCOUNT_ID: {{ .Values.authentik.geoip.accountID | quote }}
|
||||||
|
GEOIPUPDATE_LICENSE_KEY: {{ .Values.authentik.geoip.licenseKey | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.proxy.enabled }}
|
||||||
|
proxy:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.proxy.token | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.radius.enabled }}
|
||||||
|
radius:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.radius.token | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.ldap.enabled }}
|
||||||
|
ldap:
|
||||||
|
enabled: true
|
||||||
|
data:
|
||||||
|
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.ldap.token | quote }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,23 @@
|
||||||
|
{{- define "authentik.validation" -}}
|
||||||
|
{{- range $outpost, $values := .Values.authentik.outposts -}}
|
||||||
|
{{- if (kindIs "dict" $values) -}}
|
||||||
|
{{- if and $values.enabled (not $values.token) -}}
|
||||||
|
{{- fail (printf "Authentik - Outpost [%v] is enabled, but [token] was not provided" ($outpost | upper)) -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.geoip.enabled -}}
|
||||||
|
{{- if not .Values.authentik.geoip.accountID -}}
|
||||||
|
{{- fail "Authentik - GeoIP is enabled but [accountID] was not provided" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if not .Values.authentik.geoip.licenseKey -}}
|
||||||
|
{{- fail "Authentik - GeoIP is enabled but [licenseKey] was not provided" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if contains " " .Values.authentik.geoip.editionID -}}
|
||||||
|
{{- fail "Authentik - GeoIP is enabled but [editionID] cannot contain spaces" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,20 @@
|
||||||
|
{{- define "authentik.wait.server" -}}
|
||||||
|
{{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $) -}}
|
||||||
|
{{- $serverUrl := printf "https://%v:%v/-/health/ready/" $fullname .Values.service.main.ports.main.port }}
|
||||||
|
enabled: true
|
||||||
|
type: init
|
||||||
|
imageSelector: alpineImage
|
||||||
|
command: /bin/sh
|
||||||
|
args:
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
echo "Waiting Authentik Server [{{ $serverUrl }}] to be ready..."
|
||||||
|
until wget --no-check-certificate --spider --quiet "{{ $serverUrl }}";
|
||||||
|
do
|
||||||
|
echo "Waiting Authentik Server [{{ $serverUrl }}] to be ready..."
|
||||||
|
sleep 3
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "Authentik [{{ $serverUrl }}] is ready..."
|
||||||
|
echo "Starting Outpost..."
|
||||||
|
{{- end -}}
|
|
@ -0,0 +1,97 @@
|
||||||
|
{{/* Make sure all variables are set properly */}}
|
||||||
|
{{- include "tc.v1.common.loader.init" . }}
|
||||||
|
|
||||||
|
{{- include "authentik.validation" $ -}}
|
||||||
|
|
||||||
|
{{/* Render secrets for authentik and friends */}}
|
||||||
|
{{- $secrets := include "authentik.secrets" . | fromYaml -}}
|
||||||
|
{{- if $secrets -}}
|
||||||
|
{{ $secrets := (mustMergeOverwrite .Values.secret $secrets) }}
|
||||||
|
{{- $_ := set .Values "secret" $secrets -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* Render configmaps for authentik and friends */}}
|
||||||
|
{{- $configmaps := include "authentik.configmaps" . | fromYaml -}}
|
||||||
|
{{- if $configmaps -}}
|
||||||
|
{{ $configmaps := (mustMergeOverwrite .Values.configmap $configmaps) }}
|
||||||
|
{{- $_ := set .Values "configmap" $configmaps -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.general.overwriteDefaultBlueprints -}}
|
||||||
|
{{- $_ := set .Values.persistence.blueprints.targetSelector.worker.worker "mountPath" "/blueprints" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.geoip.enabled -}}
|
||||||
|
{{- $_ := set .Values.workload.geoip "enabled" true -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $_ := set .Values.workload.geoip "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.persistence.geoip "enabled" false -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if or .Values.authentik.geoip.enabled .Values.authentik.geoip.wipeBuiltInDb -}}
|
||||||
|
{{- $_ := set .Values.persistence.geoip "enabled" true -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.proxy.enabled -}}
|
||||||
|
{{- $_ := set .Values.workload.proxy "enabled" true -}}
|
||||||
|
{{- if not .Values.workload.proxy.podSpec.initContainers -}}
|
||||||
|
{{- $_ := set .Values.workload.proxy.podSpec "initContainers" dict -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- $_ := set .Values.workload.proxy.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||||
|
{{- $_ := set .Values.service.proxy "enabled" true -}}
|
||||||
|
{{- $_ := set .Values.service.proxymetrics "enabled" true -}}
|
||||||
|
{{- $_ := set .Values.metrics.proxymetrics "enabled" true -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $_ := set .Values.workload.proxy "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.proxy "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.proxymetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.metrics.proxymetrics "enabled" false -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.radius.enabled -}}
|
||||||
|
{{- $_ := set .Values.workload.radius "enabled" true -}}
|
||||||
|
{{- if not .Values.workload.radius.podSpec.initContainers -}}
|
||||||
|
{{- $_ := set .Values.workload.radius.podSpec "initContainers" dict -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- $_ := set .Values.workload.radius.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||||
|
{{- $_ := set .Values.service.radius "enabled" true -}}
|
||||||
|
{{- $_ := set .Values.service.radiusmetrics "enabled" true -}}
|
||||||
|
{{- $_ := set .Values.metrics.radiusmetrics "enabled" true -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $_ := set .Values.workload.radius "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.radius "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.radiusmetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.metrics.radiusmetrics "enabled" false -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if .Values.authentik.outposts.ldap.enabled -}}
|
||||||
|
{{- $_ := set .Values.workload.ldap "enabled" true -}}
|
||||||
|
{{- if not .Values.workload.ldap.podSpec.initContainers -}}
|
||||||
|
{{- $_ := set .Values.workload.ldap.podSpec "initContainers" dict -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- $_ := set .Values.workload.ldap.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||||
|
{{- $_ := set .Values.service.ldap "enabled" true -}}
|
||||||
|
{{- $_ := set .Values.service.ldaps "enabled" true -}}
|
||||||
|
{{- $_ := set .Values.service.ldapmetrics "enabled" true -}}
|
||||||
|
{{- $_ := set .Values.metrics.ldapmetrics "enabled" true -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $_ := set .Values.workload.ldap "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.ldap "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.ldaps "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.ldapmetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.metrics.ldapmetrics "enabled" false -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/* FIXME: See values.yaml */}}
|
||||||
|
{{- $_ := set .Values.service.servermetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.proxymetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.radiusmetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.service.ldapmetrics "enabled" false -}}
|
||||||
|
|
||||||
|
{{- $_ := set .Values.metrics.servermetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.metrics.proxymetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.metrics.radiusmetrics "enabled" false -}}
|
||||||
|
{{- $_ := set .Values.metrics.ldapmetrics "enabled" false -}}
|
||||||
|
|
||||||
|
{{/* Render the templates */}}
|
||||||
|
{{ include "tc.v1.common.loader.apply" . }}
|
|
@ -0,0 +1,99 @@
|
||||||
|
---
|
||||||
|
title: Changelog
|
||||||
|
---
|
||||||
|
|
||||||
|
**Important:**
|
||||||
|
*for the complete changelog, please refer to the website*
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## [baserow-11.1.6](https://github.com/truecharts/charts/compare/baserow-11.1.5...baserow-11.1.6) (2024-01-02)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16743](https://github.com/truecharts/charts/issues/16743))
|
||||||
|
|
||||||
|
|
||||||
|
## [baserow-11.1.5](https://github.com/truecharts/charts/compare/baserow-11.1.4...baserow-11.1.5) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- increase common version for oci fixes
|
||||||
|
|
||||||
|
|
||||||
|
## [baserow-11.1.4](https://github.com/truecharts/charts/compare/baserow-11.1.3...baserow-11.1.4) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16734](https://github.com/truecharts/charts/issues/16734))
|
||||||
|
|
||||||
|
- remove non-existent template refs ([#16738](https://github.com/truecharts/charts/issues/16738))
|
||||||
|
|
||||||
|
|
||||||
|
## [baserow-11.1.3](https://github.com/truecharts/charts/compare/baserow-11.1.0...baserow-11.1.3) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.19[@4ebb688](https://github.com/4ebb688) by renovate ([#16733](https://github.com/truecharts/charts/issues/16733))
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
|
||||||
|
|
||||||
|
## [baserow-11.1.2](https://github.com/truecharts/charts/compare/baserow-11.1.0...baserow-11.1.2) (2024-01-01)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- bump all charts for OCI test push
|
||||||
|
|
||||||
|
- move everything to consume OCI-hosted common-chart dependency
|
||||||
|
|
||||||
|
- update container image common to v17.2.18[@085ba3c](https://github.com/085ba3c) by renovate ([#16732](https://github.com/truecharts/charts/issues/16732))
|
||||||
|
|
||||||
|
- standardize ./img references ([#16704](https://github.com/truecharts/charts/issues/16704))
|
||||||
|
|
||||||
|
- lints some docs, uses front-matter instead of # h1, and fix list items in changelog ([#16589](https://github.com/truecharts/charts/issues/16589))
|
||||||
|
## [baserow-11.1.0](https://github.com/truecharts/charts/compare/baserow-11.0.2...baserow-11.1.0) (2023-12-30)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general minor by renovate ([#16579](https://github.com/truecharts/charts/issues/16579))
|
||||||
|
|
||||||
|
## [baserow-11.0.2](https://github.com/truecharts/charts/compare/baserow-11.0.1...baserow-11.0.2) (2023-12-27)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16560](https://github.com/truecharts/charts/issues/16560))
|
||||||
|
|
||||||
|
## [baserow-11.0.1](https://github.com/truecharts/charts/compare/baserow-11.0.0...baserow-11.0.1) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general non-major by renovate ([#16545](https://github.com/truecharts/charts/issues/16545))
|
||||||
|
|
||||||
|
## [baserow-11.0.0](https://github.com/truecharts/charts/compare/baserow-10.0.0...baserow-11.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
||||||
|
|
||||||
|
- update helm general major by renovate (major) ([#16547](https://github.com/truecharts/charts/issues/16547))
|
||||||
|
|
||||||
|
## [baserow-11.0.0](https://github.com/truecharts/charts/compare/baserow-10.0.0...baserow-11.0.0) (2023-12-26)
|
||||||
|
|
||||||
|
### Chore
|
|
@ -0,0 +1,43 @@
|
||||||
|
kubeVersion: ">=1.24.0-0"
|
||||||
|
apiVersion: v2
|
||||||
|
name: baserow
|
||||||
|
version: 11.1.6
|
||||||
|
appVersion: 1.22.1
|
||||||
|
description: Baserow is an open source no-code database tool and Airtable alternative.
|
||||||
|
home: https://truecharts.org/charts/stable/baserow
|
||||||
|
icon: https://truecharts.org/img/hotlink-ok/chart-icons/baserow.png
|
||||||
|
deprecated: false
|
||||||
|
sources:
|
||||||
|
- https://gitlab.com/bramw/baserow/
|
||||||
|
- https://github.com/truecharts/charts/tree/master/charts/stable/baserow
|
||||||
|
- https://hub.docker.com/r/baserow/baserow
|
||||||
|
maintainers:
|
||||||
|
- name: TrueCharts
|
||||||
|
email: info@truecharts.org
|
||||||
|
url: https://truecharts.org
|
||||||
|
keywords:
|
||||||
|
- baserow
|
||||||
|
dependencies:
|
||||||
|
- name: common
|
||||||
|
version: 17.2.21
|
||||||
|
repository: oci://tccr.io/truecharts
|
||||||
|
condition: ""
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
- name: redis
|
||||||
|
version: 11.1.5
|
||||||
|
repository: https://deps.truecharts.org
|
||||||
|
condition: redis.enabled
|
||||||
|
alias: ""
|
||||||
|
tags: []
|
||||||
|
import-values: []
|
||||||
|
annotations:
|
||||||
|
max_scale_version: 23.10.2
|
||||||
|
min_scale_version: 23.10.0
|
||||||
|
truecharts.org/SCALE-support: "true"
|
||||||
|
truecharts.org/category: productivity
|
||||||
|
truecharts.org/max_helm_version: "3.13"
|
||||||
|
truecharts.org/min_helm_version: "3.12"
|
||||||
|
truecharts.org/train: stable
|
||||||
|
type: application
|
|
@ -0,0 +1,28 @@
|
||||||
|
---
|
||||||
|
title: README
|
||||||
|
---
|
||||||
|
|
||||||
|
## General Info
|
||||||
|
|
||||||
|
TrueCharts can be installed as both _normal_ Helm Charts or as Apps on TrueNAS SCALE.
|
||||||
|
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||||
|
|
||||||
|
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/baserow)
|
||||||
|
|
||||||
|
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||||
|
- See the [Website](https://truecharts.org)
|
||||||
|
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||||
|
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Sponsor TrueCharts
|
||||||
|
|
||||||
|
TrueCharts can only exist due to the incredible effort of our staff.
|
||||||
|
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||||
|
|
||||||
|
_All Rights Reserved - The TrueCharts Project_
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue