portieris

# Default values for portieris.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

replicaCount: 3

# Annotations to add to the Portieris deployment. Optional.

deploymentAnnotations: {}

# secret.reloader.stakater.com/reload: "portieris-certs"

# Annotations to add to the Portieris deployment's pod template. Optional.

podAnnotations: {}

# sidecar.istio.io/inject: "false"

image:

host: cgr.dev

pullSecret:

image: chainguard-private/portieris

tag: 0.15.1-r0@sha256:6fa8858219dc8e14e3200615f07157bf6066ef77becb3a39a09fe48e739ba022

pullPolicy: Always

service:

type: ClusterIP

port: 443

targetPort: 8000

metricsPort: 8080

securityContext:

runAsUser: 1000060001

webHooks:

failurePolicy: Fail

# Define policySet to install the default policies

# Possible values: IKS | None

PolicySet: None

# If managing portieris-certs secret externally

SkipSecretCreation: false

# If using cert-manager to handle secrets

UseCertManager: false

certManagerIssuer:

skipCreation: false

kind: Issuer

name: portieris

## Use generated certs from values file.

## Ref: https://github.com/IBM/portieris/blob/main/helm/portieris/gencerts

##

UseGeneratedCerts:

enabled: false

tlsCert: ""

tlsKey: ""

caCert: ""

# Kubernetes API client rate limits.

# Leave unset to use the client-go defaults (QPS=5, Burst=10)

# If only one is set, the other is derived automatically using a 2:1 burst-to-QPS ratio

# Example for a busy ROKS cluster would be qps: 50, burst: 100

kubeClientRateLimits:

qps:

burst:

# Resoures defined to assist scheduling

# request is typical x10, limit is typical x100

resources:

limits:

cpu: 400m

memory: 600Mi

requests:

cpu: 40m

memory: 60Mi

nodeSelector: {}

tolerations: []

# Affinity settings

# the `podAntiAffinity` defined here results in the distribution of pods over nodes where possible

# intended to improve availability in the face of node and zone instability, reducing the potential of admission deadlock

affinity:

podAntiAffinity:

preferredDuringSchedulingIgnoredDuringExecution:

- podAffinityTerm:

labelSelector:

matchExpressions:

- key: app

operator: In

values:

- portieris

topologyKey: kubernetes.io/hostname

weight: 50

- podAffinityTerm:

labelSelector:

matchExpressions:

- key: app

operator: In

values:

- portieris

topologyKey: topology.kubernetes.io/zone

weight: 50

# Allow an annotation to be used to skip the webhook. This is required for Portieris to be able to

# self heal when it has no running pods, which could otherwise deadlock your cluster after an

# outage.

# However, if this is enabled, anyone with access to annotate namespaces could bypass Portieris by

# setting the annotation on their namespaces. Therefore, be careful with your RBAC policies if you

# enable this option!

AllowAdmissionSkip: false

ObjectSelectorAdmissionSkip:

# matchLabels:

# app: xxx

# matchExpressions:

# - key: xxxxx.xxxxx/xxx

# operator: NotIn

# values:

# - xxxx

NamespaceSelectorAdmissionSkip:

#- key: kubernetes.io/metadata.name

# operator: NotIn

# values:

# - kube-system

clusterPolicy:

allowedRepositories:

# This permissive policy allows all images in namespaces which do not have an ImagePolicy.

# IMPORTANT: Review this policy and replace it with one that meets your requirements.

- name: "*"

# use hostNetwork for Portieris webhook

useHostNetwork: false

# Set podPriorityClass of the portieris deployment. This will tell kube api to schedule the pods as high priority and stop timing issues where applications try to start before the webhook is available

priorityClass: system-cluster-critical

# Specifying a Disruption Budget for portieris pod

# https://kubernetes.io/docs/tasks/run-application/configure-pdb/

podDisruptionBudget:

enabled: true

minAvailable: 1

# Service selector includes release in addition to app

selectByRelease: true