community-grafana
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
global:
2
# -- Overrides the Docker registry globally for all images
3
imageRegistry: null
4
# To help compatibility with other charts which use global.imagePullSecrets.
5
# Allow either an array of {name: pullSecret} maps (k8s-style), or an array of strings (more common helm-style).
6
# Can be templated.
7
# global:
8
# imagePullSecrets:
9
# - name: pullSecret1
10
# - name: pullSecret2
11
# or
12
# global:
13
# imagePullSecrets:
14
# - pullSecret1
15
# - pullSecret2
16
imagePullSecrets: []
17
rbac:
18
create: true
19
## Use an existing ClusterRole/Role (depending on rbac.namespaced false/true)
20
# useExistingRole: name-of-some-role
21
# useExistingClusterRole: name-of-some-clusterRole
22
pspEnabled: false
23
pspUseAppArmor: false
24
namespaced: false
25
# Only has an effect if namespaced: true is set
26
namespaces: []
27
extraRoleRules: []
28
# - apiGroups: []
29
# resources: []
30
# verbs: []
31
extraClusterRoleRules: []
32
# - apiGroups: []
33
# resources: []
34
# verbs: []
35
serviceAccount:
36
create: true
37
name: ""
38
nameTest: ""
39
## ServiceAccount labels.
40
labels: {}
41
## Service account annotations. Can be templated.
42
# annotations:
43
# eks.amazonaws.com/role-arn: arn:aws:iam::123456789000:role/iam-role-name-here
44
45
## autoMount is deprecated in favor of automountServiceAccountToken
46
# autoMount: false
47
automountServiceAccountToken: false
48
replicas: 1
49
## Create a headless service for the deployment
50
headlessService: false
51
## Should the service account be auto mounted on the pod
52
automountServiceAccountToken: true
53
## Create HorizontalPodAutoscaler object for deployment type
54
#
55
autoscaling:
56
enabled: false
57
minReplicas: 1
58
maxReplicas: 5
59
targetCPU: "60"
60
targetMemory: ""
61
behavior: {}
62
## See `kubectl explain poddisruptionbudget.spec` for more
63
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
64
podDisruptionBudget: {}
65
# apiVersion: ""
66
# minAvailable: 1
67
# maxUnavailable: 1
68
# unhealthyPodEvictionPolicy: IfHealthyBudget
69
70
## See `kubectl explain deployment.spec.strategy` for more
71
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
72
deploymentStrategy:
73
type: RollingUpdate
74
## The maximum time in seconds for a Deployment to make progress before it is considered to be failed.
75
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds
76
progressDeadlineSeconds: null
77
## Startup probe. Holds off the liveness and readiness probes until it succeeds, useful for slow starts.
78
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
79
startupProbe: {}
80
readinessProbe:
81
httpGet:
82
path: /api/health
83
port: grafana
84
livenessProbe:
85
httpGet:
86
path: /api/health
87
port: grafana
88
initialDelaySeconds: 60
89
timeoutSeconds: 30
90
failureThreshold: 10
91
## Use an alternate scheduler, e.g. "stork".
92
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
93
##
94
# schedulerName: "default-scheduler"
95
image:
96
# -- The Docker registry
97
registry: cgr.dev
98
# -- Docker image repository
99
repository: chainguard-private/grafana
100
# Overrides the Grafana image tag whose default is the chart appVersion
101
tag: v13.2.2-r1
102
sha: sha256:0d6815a9322efc793e4b8525d94d0266e9d3f555e666363e2387ec59e5d0227c
103
pullPolicy: IfNotPresent
104
## Optionally specify an array of imagePullSecrets.
105
## Secrets must be manually created in the namespace.
106
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
107
## Can be templated.
108
##
109
pullSecrets: []
110
# - myRegistrKeySecretName
111
testFramework:
112
enabled: true
113
## The type of Helm hook used to run this test. Defaults to test.
114
## ref: https://helm.sh/docs/topics/charts_hooks/#the-available-hooks
115
##
116
# hookType: test
117
image:
118
# -- The Docker registry
119
registry: docker.io
120
repository: bats/bats
121
tag: "1.14.0"
122
imagePullPolicy: IfNotPresent
123
securityContext: {}
124
containerSecurityContext: {}
125
resources: {}
126
# limits:
127
# cpu: 100m
128
# memory: 128Mi
129
# requests:
130
# cpu: 100m
131
# memory: 128Mi
132
# dns configuration for pod
133
dnsPolicy: ~
134
dnsConfig: {}
135
# nameservers:
136
# - 8.8.8.8
137
# options:
138
# - name: ndots
139
# value: "2"
140
# - name: edns0
141
142
hostUsers: ~
143
securityContext:
144
runAsNonRoot: true
145
runAsUser: 472
146
runAsGroup: 472
147
fsGroup: 472
148
containerSecurityContext:
149
allowPrivilegeEscalation: false
150
privileged: false
151
capabilities:
152
drop:
153
- ALL
154
seccompProfile:
155
type: RuntimeDefault
156
readOnlyRootFilesystem: true
157
# Enable creating the grafana configmap
158
createConfigmap: true
159
# Extra configmaps to mount in grafana pods
160
# Values are templated.
161
extraConfigmapMounts: []
162
# - name: certs-configmap
163
# mountPath: /etc/grafana/ssl/
164
# subPath: certificates.crt # (optional)
165
# configMap: certs-configmap
166
# readOnly: true
167
# optional: false
168
169
extraEmptyDirMounts: []
170
# - name: provisioning-notifiers
171
# mountPath: /etc/grafana/provisioning/notifiers
172
173
# Shadow `/usr/share/grafana/data/plugins-bundled` with an emptyDir so plugins
174
# listed under `plugins:` install cleanly into `/var/lib/grafana/plugins` instead
175
# of failing on the read-only bundled directory shipped in the Grafana image.
176
# Required for plugins moved out of core in Grafana 13 (e.g. `elasticsearch`,
177
# `cloudwatch`) when listed in `plugins:`. Side effect: any bundled plugin not
178
# explicitly listed in `plugins:` will not be available.
179
shadowBundledPlugins: false
180
# Apply extra labels to common labels.
181
extraLabels: {}
182
## Assign a PriorityClassName to pods if set
183
# priorityClassName:
184
downloadDashboardsImage:
185
# -- The Docker registry
186
registry: cgr.dev
187
repository: chainguard-private/curl
188
tag: latest-dev
189
sha: sha256:811154c3bc9991ed7b5ebdc0d141eaf34b2254b2fe613a5c85274017226a7d2f
190
pullPolicy: IfNotPresent
191
downloadDashboards:
192
env: {}
193
envFromSecret: ""
194
resources: {}
195
securityContext:
196
allowPrivilegeEscalation: false
197
capabilities:
198
drop:
199
- ALL
200
seccompProfile:
201
type: RuntimeDefault
202
envValueFrom: {}
203
# ENV_NAME:
204
# configMapKeyRef:
205
# name: configmap-name
206
# key: value_key
207
## Pod Annotations
208
# podAnnotations: {}
209
210
## ConfigMap Annotations
211
# configMapAnnotations: {}
212
# argocd.argoproj.io/sync-options: Replace=true
213
214
## Pod Labels
215
# podLabels: {}
216
podPortName: grafana
217
gossipPortName: gossip
218
## Deployment annotations
219
# annotations: {}
220
221
## Expose the grafana service to be accessed from outside the cluster (LoadBalancer service).
222
## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
223
## ref: http://kubernetes.io/docs/user-guide/services/
224
##
225
service:
226
enabled: true
227
type: ClusterIP
228
# Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)
229
ipFamilyPolicy: ""
230
# Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
231
ipFamilies: []
232
loadBalancerIP: ""
233
loadBalancerClass: ""
234
loadBalancerSourceRanges: []
235
port: 80
236
targetPort: 3000
237
# targetPort: 4181 To be used with a proxy extraContainer
238
## Service annotations. Can be templated.
239
annotations: {}
240
labels: {}
241
portName: service
242
# Adds the appProtocol field to the service. This allows to work with istio protocol selection. Ex: "http" or "tcp"
243
appProtocol: ""
244
sessionAffinity: ""
245
# trafficDistribution allows specifying how traffic is distributed to Service endpoints.
246
# Valid values: "" (default - standard load balancing),"PreferSameZone" (K8s 1.34+), "PreferSameNode" (K8s 1.35+), "PreferClose" (deprecated, use PreferSameZone),
247
trafficDistribution: ""
248
serviceMonitor:
249
## If true, a ServiceMonitor CR is created for a prometheus operator
250
## https://github.com/coreos/prometheus-operator
251
##
252
enabled: false
253
path: /metrics
254
# namespace: monitoring (defaults to use the namespace this chart is deployed to)
255
labels: {}
256
# Set these to override the Prometheus global scrape interval/timeout.
257
# interval: 30s
258
# scrapeTimeout: 30s
259
scheme: http
260
tlsConfig: {}
261
relabelings: []
262
metricRelabelings: []
263
basicAuth: {}
264
targetLabels: []
265
extraExposePorts: []
266
# - name: keycloak
267
# port: 8080
268
# targetPort: 8080
269
270
# overrides pod.spec.hostAliases in the grafana deployment's pods
271
hostAliases: []
272
# - ip: "1.2.3.4"
273
# hostnames:
274
# - "my.host.com"
275
276
ingress:
277
enabled: false
278
# ingressClassName: nginx
279
# Values can be templated
280
annotations: {}
281
# kubernetes.io/ingress.class: nginx
282
# kubernetes.io/tls-acme: "true"
283
labels: {}
284
path: /
285
pathType: Prefix
286
hosts:
287
- chart-example.local
288
## Extra paths to prepend to every host configuration. This is useful when working with annotation based services.
289
extraPaths: []
290
# - path: /*
291
# pathType: Prefix
292
# backend:
293
# service:
294
# name: ssl-redirect
295
# port:
296
# name: use-annotation
297
298
tls: []
299
# - secretName: chart-example-tls
300
# hosts:
301
# - chart-example.local
302
# -- BETA: Configure the gateway routes for the chart here.
303
# More routes can be added by adding a dictionary key like the 'main' route.
304
# Be aware that this is an early beta of this feature,
305
# kube-prometheus-stack does not guarantee this works and is subject to change.
306
# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk
307
# [[ref]](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io%2fv1alpha2)
308
route:
309
main:
310
# -- Enables or disables the route
311
enabled: false
312
# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2
313
apiVersion: gateway.networking.k8s.io/v1
314
# -- Set the route kind
315
# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute
316
kind: HTTPRoute
317
annotations: {}
318
labels: {}
319
hostnames: []
320
# - my-filter.example.com
321
parentRefs: []
322
# - name: acme-gw
323
324
matches:
325
- path:
326
type: PathPrefix
327
value: /
328
## Timeouts define the timeouts that can be configured for an HTTP request.
329
## Ref. https://gateway-api.sigs.k8s.io/api-types/httproute/#timeouts-optional
330
timeouts: {}
331
# request: 10s
332
# backendRequest: 5s
333
334
## SessionPersistence defines and configures session persistence for the route rule.
335
## Ref. https://gateway-api.sigs.k8s.io/geps/gep-1619/
336
sessionPersistence: {}
337
# sessionName: grafana-session
338
# type: Cookie
339
# absoluteTimeout: 48h
340
# cookieConfig:
341
# lifetimeType: Permanent
342
343
## Filters define the filters that are applied to requests that match this rule.
344
filters: []
345
## Additional custom rules that can be added to the route
346
additionalRules: []
347
## httpsRedirect adds a filter for redirecting to https (HTTP 301 Moved Permanently).
348
## To redirect HTTP traffic to HTTPS, you need to have a Gateway with both HTTP and HTTPS listeners.
349
## Matches and filters do not take effect if enabled.
350
## Ref. https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/
351
httpsRedirect: false
352
# -- BETA: Configure Gateway API ListenerSet resources for the chart here.
353
# ListenerSet allows attaching additional listeners to an existing Gateway.
354
# More listener sets can be added by adding a dictionary key like the 'main' entry.
355
# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk
356
# [[ref]](https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#listenerset)
357
listenerSet:
358
main:
359
# -- Enables or disables the listener set
360
enabled: false
361
# -- Set the ListenerSet apiVersion, e.g. gateway.networking.k8s.io/v1
362
apiVersion: gateway.networking.k8s.io/v1
363
annotations: {}
364
labels: {}
365
# -- Reference to the parent Gateway this ListenerSet attaches to
366
parentRef: {}
367
# name: my-gateway
368
# namespace: default
369
# group: gateway.networking.k8s.io
370
# kind: Gateway
371
372
# -- List of listeners to attach to the parent Gateway
373
listeners: []
374
# - name: https
375
# port: 443
376
# protocol: HTTPS
377
# hostname: grafana.example.com
378
# tls:
379
# mode: Terminate
380
# certificateRefs:
381
# - name: grafana-tls
382
# allowedRoutes:
383
# namespaces:
384
# from: Same
385
resources: {}
386
# limits:
387
# cpu: 100m
388
# memory: 128Mi
389
# requests:
390
# cpu: 100m
391
# memory: 128Mi
392
393
## Configure the GOMEMLIMIT environment variable.
394
## When enabled and resources.limits.memory is set, GOMEMLIMIT is injected
395
## as a computed value (factor × memory limit) unless the user has already
396
## defined GOMEMLIMIT via env or envValueFrom.
397
goMemLimit:
398
# -- Enable automatic GOMEMLIMIT injection.
399
enabled: true
400
# -- Fraction of resources.limits.memory to use as GOMEMLIMIT (e.g. 0.9 = 90 %).
401
factor: 0.9
402
## Node labels for pod assignment
403
## ref: https://kubernetes.io/docs/user-guide/node-selection/
404
#
405
nodeSelector: {}
406
## Tolerations for pod assignment
407
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
408
##
409
tolerations: []
410
## Affinity for pod assignment (evaluated as template)
411
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
412
##
413
affinity: {}
414
## Topology Spread Constraints
415
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
416
##
417
topologySpreadConstraints: []
418
## Additional init containers (evaluated as template)
419
## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
420
##
421
extraInitContainers: []
422
## Enable an Specify container in extraContainers. This is meant to allow adding an authentication proxy to a grafana pod
423
extraContainers: ""
424
# extraContainers: |
425
# - name: proxy
426
# image: quay.io/gambol99/keycloak-proxy:latest
427
# args:
428
# - -provider=github
429
# - -client-id=
430
# - -client-secret=
431
# - -github-org=<ORG_NAME>
432
# - -email-domain=*
433
# - -cookie-secret=
434
# - -http-address=http://0.0.0.0:4181
435
# - -upstream-url=http://127.0.0.1:3000
436
# ports:
437
# - name: proxy-web
438
# containerPort: 4181
439
440
## Volumes that can be used in init containers that will not be mounted to deployment pods
441
extraContainerVolumes: []
442
# - name: volume-from-secret
443
# secret:
444
# secretName: secret-to-mount
445
# - name: empty-dir-volume
446
# emptyDir: {}
447
448
## Enable persistence using Persistent Volume Claims
449
## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
450
##
451
persistence:
452
type: pvc
453
enabled: false
454
# storageClassName: default
455
## (Optional) Use this to bind the claim to an existing PersistentVolume (PV) by name.
456
volumeName: ""
457
accessModes:
458
- ReadWriteOnce
459
size: 10Gi
460
# annotations: {}
461
finalizers:
462
- kubernetes.io/pvc-protection
463
# selectorLabels: {}
464
## Sub-directory of the PV to mount. Can be templated.
465
# subPath: ""
466
## Name of an existing PVC. Can be templated.
467
# existingClaim:
468
## Extra labels to apply to a PVC.
469
extraPvcLabels: {}
470
disableWarning: false
471
## Configure StatefulSet persistent volume claim retention policy.
472
## This is ignored when Grafana is configured to use a Deployment with a PVC.
473
## By default, Kubernetes uses Retain for both whenDeleted and whenScaled.
474
persistentVolumeClaimRetentionPolicy: {}
475
# whenDeleted: Retain
476
# whenScaled: Retain
477
478
## If persistence is not enabled, this allows to mount the
479
## local storage in-memory to improve performance
480
##
481
inMemory:
482
enabled: false
483
## The maximum usage on memory medium EmptyDir would be
484
## the minimum value between the SizeLimit specified
485
## here and the sum of memory limits of all containers in a pod
486
##
487
# sizeLimit: 300Mi
488
## If 'lookupVolumeName' is set to true, Helm will attempt to retrieve
489
## the current value of 'spec.volumeName' and incorporate it into the template.
490
lookupVolumeName: true
491
initChownData:
492
## If false, data ownership will not be reset at startup
493
## This allows the grafana-server to be run with an arbitrary user
494
##
495
enabled: true
496
## initChownData container image
497
##
498
image:
499
# -- The Docker registry
500
registry: cgr.dev
501
repository: chainguard-private/busybox
502
tag: glibc-1.38.0-r2
503
sha: sha256:2a9dc729fa177c41c3fb59a2d6c4a8b0d5dc51f2f999854a3fa2b46171b72041
504
pullPolicy: IfNotPresent
505
## initChownData resource requests and limits
506
## Ref: http://kubernetes.io/docs/user-guide/compute-resources/
507
##
508
resources: {}
509
# limits:
510
# cpu: 100m
511
# memory: 128Mi
512
# requests:
513
# cpu: 100m
514
# memory: 128Mi
515
securityContext:
516
readOnlyRootFilesystem: false
517
runAsNonRoot: false
518
runAsUser: 0
519
seccompProfile:
520
type: RuntimeDefault
521
capabilities:
522
add:
523
- CHOWN
524
- DAC_OVERRIDE
525
drop:
526
- ALL
527
# Administrator credentials when not using an existing secret (see below)
528
adminUser: admin
529
# adminPassword: strongpassword
530
531
# Use an existing secret for the admin user.
532
admin:
533
## Name of the secret. Can be templated.
534
existingSecret: ""
535
userKey: admin-user
536
passwordKey: admin-password
537
## Define command to be executed at startup by grafana container
538
## Needed if using `vault-env` to manage secrets (ref: https://banzaicloud.com/blog/inject-secrets-into-pods-vault/)
539
## The default distroless image starts Grafana directly and does not contain a shell or `/run.sh`.
540
# command:
541
# - "/path/to/your/entrypoint"
542
543
## Optionally define args if command is used
544
## Needed if using `hashicorp/envconsul` to manage secrets
545
## By default no arguments are set
546
# args:
547
# - "-secret"
548
# - "secret/grafana"
549
# - "./grafana"
550
551
## Extra environment variables that will be pass onto deployment pods
552
##
553
## to provide grafana with access to CloudWatch on AWS EKS:
554
## 1. create an iam role of type "Web identity" with provider oidc.eks.* (note the provider for later)
555
## 2. edit the "Trust relationships" of the role, add a line inside the StringEquals clause using the
556
## same oidc eks provider as noted before (same as the existing line)
557
## also, replace NAMESPACE and prometheus-operator-grafana with the service account namespace and name
558
##
559
## "oidc.eks.us-east-1.amazonaws.com/id/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:sub": "system:serviceaccount:NAMESPACE:prometheus-operator-grafana",
560
##
561
## 3. attach a policy to the role, you can use a built in policy called CloudWatchReadOnlyAccess
562
## 4. use the following env: (replace 123456789000 and iam-role-name-here with your aws account number and role name)
563
##
564
## env:
565
## AWS_ROLE_ARN: arn:aws:iam::123456789000:role/iam-role-name-here
566
## AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
567
## AWS_REGION: us-east-1
568
##
569
## 5. uncomment the EKS section in extraSecretMounts: below
570
## 6. uncomment the annotation section in the serviceAccount: above
571
## make sure to replace arn:aws:iam::123456789000:role/iam-role-name-here with your role arn
572
env: {}
573
## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.
574
## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core
575
## Renders in container spec as:
576
## env:
577
## ...
578
## - name: <key>
579
## valueFrom:
580
## <value rendered as YAML>
581
envValueFrom: {}
582
# ENV_NAME:
583
# configMapKeyRef:
584
# name: configmap-name
585
# key: value_key
586
587
## The name of a secret in the same kubernetes namespace which contain values to be added to the environment
588
## This can be useful for auth tokens, etc. Value is templated.
589
envFromSecret: ""
590
## Sensible environment variables that will be rendered as new secret object
591
## This can be useful for auth tokens, etc.
592
## If the secret values contains "{{", they'll need to be properly escaped so that they are not interpreted by Helm
593
## ref: https://helm.sh/docs/howto/charts_tips_and_tricks/#using-the-tpl-function
594
envRenderSecret: {}
595
## The names of secrets in the same kubernetes namespace which contain values to be added to the environment
596
## Each entry should contain a name key, and can optionally specify whether the secret must be defined with an optional key.
597
## Name is templated.
598
envFromSecrets: []
599
## - name: secret-name
600
## prefix: prefix
601
## optional: true
602
603
## The names of configmaps in the same kubernetes namespace which contain values to be added to the environment
604
## Each entry should contain a name key, and can optionally specify whether the configmap must be defined with an optional key.
605
## Name is templated.
606
## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#configmapenvsource-v1-core
607
envFromConfigMaps: []
608
## - name: configmap-name
609
## prefix: prefix
610
## optional: true
611
612
# Inject Kubernetes services as environment variables.
613
# See https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#environment-variables
614
enableServiceLinks: true
615
## Additional grafana server secret mounts
616
# Defines additional mounts with secrets. Secrets must be manually created in the namespace.
617
extraSecretMounts: []
618
# - name: secret-files
619
# mountPath: /etc/secrets
620
# secretName: grafana-secret-files
621
# readOnly: true
622
# optional: false
623
# subPath: ""
624
#
625
# for AWS EKS (cloudwatch) use the following (see also instruction in env: above)
626
# - name: aws-iam-token
627
# mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount
628
# readOnly: true
629
# projected:
630
# defaultMode: 420
631
# sources:
632
# - serviceAccountToken:
633
# audience: sts.amazonaws.com
634
# expirationSeconds: 86400
635
# path: token
636
#
637
# for CSI e.g. Azure Key Vault use the following
638
# - name: secrets-store-inline
639
# mountPath: /run/secrets/vault.azure.com
640
# readOnly: true
641
# csi:
642
# driver: secrets-store.csi.k8s.io
643
# readOnly: true
644
# volumeAttributes:
645
# secretProviderClass: "akv-grafana-spc"
646
# nodePublishSecretRef: # Only required when using service principal mode
647
# name: grafana-akv-creds # Only required when using service principal mode
648
649
## Additional grafana server volume mounts
650
# Defines additional volume mounts.
651
extraVolumeMounts: []
652
# - name: extra-volume-0
653
# mountPath: /mnt/volume0
654
# readOnly: true
655
# - name: extra-volume-1
656
# mountPath: /mnt/volume1
657
# readOnly: true
658
# - name: grafana-secrets
659
# mountPath: /mnt/volume2
660
661
## Additional Grafana server volumes
662
extraVolumes: []
663
# - name: extra-volume-0
664
# existingClaim: volume-claim
665
# - name: extra-volume-1
666
# hostPath:
667
# path: /usr/shared/
668
# type: ""
669
# - name: grafana-secrets
670
# csi:
671
# driver: secrets-store.csi.k8s.io
672
# readOnly: true
673
# volumeAttributes:
674
# secretProviderClass: "grafana-env-spc"
675
676
## Container Lifecycle Hooks. Execute a specific bash command or make an HTTP request
677
lifecycleHooks: {}
678
# postStart:
679
# exec:
680
# command: []
681
682
## Pass the plugins you want installed as a list.
683
##
684
plugins: []
685
# - digrich-bubblechart-panel
686
# - grafana-clock-panel
687
## You can also use other plugin download URL, as long as they are valid zip files,
688
## and specify the name of the plugin as prefix, with an version. Like this:
689
# - marcusolsson-json-datasource@1.3.24@https://grafana.com/api/plugins/marcusolsson-json-datasource/versions/1.3.24/download
690
691
## Configure grafana datasources
692
## ref: http://docs.grafana.org/administration/provisioning/#datasources
693
##
694
datasources: {}
695
# datasources.yaml:
696
# apiVersion: 1
697
# datasources:
698
# - name: Prometheus
699
# type: prometheus
700
# url: http://prometheus-prometheus-server
701
# access: proxy
702
# isDefault: true
703
# - name: CloudWatch
704
# type: cloudwatch
705
# access: proxy
706
# uid: cloudwatch
707
# editable: false
708
# jsonData:
709
# authType: default
710
# defaultRegion: us-east-1
711
# deleteDatasources: []
712
# - name: Prometheus
713
714
## Configure grafana alerting (can be templated)
715
## ref: https://docs.grafana.com/alerting/set-up/provision-alerting-resources/file-provisioning/
716
##
717
alerting: {}
718
# policies.yaml:
719
# apiVersion: 1
720
# policies:
721
# - orgId: 1
722
# receiver: first_uid
723
#
724
# rules.yaml:
725
# apiVersion: 1
726
# groups:
727
# - orgId: 1
728
# name: '{{ .Chart.Name }}_my_rule_group'
729
# folder: my_first_folder
730
# interval: 60s
731
# rules:
732
# - uid: my_id_1
733
# title: my_first_rule
734
# condition: A
735
# data:
736
# - refId: A
737
# datasourceUid: '-100'
738
# model:
739
# conditions:
740
# - evaluator:
741
# params:
742
# - 3
743
# type: gt
744
# operator:
745
# type: and
746
# query:
747
# params:
748
# - A
749
# reducer:
750
# type: last
751
# type: query
752
# datasource:
753
# type: __expr__
754
# uid: '-100'
755
# expression: 1==0
756
# intervalMs: 1000
757
# maxDataPoints: 43200
758
# refId: A
759
# type: math
760
# dashboardUid: my_dashboard
761
# panelId: 123
762
# noDataState: Alerting
763
# for: 60s
764
# annotations:
765
# some_key: some_value
766
# labels:
767
# team: sre_team_1
768
#
769
# contactpoints.yaml:
770
# secret:
771
# apiVersion: 1
772
# contactPoints:
773
# - orgId: 1
774
# name: cp_1
775
# receivers:
776
# - uid: first_uid
777
# type: pagerduty
778
# settings:
779
# integrationKey: XXX
780
# severity: critical
781
# class: ping failure
782
# component: Grafana
783
# group: app-stack
784
# summary: |
785
# {{ `{{ include "default.message" . }}` }}
786
#
787
# templates.yaml:
788
# apiVersion: 1
789
# templates:
790
# - orgId: 1
791
# name: my_first_template
792
# template: |
793
# {{ `
794
# {{ define "my_first_template" }}
795
# Custom notification message
796
# {{ end }}
797
# ` }}
798
#
799
# mutetimes.yaml
800
# apiVersion: 1
801
# muteTimes:
802
# - orgId: 1
803
# name: mti_1
804
# # refer to https://prometheus.io/docs/alerting/latest/configuration/#time_interval-0
805
# time_intervals: {}
806
807
## Configure notifiers
808
## ref: http://docs.grafana.org/administration/provisioning/#alert-notification-channels
809
##
810
notifiers: {}
811
# notifiers.yaml:
812
# notifiers:
813
# - name: email-notifier
814
# type: email
815
# uid: email1
816
# # either:
817
# org_id: 1
818
# # or
819
# org_name: Main Org.
820
# is_default: true
821
# settings:
822
# addresses: an_email_address@example.com
823
# delete_notifiers:
824
825
## Configure grafana dashboard providers
826
## ref: http://docs.grafana.org/administration/provisioning/#dashboards
827
##
828
## `path` must be /var/lib/grafana/dashboards/<provider_name>
829
##
830
dashboardProviders: {}
831
# dashboardproviders.yaml:
832
# apiVersion: 1
833
# providers:
834
# - name: 'default'
835
# orgId: 1
836
# folder: ''
837
# type: file
838
# disableDeletion: false
839
# editable: true
840
# options:
841
# path: /var/lib/grafana/dashboards/default
842
843
## Configure how curl fetches remote dashboards. The beginning dash is required.
844
## NOTE: This sets the default short flags for all dashboards, but these
845
## defaults can be overridden individually for each dashboard by setting
846
## curlOptions. See the example dashboards section below.
847
##
848
## -s - silent mode
849
## -k - allow insecure (eg: non-TLS) connections
850
## -f - fail fast
851
## See the curl documentation for additional options
852
##
853
defaultCurlOptions: "-skf"
854
## Configure shell options for downloading dashboards. The beginning dash is added automatically.
855
## Add `x` to enable command tracing. This can expose sensitive values in logs.
856
##
857
defaultShellOptions: "eufo pipefail"
858
## Configure grafana dashboard to import
859
## NOTE: To use dashboards you must also enable/configure dashboardProviders
860
## ref: https://grafana.com/dashboards
861
##
862
## dashboards per provider, use provider name as key.
863
## For dashboards downloaded via gnetId or url, the optional "title" key overrides
864
## the dashboard title in the downloaded JSON so the UI displays your custom title.
865
##
866
dashboards: {}
867
# default:
868
# some-dashboard:
869
# json: |
870
# $RAW_JSON
871
# custom-dashboard:
872
# file: dashboards/custom-dashboard.json
873
# prometheus-stats:
874
# title: My Custom Dashboard Title # optional; overrides the dashboard title in the downloaded JSON
875
# gnetId: 2
876
# revision: 2
877
# datasource: Prometheus
878
# local-dashboard:
879
# url: https://example.com/repository/test.json
880
# curlOptions: "-sLf"
881
# token: ''
882
# local-dashboard-base64:
883
# url: https://example.com/repository/test-b64.json
884
# token: ''
885
# b64content: true
886
# local-dashboard-gitlab:
887
# url: https://example.com/repository/test-gitlab.json
888
# gitlabToken: ''
889
# local-dashboard-bitbucket:
890
# url: https://example.com/repository/test-bitbucket.json
891
# bearerToken: ''
892
# local-dashboard-azure:
893
# url: https://example.com/repository/test-azure.json
894
# basic: ''
895
# acceptHeader: '*/*'
896
897
## Reference to external ConfigMap per provider. Use provider name as key and ConfigMap name as value.
898
## A provider dashboards must be defined either by external ConfigMaps or in values.yaml, not in both.
899
## ConfigMap data example:
900
##
901
## data:
902
## example-dashboard.json: |
903
## RAW_JSON
904
##
905
dashboardsConfigMaps: {}
906
# default: ""
907
908
## Grafana's primary configuration
909
## NOTE: values in map will be converted to ini format
910
## ref: http://docs.grafana.org/installation/configuration/
911
##
912
grafana.ini:
913
paths:
914
data: /var/lib/grafana/
915
logs: /var/log/grafana
916
plugins: /var/lib/grafana/plugins
917
provisioning: /etc/grafana/provisioning
918
analytics:
919
check_for_updates: true
920
plugins:
921
preinstall_auto_update: "false"
922
log:
923
mode: console
924
server:
925
domain: "{{ if (and .Values.ingress.enabled .Values.ingress.hosts) }}{{ tpl (.Values.ingress.hosts | first) . }}{{ else if (and .Values.route.main.enabled .Values.route.main.hostnames) }}{{ tpl (.Values.route.main.hostnames | first) . }}{{ else }}''{{ end }}"
926
unified_storage:
927
index_path: /var/lib/grafana-search/bleve
928
## grafana Authentication can be enabled with the following values on grafana.ini
929
# server:
930
# The full public facing url you use in browser, used for redirects and emails
931
# root_url:
932
# https://grafana.com/docs/grafana/latest/auth/github/#enable-github-in-grafana
933
# auth.github:
934
# enabled: false
935
# allow_sign_up: false
936
# scopes: user:email,read:org
937
# auth_url: https://github.com/login/oauth/authorize
938
# token_url: https://github.com/login/oauth/access_token
939
# api_url: https://api.github.com/user
940
# team_ids:
941
# allowed_organizations:
942
# client_id:
943
# client_secret:
944
## LDAP Authentication can be enabled with the following values on grafana.ini
945
## NOTE: Grafana will fail to start if the value for ldap.toml is invalid
946
# auth.ldap:
947
# enabled: true
948
# allow_sign_up: true
949
# config_file: /etc/grafana/ldap.toml
950
## Grafana's alerting configuration
951
# unified_alerting:
952
# enabled: true
953
# rule_version_record_limit: "5"
954
955
## Grafana's LDAP configuration
956
## Templated by the template in _helpers.tpl
957
## NOTE: To enable the grafana.ini must be configured with auth.ldap.enabled
958
## ref: http://docs.grafana.org/installation/configuration/#auth-ldap
959
## ref: http://docs.grafana.org/installation/ldap/#configuration
960
ldap:
961
enabled: false
962
# `existingSecret` is a reference to an existing secret containing the ldap configuration
963
# for Grafana in a key `ldap-toml`.
964
existingSecret: ""
965
# `config` is the content of `ldap.toml` that will be stored in the created secret
966
config: ""
967
# config: |-
968
# verbose_logging = true
969
# [[servers]]
970
# host = "my-ldap-server"
971
# port = 636
972
# use_ssl = true
973
# start_tls = false
974
# ssl_skip_verify = false
975
# bind_dn = "uid=%s,ou=users,dc=myorg,dc=com"
976
977
# When process namespace sharing is enabled, processes in a container are visible to all other containers in the same pod
978
# This parameter is added because the ldap reload api is not working https://grafana.com/docs/grafana/latest/developers/http_api/admin/#reload-ldap-configuration
979
# To allow an extraContainer to restart the Grafana container
980
shareProcessNamespace: false
981
## Grafana's SMTP configuration
982
## NOTE: To enable, grafana.ini must be configured with smtp.enabled
983
## ref: http://docs.grafana.org/installation/configuration/#smtp
984
smtp:
985
# `existingSecret` is a reference to an existing secret containing the smtp configuration
986
# for Grafana.
987
existingSecret: ""
988
userKey: "user"
989
passwordKey: "password"
990
## Sidecars that collect the configmaps with specified label and stores the included files them into the respective folders
991
## Requires at least Grafana 5 to work and can't be used together with parameters dashboardProviders, datasources and dashboards
992
sidecar:
993
image:
994
# -- The Docker registry
995
registry: cgr.dev
996
repository: chainguard-private/k8s-sidecar
997
tag: 2.11.2-r1
998
sha: sha256:3e8d6d3d1865ec7d2ca2a253ca996713b3917cb86ac373f4d51d6296f743b93a
999
imagePullPolicy: IfNotPresent
1000
resources: {}
1001
# limits:
1002
# cpu: 100m
1003
# memory: 100Mi
1004
# requests:
1005
# cpu: 50m
1006
# memory: 50Mi
1007
securityContext:
1008
allowPrivilegeEscalation: false
1009
capabilities:
1010
drop:
1011
- ALL
1012
seccompProfile:
1013
type: RuntimeDefault
1014
# Set to true to skip tls verification for kube api calls. Can be overridden per sidecar
1015
# skipTlsVerify: true
1016
enableUniqueFilenames: false
1017
readinessProbe: {}
1018
livenessProbe: {}
1019
# Log level default for all sidecars. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL. Defaults to INFO
1020
# logLevel: INFO
1021
alerts:
1022
enabled: false
1023
# Additional environment variables for the alerts sidecar
1024
env: {}
1025
## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.
1026
## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core
1027
## Renders in container spec as:
1028
## env:
1029
## ...
1030
## - name: <key>
1031
## valueFrom:
1032
## <value rendered as YAML>
1033
envValueFrom: {}
1034
# ENV_NAME:
1035
# configMapKeyRef:
1036
# name: configmap-name
1037
# key: value_key
1038
# Do not reprocess already processed unchanged resources on k8s API reconnect.
1039
# ignoreAlreadyProcessed: true
1040
# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify
1041
# skipTlsVerify: true
1042
# label that the configmaps with alert are marked with (can be templated)
1043
label: grafana_alert
1044
# value of label that the configmaps with alert are set to (can be templated)
1045
labelValue: ""
1046
# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.
1047
# logLevel: INFO
1048
# If specified, the sidecar will search for alert config-maps inside this namespace.
1049
# Otherwise the namespace in which the sidecar is running will be used.
1050
# It's also possible to specify ALL to search in all namespaces
1051
searchNamespace: null
1052
# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
1053
watchMethod: WATCH
1054
# search in configmap, secret or both
1055
resource: both
1056
#
1057
# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.
1058
# per default all resources of the type defined in {{ .Values.sidecar.alerts.resource }} will be checked.
1059
# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.
1060
# resourceName: "secret/alerts-1,configmap/alerts-0"
1061
resourceName: ""
1062
#
1063
# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.
1064
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S
1065
# watchServerTimeout: 3600
1066
#
1067
# watchClientTimeout: is a client-side timeout, configuring your local socket.
1068
# If you have a network outage dropping all packets with no RST/FIN,
1069
# this is how long your client waits before realizing & dropping the connection.
1070
# defaults to 66sec (sic!)
1071
# watchClientTimeout: 60
1072
#
1073
# maxTotalRetries: Total number of retries to allow for any http request.
1074
# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.
1075
# Set to 0 to fail on the first retry.
1076
# maxTotalRetries: 5
1077
#
1078
# maxConnectRetries: How many connection-related errors to retry on for any http request.
1079
# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.
1080
# Applies to all requests to reloadURL and k8s api requests.
1081
# Set to 0 to fail on the first retry of this type.
1082
# maxConnectRetries: 10
1083
#
1084
# maxReadRetries: How many times to retry on read errors for any http request
1085
# These errors are raised after the request was sent to the server, so the request may have side-effects.
1086
# Applies to all requests to reloadURL and k8s api requests.
1087
# Set to 0 to fail on the first retry of this type.
1088
# maxReadRetries: 5
1089
#
1090
# Endpoint to send request to reload alerts
1091
reloadURL: "http://localhost:3000/api/admin/provisioning/alerting/reload"
1092
# Absolute path to a script to execute after a configmap got reloaded.
1093
# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.
1094
# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python
1095
script: null
1096
skipReload: false
1097
# This is needed if skipReload is true, to load any alerts defined at startup time.
1098
# Deploy the alert sidecar as an initContainer.
1099
initAlerts: false
1100
# Use native sidecar https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/
1101
# restartPolicy: Always
1102
# # only applies to native sidecars
1103
# startupProbe:
1104
# httpGet:
1105
# path: /healthz
1106
# port: 8080
1107
# initialDelaySeconds: 5
1108
# periodSeconds: 5
1109
# failureThreshold: 60 # 5 minutes
1110
# Additional alerts sidecar volume mounts
1111
extraMounts: []
1112
# Sets the size limit of the alert sidecar emptyDir volume
1113
sizeLimit: ""
1114
dashboards:
1115
enabled: false
1116
# Additional environment variables for the dashboards sidecar
1117
env: {}
1118
## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.
1119
## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core
1120
## Renders in container spec as:
1121
## env:
1122
## ...
1123
## - name: <key>
1124
## valueFrom:
1125
## <value rendered as YAML>
1126
envValueFrom: {}
1127
# ENV_NAME:
1128
# configMapKeyRef:
1129
# name: configmap-name
1130
# key: value_key
1131
# Do not reprocess already processed unchanged resources on k8s API reconnect.
1132
# ignoreAlreadyProcessed: true
1133
# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify
1134
# skipTlsVerify: true
1135
SCProvider: true
1136
# label that the configmaps with dashboards are marked with (can be templated)
1137
label: grafana_dashboard
1138
# value of label that the configmaps with dashboards are set to (can be templated)
1139
labelValue: ""
1140
# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.
1141
# logLevel: INFO
1142
# folder in the pod that should hold the collected dashboards (unless `defaultFolderName` is set)
1143
folder: /tmp/dashboards
1144
# The default folder name, it will create a subfolder under the `folder` and put dashboards in there instead
1145
defaultFolderName: null
1146
# Namespaces list. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
1147
# Otherwise the namespace in which the sidecar is running will be used.
1148
# It's also possible to specify ALL to search in all namespaces.
1149
searchNamespace: null
1150
# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
1151
watchMethod: WATCH
1152
# search in configmap, secret or both
1153
resource: both
1154
# If specified, the sidecar will look for annotation with this name to create folder and put graph here.
1155
# You can use this parameter together with `provider.foldersFromFilesStructure`to annotate configmaps and create folder structure.
1156
folderAnnotation: null
1157
#
1158
# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.
1159
# per default all resources of the type defined in {{ .Values.sidecar.dashboards.resource }} will be checked.
1160
# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.
1161
# resourceName: "secret/dashboards-0,configmap/dashboards-1"
1162
resourceName: ""
1163
#
1164
# maxTotalRetries: Total number of retries to allow for any http request.
1165
# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.
1166
# Set to 0 to fail on the first retry.
1167
# maxTotalRetries: 5
1168
#
1169
# maxConnectRetries: How many connection-related errors to retry on for any http request.
1170
# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.
1171
# Applies to all requests to reloadURL and k8s api requests.
1172
# Set to 0 to fail on the first retry of this type.
1173
# maxConnectRetries: 10
1174
#
1175
# maxReadRetries: How many times to retry on read errors for any http request
1176
# These errors are raised after the request was sent to the server, so the request may have side-effects.
1177
# Applies to all requests to reloadURL and k8s api requests.
1178
# Set to 0 to fail on the first retry of this type.
1179
# maxReadRetries: 5
1180
#
1181
# Endpoint to send request to reload alerts
1182
reloadURL: "http://localhost:3000/api/admin/provisioning/dashboards/reload"
1183
# Absolute path to a script to execute after a configmap got reloaded.
1184
# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.
1185
# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python
1186
script: null
1187
skipReload: false
1188
# This is needed if skipReload is true, to load any dashboards defined at startup time.
1189
# Deploy the dashboard sidecar as an initContainer.
1190
initDashboards: false
1191
# Use native sidecar https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/
1192
# restartPolicy: Always
1193
# # only applies to native sidecars
1194
# startupProbe:
1195
# httpGet:
1196
# path: /healthz
1197
# port: 8083
1198
# initialDelaySeconds: 5
1199
# periodSeconds: 5
1200
# failureThreshold: 60 # 5 minutes
1201
# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.
1202
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S
1203
# watchServerTimeout: 3600
1204
#
1205
# watchClientTimeout: is a client-side timeout, configuring your local socket.
1206
# If you have a network outage dropping all packets with no RST/FIN,
1207
# this is how long your client waits before realizing & dropping the connection.
1208
# defaults to 66sec (sic!)
1209
# watchClientTimeout: 60
1210
#
1211
# provider configuration that lets grafana manage the dashboards
1212
provider:
1213
# name of the provider, should be unique
1214
name: sidecarProvider
1215
# orgid as configured in grafana
1216
orgid: 1
1217
# folder in which the dashboards should be imported in grafana
1218
folder: ''
1219
# <string> folder UID. will be automatically generated if not specified
1220
folderUid: ''
1221
# type of the provider
1222
type: file
1223
# disableDelete to activate a import-only behaviour
1224
disableDelete: false
1225
# allow updating provisioned dashboards from the UI
1226
allowUiUpdates: false
1227
# allow Grafana to replicate dashboard structure from filesystem
1228
foldersFromFilesStructure: false
1229
# Additional dashboards sidecar volume mounts
1230
extraMounts: []
1231
# Sets the size limit of the dashboard sidecar emptyDir volume
1232
sizeLimit: ""
1233
datasources:
1234
enabled: false
1235
# Additional environment variables for the datasourcessidecar
1236
env: {}
1237
## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.
1238
## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core
1239
## Renders in container spec as:
1240
## env:
1241
## ...
1242
## - name: <key>
1243
## valueFrom:
1244
## <value rendered as YAML>
1245
envValueFrom: {}
1246
# ENV_NAME:
1247
# configMapKeyRef:
1248
# name: configmap-name
1249
# key: value_key
1250
# Do not reprocess already processed unchanged resources on k8s API reconnect.
1251
# ignoreAlreadyProcessed: true
1252
# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify
1253
# skipTlsVerify: true
1254
# label that the configmaps with datasources are marked with (can be templated)
1255
label: grafana_datasource
1256
# value of label that the configmaps with datasources are set to (can be templated)
1257
labelValue: ""
1258
# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.
1259
# logLevel: INFO
1260
# If specified, the sidecar will search for datasource config-maps inside this namespace.
1261
# Otherwise the namespace in which the sidecar is running will be used.
1262
# It's also possible to specify ALL to search in all namespaces
1263
searchNamespace: null
1264
# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
1265
watchMethod: WATCH
1266
# search in configmap, secret or both
1267
resource: both
1268
#
1269
# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.
1270
# per default all resources of the type defined in {{ .Values.sidecar.datasources.resource }} will be checked.
1271
# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.
1272
# resourceName: "secret/datasources-0,configmap/datasources-15"
1273
resourceName: ""
1274
#
1275
# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.
1276
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S
1277
# watchServerTimeout: 3600
1278
#
1279
# watchClientTimeout: is a client-side timeout, configuring your local socket.
1280
# If you have a network outage dropping all packets with no RST/FIN,
1281
# this is how long your client waits before realizing & dropping the connection.
1282
# defaults to 66sec (sic!)
1283
# watchClientTimeout: 60
1284
#
1285
# maxTotalRetries: Total number of retries to allow for any http request.
1286
# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.
1287
# Set to 0 to fail on the first retry.
1288
# maxTotalRetries: 5
1289
#
1290
# maxConnectRetries: How many connection-related errors to retry on for any http request.
1291
# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.
1292
# Applies to all requests to reloadURL and k8s api requests.
1293
# Set to 0 to fail on the first retry of this type.
1294
# maxConnectRetries: 10
1295
#
1296
# maxReadRetries: How many times to retry on read errors for any http request
1297
# These errors are raised after the request was sent to the server, so the request may have side-effects.
1298
# Applies to all requests to reloadURL and k8s api requests.
1299
# Set to 0 to fail on the first retry of this type.
1300
# maxReadRetries: 5
1301
#
1302
# Endpoint to send request to reload datasources
1303
reloadURL: "http://localhost:3000/api/admin/provisioning/datasources/reload"
1304
# Absolute path to a script to execute after a configmap got reloaded.
1305
# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.
1306
# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python
1307
script: null
1308
skipReload: false
1309
# This is needed if skipReload is true, to load any datasources defined at startup time.
1310
# Deploy the datasources sidecar as an initContainer.
1311
initDatasources: false
1312
# Use native sidecar https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/
1313
# restartPolicy: Always
1314
# # only applies to native sidecars
1315
# startupProbe:
1316
# httpGet:
1317
# path: /healthz
1318
# port: 8081
1319
# initialDelaySeconds: 5
1320
# periodSeconds: 5
1321
# failureThreshold: 60 # 5 minutes
1322
# Additional datasources sidecar volume mounts
1323
extraMounts: []
1324
# Sets the size limit of the datasource sidecar emptyDir volume
1325
sizeLimit: ""
1326
plugins:
1327
enabled: false
1328
# Additional environment variables for the plugins sidecar
1329
env: {}
1330
# Do not reprocess already processed unchanged resources on k8s API reconnect.
1331
# ignoreAlreadyProcessed: true
1332
# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify
1333
# skipTlsVerify: true
1334
# label that the configmaps with plugins are marked with (can be templated)
1335
label: grafana_plugin
1336
# value of label that the configmaps with plugins are set to (can be templated)
1337
labelValue: ""
1338
# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.
1339
# logLevel: INFO
1340
# If specified, the sidecar will search for plugin config-maps inside this namespace.
1341
# Otherwise the namespace in which the sidecar is running will be used.
1342
# It's also possible to specify ALL to search in all namespaces
1343
searchNamespace: null
1344
# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
1345
watchMethod: WATCH
1346
# search in configmap, secret or both
1347
resource: both
1348
#
1349
# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.
1350
# per default all resources of the type defined in {{ .Values.sidecar.plugins.resource }} will be checked.
1351
# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.
1352
# resourceName: "secret/plugins-0,configmap/plugins-1"
1353
resourceName: ""
1354
#
1355
# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.
1356
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S
1357
# watchServerTimeout: 3600
1358
#
1359
# watchClientTimeout: is a client-side timeout, configuring your local socket.
1360
# If you have a network outage dropping all packets with no RST/FIN,
1361
# this is how long your client waits before realizing & dropping the connection.
1362
# defaults to 66sec (sic!)
1363
# watchClientTimeout: 60
1364
#
1365
# maxTotalRetries: Total number of retries to allow for any http request.
1366
# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.
1367
# Set to 0 to fail on the first retry.
1368
# maxTotalRetries: 5
1369
#
1370
# maxConnectRetries: How many connection-related errors to retry on for any http request.
1371
# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.
1372
# Applies to all requests to reloadURL and k8s api requests.
1373
# Set to 0 to fail on the first retry of this type.
1374
# maxConnectRetries: 10
1375
#
1376
# maxReadRetries: How many times to retry on read errors for any http request
1377
# These errors are raised after the request was sent to the server, so the request may have side-effects.
1378
# Applies to all requests to reloadURL and k8s api requests.
1379
# Set to 0 to fail on the first retry of this type.
1380
# maxReadRetries: 5
1381
#
1382
# Endpoint to send request to reload plugins
1383
reloadURL: "http://localhost:3000/api/admin/provisioning/plugins/reload"
1384
# Absolute path to a script to execute after a configmap got reloaded.
1385
# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.
1386
# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python
1387
script: null
1388
skipReload: false
1389
# Deploy the datasource sidecar as an initContainer in addition to a container.
1390
# This is needed if skipReload is true, to load any plugins defined at startup time.
1391
initPlugins: false
1392
# Additional plugins sidecar volume mounts
1393
extraMounts: []
1394
# Sets the size limit of the plugin sidecar emptyDir volume
1395
sizeLimit: ""
1396
notifiers:
1397
enabled: false
1398
# Additional environment variables for the notifierssidecar
1399
env: {}
1400
# Do not reprocess already processed unchanged resources on k8s API reconnect.
1401
# ignoreAlreadyProcessed: true
1402
# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify
1403
# skipTlsVerify: true
1404
# label that the configmaps with notifiers are marked with (can be templated)
1405
label: grafana_notifier
1406
# value of label that the configmaps with notifiers are set to (can be templated)
1407
labelValue: ""
1408
# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.
1409
# logLevel: INFO
1410
# If specified, the sidecar will search for notifier config-maps inside this namespace.
1411
# Otherwise the namespace in which the sidecar is running will be used.
1412
# It's also possible to specify ALL to search in all namespaces
1413
searchNamespace: null
1414
# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
1415
watchMethod: WATCH
1416
# search in configmap, secret or both
1417
resource: both
1418
#
1419
# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.
1420
# per default all resources of the type defined in {{ .Values.sidecar.notifiers.resource }} will be checked.
1421
# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.
1422
# resourceName: "secret/notifiers-2,configmap/notifiers-1"
1423
resourceName: ""
1424
#
1425
# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.
1426
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S
1427
# watchServerTimeout: 3600
1428
#
1429
# watchClientTimeout: is a client-side timeout, configuring your local socket.
1430
# If you have a network outage dropping all packets with no RST/FIN,
1431
# this is how long your client waits before realizing & dropping the connection.
1432
# defaults to 66sec (sic!)
1433
# watchClientTimeout: 60
1434
#
1435
# maxTotalRetries: Total number of retries to allow for any http request.
1436
# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.
1437
# Set to 0 to fail on the first retry.
1438
# maxTotalRetries: 5
1439
#
1440
# maxConnectRetries: How many connection-related errors to retry on for any http request.
1441
# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.
1442
# Applies to all requests to reloadURL and k8s api requests.
1443
# Set to 0 to fail on the first retry of this type.
1444
# maxConnectRetries: 10
1445
#
1446
# maxReadRetries: How many times to retry on read errors for any http request
1447
# These errors are raised after the request was sent to the server, so the request may have side-effects.
1448
# Applies to all requests to reloadURL and k8s api requests.
1449
# Set to 0 to fail on the first retry of this type.
1450
# maxReadRetries: 5
1451
#
1452
# Endpoint to send request to reload notifiers
1453
reloadURL: "http://localhost:3000/api/admin/provisioning/notifications/reload"
1454
# Absolute path to a script to execute after a configmap got reloaded.
1455
# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.
1456
# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python
1457
script: null
1458
skipReload: false
1459
# Deploy the notifier sidecar as an initContainer in addition to a container.
1460
# This is needed if skipReload is true, to load any notifiers defined at startup time.
1461
initNotifiers: false
1462
# Use native sidecar https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/
1463
# restartPolicy: Always
1464
# # only applies to native sidecars
1465
# startupProbe:
1466
# httpGet:
1467
# path: /healthz
1468
# port: 8082
1469
# initialDelaySeconds: 5
1470
# periodSeconds: 5
1471
# failureThreshold: 60 # 5 minutes
1472
# Additional notifiers sidecar volume mounts
1473
extraMounts: []
1474
# Sets the size limit of the notifier sidecar emptyDir volume
1475
sizeLimit: ""
1476
## Override the deployment namespace
1477
##
1478
namespaceOverride: ""
1479
## Number of old ReplicaSets to retain
1480
##
1481
revisionHistoryLimit: 10
1482
## Add a separate remote image renderer deployment/service
1483
imageRenderer:
1484
deploymentStrategy: {}
1485
## The maximum time in seconds for the image renderer Deployment to make progress before it is
1486
## considered to be failed.
1487
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds
1488
progressDeadlineSeconds: null
1489
# Enable the image-renderer deployment & service
1490
enabled: false
1491
replicas: 1
1492
autoscaling:
1493
enabled: false
1494
minReplicas: 1
1495
maxReplicas: 5
1496
targetCPU: "60"
1497
targetMemory: ""
1498
behavior: {}
1499
# The url of remote image renderer if it is not in the same namespace with the grafana instance
1500
serverURL: ""
1501
# The callback url of grafana instances if it is not in the same namespace with the remote image renderer
1502
renderingCallbackURL: ""
1503
# Token used for authentication between Grafana and the remote image renderer.
1504
token: ""
1505
# Use an existing secret for the image renderer token. Must contain a key named "token".
1506
existingSecret: ""
1507
image:
1508
# -- The Docker registry
1509
registry: cgr.dev
1510
# image-renderer Image repository
1511
repository: chainguard-private/grafana-image-renderer
1512
# image-renderer Image tag
1513
tag: 5.12.3-r1
1514
# image-renderer Image sha (optional)
1515
sha: sha256:4d57f312418d484942fc9c184a14f7f4c83b6ee754a03b88378c70ddfa27bcaf
1516
# image-renderer Image pull secrets (optional)
1517
pullSecrets: []
1518
# image-renderer ImagePullPolicy
1519
pullPolicy: Always
1520
dnsPolicy: ~
1521
dnsConfig: {}
1522
# nameservers:
1523
# - 8.8.8.8
1524
# options:
1525
# - name: ndots
1526
# value: "2"
1527
# - name: edns0
1528
# extra environment variables
1529
env:
1530
HTTP_HOST: "0.0.0.0"
1531
# Fixes "Error: Failed to launch the browser process!\nchrome_crashpad_handler: --database is required"
1532
XDG_CONFIG_HOME: /tmp/.chromium
1533
XDG_CACHE_HOME: /tmp/.chromium
1534
# RENDERING_ARGS: --no-sandbox,--disable-gpu,--window-size=1280x758
1535
# RENDERING_MODE: clustered
1536
# IGNORE_HTTPS_ERRORS: true
1537
## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.
1538
## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core
1539
## Renders in container spec as:
1540
## env:
1541
## ...
1542
## - name: <key>
1543
## valueFrom:
1544
## <value rendered as YAML>
1545
envValueFrom: {}
1546
# ENV_NAME:
1547
# configMapKeyRef:
1548
# name: configmap-name
1549
# key: value_key
1550
1551
# image-renderer deployment serviceAccount
1552
serviceAccountName: ""
1553
automountServiceAccountToken: false
1554
# image-renderer deployment hostUsers
1555
hostUsers: ~
1556
# image-renderer deployment securityContext
1557
securityContext: {}
1558
# image-renderer deployment container securityContext
1559
containerSecurityContext:
1560
seccompProfile:
1561
type: RuntimeDefault
1562
capabilities:
1563
drop: ['ALL']
1564
allowPrivilegeEscalation: false
1565
readOnlyRootFilesystem: true
1566
## image-renderer pod annotation
1567
podAnnotations: {}
1568
# image-renderer deployment Host Aliases
1569
hostAliases: []
1570
# image-renderer deployment priority class
1571
priorityClassName: ''
1572
# Path to the healthcheck endpoint. On Image Renderer v5.0.0 or newer, this is '/healthz'. Older versions use '/'.
1573
healthcheckPath: '/healthz'
1574
service:
1575
# Enable the image-renderer service
1576
enabled: true
1577
# image-renderer service port name
1578
portName: 'http'
1579
# image-renderer service port used by both service and deployment
1580
port: 8081
1581
targetPort: 8081
1582
# Adds the appProtocol field to the image-renderer service. This allows to work with istio protocol selection. Ex: "http" or "tcp"
1583
appProtocol: ""
1584
serviceMonitor:
1585
## If true, a ServiceMonitor CRD is created for a prometheus operator
1586
## https://github.com/coreos/prometheus-operator
1587
##
1588
enabled: false
1589
path: /metrics
1590
# namespace: monitoring (defaults to use the namespace this chart is deployed to)
1591
labels: {}
1592
# Set these to override the Prometheus global scrape interval/timeout.
1593
# interval: 1m
1594
# scrapeTimeout: 30s
1595
scheme: http
1596
tlsConfig: {}
1597
relabelings: []
1598
# See: https://doc.crds.dev/github.com/prometheus-operator/kube-prometheus/monitoring.coreos.com/ServiceMonitor/v1@v0.11.0#spec-targetLabels
1599
targetLabels: []
1600
# - targetLabel1
1601
# - targetLabel2
1602
# If https is enabled in Grafana, this needs to be set as 'https' to correctly configure the callback used in Grafana
1603
grafanaProtocol: http
1604
# In case a sub_path is used this needs to be added to the image renderer callback
1605
grafanaSubPath: ""
1606
# name of the image-renderer port on the pod
1607
podPortName: http
1608
# number of image-renderer replica sets to keep
1609
revisionHistoryLimit: 10
1610
networkPolicy:
1611
# Enable a NetworkPolicy to limit inbound traffic to only the created grafana pods
1612
limitIngress: true
1613
# Enable a NetworkPolicy to limit outbound traffic to only the created grafana pods
1614
limitEgress: false
1615
# Allow additional services to access image-renderer (eg. Prometheus operator when ServiceMonitor is enabled)
1616
extraIngressSelectors: []
1617
resources: {}
1618
# limits:
1619
# cpu: 100m
1620
# memory: 100Mi
1621
# requests:
1622
# cpu: 50m
1623
# memory: 50Mi
1624
## Node labels for pod assignment
1625
## ref: https://kubernetes.io/docs/user-guide/node-selection/
1626
#
1627
nodeSelector: {}
1628
## Tolerations for pod assignment
1629
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
1630
##
1631
tolerations: []
1632
## Affinity for pod assignment (evaluated as template)
1633
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
1634
##
1635
affinity: {}
1636
## Use an alternate scheduler, e.g. "stork".
1637
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
1638
##
1639
# schedulerName: "default-scheduler"
1640
1641
# Extra configmaps to mount in image-renderer pods
1642
extraConfigmapMounts: []
1643
# Extra secrets to mount in image-renderer pods
1644
extraSecretMounts: []
1645
# Extra volumes to mount in image-renderer pods
1646
extraVolumeMounts: []
1647
# Extra volumes for image-renderer pods
1648
extraVolumes: []
1649
networkPolicy:
1650
# -- networkPolicy.enabled Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
1651
enabled: false
1652
# --networkPolicy.allowExternal Don't require client label for connections
1653
# The Policy model to apply. When set to false, only pods with the correct
1654
# client label will have network access to grafana port defined.
1655
# When true, grafana will accept connections from any source
1656
# (with the correct destination port).
1657
#
1658
ingress: true
1659
# -- networkPolicy.ingress When true enables the creation
1660
# an ingress network policy
1661
allowExternal: true
1662
# -- networkPolicy.explicitNamespacesSelector A Kubernetes LabelSelector to explicitly select namespaces from which traffic could be allowed
1663
# If explicitNamespacesSelector is missing or set to {}, only client Pods that are in the networkPolicy's namespace
1664
# and that match other criteria, the ones that have the good label, can reach the grafana.
1665
# But sometimes, we want the grafana to be accessible to clients from other namespaces, in this case, we can use this
1666
# LabelSelector to select these namespaces, note that the networkPolicy's namespace should also be explicitly added.
1667
# </br>
1668
#
1669
# Example:
1670
#
1671
# ```
1672
# explicitNamespacesSelector:
1673
# matchLabels:
1674
# role: frontend
1675
# matchExpressions:
1676
# - {key: role, operator: In, values: [frontend]}
1677
# ```
1678
explicitNamespacesSelector: {}
1679
# -- networkPolicy.explicitIpBlocks List of CIDR blocks allowed as ingress sources.
1680
# Each entry must be a valid CIDR notation string (e.g. 10.0.0.0/8).
1681
# When defined, the specified CIDR ranges are added to the ingress `from` rules
1682
# using `ipBlock` entries and complement the other configured ingress sources.
1683
# </br>
1684
#
1685
# Example:
1686
#
1687
# ```
1688
# explicitIpBlocks:
1689
# - 35.191.0.0/16
1690
# - 130.211.0.0/22
1691
# ```
1692
#
1693
explicitIpBlocks: []
1694
egress:
1695
# -- networkPolicy.egress.enabled When enabled, an egress network policy will be
1696
# created allowing grafana to connect to external data sources from kubernetes cluster.
1697
enabled: false
1698
# -- networkPolicy.egress.blockDNSResolution When enabled, DNS resolution will be blocked
1699
# for all pods in the grafana namespace.
1700
blockDNSResolution: false
1701
# -- networkPolicy.egress.ports Add individual ports to be allowed by the egress
1702
ports: []
1703
# Add ports to the egress by specifying - port: <port number>
1704
# E.X.
1705
# - port: 80
1706
# - port: 443
1707
#
1708
# -- networkPolicy.egress.to Allow egress traffic to specific destinations
1709
to: []
1710
# -- destinations to the egress by specifying - ipBlock: <CIDR>
1711
# E.X.
1712
# to:
1713
# - namespaceSelector:
1714
# matchExpressions:
1715
# - {key: role, operator: In, values: [grafana]}
1716
# Enable backward compatibility of kubernetes where version below 1.13 doesn't have the enableServiceLinks option
1717
enableKubeBackwardCompatibility: false
1718
useStatefulSet: false
1719
# extraObjects could be utilized to add dynamic manifests via values
1720
extraObjects: []
1721
# Examples:
1722
# extraObjects:
1723
# - apiVersion: kubernetes-client.io/v1
1724
# kind: ExternalSecret
1725
# metadata:
1726
# name: grafana-secrets-{{ .Release.Name }}
1727
# spec:
1728
# backendType: gcpSecretsManager
1729
# data:
1730
# - key: grafana-admin-password
1731
# name: adminPassword
1732
# Alternatively, you can use strings, which lets you use additional templating features:
1733
# extraObjects:
1734
# - |
1735
# apiVersion: kubernetes-client.io/v1
1736
# kind: ExternalSecret
1737
# metadata:
1738
# name: grafana-secrets-{{ .Release.Name }}
1739
# spec:
1740
# backendType: gcpSecretsManager
1741
# data:
1742
# - key: grafana-admin-password
1743
# name: {{ include "some-other-template" }}
1744
1745
# assertNoLeakedSecrets is a helper function defined in _helpers.tpl that checks if secret
1746
# values are not exposed in the rendered grafana.ini configmap. It is enabled by default.
1747
#
1748
# To pass values into grafana.ini without exposing them in a configmap, use variable expansion:
1749
# https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion
1750
#
1751
# Alternatively, if you wish to allow secret values to be exposed in the rendered grafana.ini configmap,
1752
# you can disable this check by setting assertNoLeakedSecrets to false.
1753
assertNoLeakedSecrets: true
1754
# updateMode options are:
1755
# Off: n the Off update mode, the VPA recommender still analyzes resource usage and generates recommendations, but these recommendations are not automatically applied to Pods. The recommendations are only stored in the VPA object's .status field.
1756
# Initial: In Initial mode, VPA only sets resource requests when Pods are first created. It does not update resources for already running Pods, even if recommendations change over time. The recommendations apply only during Pod creation.
1757
# Recreate: In Recreate mode, VPA actively manages Pod resources by evicting Pods when their current resource requests differ significantly from recommendations. When a Pod is evicted, the workload controller (managing a Deployment, StatefulSet, etc) creates a replacement Pod, and the VPA admission controller applies the updated resource requests to the new Pod.
1758
# InPlaceOrRecreate: In Recreate mode, VPA actively manages Pod resources by evicting Pods when their current resource requests differ significantly from recommendations. When a Pod is evicted, the workload controller (managing a Deployment, StatefulSet, etc) creates a replacement Pod, and the VPA admission controller applies the updated resource requests to the new Pod.
1759
# Auto (deprecated): The Auto update mode is deprecated since VPA version 1.4.0. Use Recreate for eviction-based updates, or InPlaceOrRecreate for in-place updates with eviction fallback.
1760
verticalPodAutoscaler:
1761
enabled: false
1762
updateMode: "Off"
1763
controlledResources:
1764
cpu: true
1765
memory: true
1766
# Default safety bounds
1767
minAllowed:
1768
cpu: "25m"
1769
memory: "128Mi"
1770
maxAllowed:
1771
cpu: "1000m"
1772
memory: "1Gi"
1773
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.