pyrra
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# -- specifies pull secrets for image repository
2
imagePullSecrets: []
3
# -- overrides chart name
4
nameOverride: ""
5
# -- Overrides helm-generated chart fullname
6
fullnameOverride: ""
7
# -- Overrides the namespace for all resources (defaults to .Release.Namespace)
8
namespaceOverride: ""
9
image:
10
# -- Overrides the image repository
11
repository: cgr.dev/chainguard-private/pyrra-fips
12
# -- Overrides pullpolicy
13
pullPolicy: IfNotPresent
14
# -- Overrides the image tag
15
tag: 0.10.1-r1@sha256:e0f8b7caa1b05ab98cf1e48bc6ac77324fb015c5afdc011ec0d62c8361967660
16
additionalLabels: {}
17
# app: pyrra
18
19
# -- Extra args for Pyrra's API container
20
extraApiArgs: []
21
# -- Extra args for Pyrra's Kubernetes container
22
extraKubernetesArgs: []
23
# -- Extra Volumes for the pod
24
extraApiVolumes: []
25
# - name: example
26
# configMap:
27
# name: example
28
29
# -- Extra Volume Mounts for the container
30
extraApiVolumeMounts: []
31
# - name: example
32
# mountPath: /example
33
34
# -- Address to expose operator metrics
35
operatorMetricsAddress: ":8080"
36
serviceAccount:
37
# -- Specifies whether a service account should be created
38
create: true
39
# -- Annotations to add to the service account
40
annotations: {}
41
# -- The name of the service account to use, if not set and create is true, a name is generated using the fullname template
42
name: ""
43
# -- Whether pods running as this service account automatically mount the service account token, disabled by default; the pod mounts the token explicitly via `automountServiceAccountToken`.
44
automountServiceAccountToken: false
45
# -- Whether to automount the service account token in the pod, enabled by default because Pyrra's kubernetes container requires Kubernetes API access.
46
automountServiceAccountToken: true
47
# -- additional annotations for pod
48
podAnnotations: {}
49
# -- additional labels for pod
50
podLabels: {}
51
# -- security context for pod
52
podSecurityContext:
53
runAsNonRoot: true
54
seccompProfile:
55
type: RuntimeDefault
56
# -- security context for each container
57
securityContext:
58
allowPrivilegeEscalation: false
59
capabilities:
60
drop:
61
- ALL
62
readOnlyRootFilesystem: true
63
# -- URL to prometheus instance with metrics
64
prometheusUrl: http://prometheus-operated.monitoring.svc.cluster.local:9090
65
# -- URL to public-facing prometheus UI in case it differs from prometheusUrl
66
prometheusExternalUrl: ""
67
# -- HTTP basic auth username for querying Prometheus
68
prometheusBasicAuthUsername: ""
69
# -- Path to a bearer token file for querying Prometheus. Mount the file via extraApiVolumes/extraApiVolumeMounts. For the basic auth password, use extraApiArgs, since Pyrra only accepts it as a plain flag value.
70
prometheusBearerTokenPath: ""
71
# -- Mimir tenant ID (X-Scope-OrgID) the API container sends when querying Prometheus behind Mimir
72
mimirOrgId: ""
73
mimir:
74
# -- URL to the Mimir API. When set, the operator provisions recording rules via the Mimir Ruler
75
# instead of creating PrometheusRule resources. This single key gates the whole Mimir integration —
76
# there is no separate `enabled` flag. Note that Pyrra checks the connection on startup and exits
77
# if Mimir is unreachable, so the operator will CrashLoopBackOff on a wrong URL.
78
url: ""
79
# -- Prefix of the Prometheus API in Mimir
80
prometheusPrefix: prometheus
81
# -- Mimir deployment mode. One of `standalone`, `distributed`.
82
deploymentMode: standalone
83
# -- Provision alerting rules to the Mimir Ruler as well, in addition to recording rules
84
writeAlertingRules: false
85
# -- Mimir tenant ID (X-Scope-OrgID) the operator sends when provisioning rules. Falls back to
86
# `mimirOrgId` when empty, since query and provisioning usually target the same tenant.
87
orgId: ""
88
basicAuth:
89
# -- HTTP basic auth username for the Mimir API
90
username: ""
91
# -- HTTP basic auth password for the Mimir API. The chart renders it into a
92
# `<fullname>-mimir-basic-auth` Secret rather than into the pod spec, but the value still passes
93
# through `values.yaml` and the Helm release. Prefer `existingSecret` in production.
94
password: ""
95
# -- Name of an existing Secret holding the Mimir basic auth password, so the value never passes
96
# through Helm at all. Mutually exclusive with `password`.
97
existingSecret: ""
98
# -- Key inside `existingSecret` holding the password. Only applies to `existingSecret`; the
99
# chart-rendered Secret always uses the key `mimir-basic-auth-password`.
100
existingSecretKey: mimir-basic-auth-password
101
# -- URL to redirect users to the Grafana Explore page instead of Prometheus. Mutually exclusive with prometheusExternalUrl.
102
grafanaExternalUrl: ""
103
# -- Grafana Explore organization ID. Pyrra defaults to "1" when unset.
104
grafanaExternalOrgId: ""
105
# -- Grafana Explore Prometheus datasource ID. Required when grafanaExternalUrl is set.
106
grafanaExternalDatasourceId: ""
107
# -- URL under which the pyrra web server is serving content. this can be set when running behind a reverse proxy.
108
# Must start with a slash and not end with a slash.
109
routePrefix: ""
110
# -- Public-facing URL of the Pyrra UI. When set, the operator adds a pyrra_url annotation with a direct link to the SLO to every generated alert.
111
externalUrl: ""
112
service:
113
# -- Annotations to add to the service
114
annotations: {}
115
# -- service type for server
116
type: ClusterIP
117
# -- service port for server
118
port: 9099
119
# -- service nodePort to expose
120
# node port for HTTP, choose port between <30000-32767>
121
nodePort: ""
122
# -- service port for operator metrics
123
operatorMetricsPort: 8080
124
# -- IP family policy for the service.
125
# Supported values: SingleStack, PreferDualStack, RequireDualStack.
126
# Leave empty to use the Kubernetes cluster default.
127
ipFamilyPolicy: ""
128
# -- Ordered list of IP families assigned to the service.
129
# Supported values: IPv4, IPv6.
130
# When using dual-stack, the first entry becomes the primary IP family.
131
# Leave empty to use the Kubernetes cluster default.
132
ipFamilies: []
133
ingress:
134
# -- enables ingress for server UI
135
enabled: false
136
# -- specifies ingress class name (ie nginx)
137
className: ""
138
# -- additional annotations for ingress
139
annotations: {}
140
# kubernetes.io/ingress.class: nginx
141
# kubernetes.io/tls-acme: "true"
142
hosts:
143
- host: chart-example.local
144
paths:
145
- path: /
146
pathType: ImplementationSpecific
147
tls: []
148
# - secretName: chart-example-tls
149
# hosts:
150
# - chart-example.local
151
# -- Gateway API HTTPRoute configuration. Supports multiple named routes.
152
route:
153
main:
154
# -- enables HTTPRoute for server UI
155
enabled: false
156
# -- Gateway API version
157
apiVersion: gateway.networking.k8s.io/v1
158
# -- Route kind (HTTPRoute or GRPCRoute)
159
kind: HTTPRoute
160
# -- additional annotations for the route
161
annotations: {}
162
# -- additional labels for the route
163
labels: {}
164
# -- hostnames to match for this route
165
hostnames: []
166
# -- parentRefs defines which Gateways this route attaches to
167
parentRefs: []
168
# -- path/header match conditions
169
matches:
170
- path:
171
type: PathPrefix
172
value: /
173
# -- request/response filter configuration
174
filters: []
175
# -- timeout configuration
176
timeouts: {}
177
# -- additional custom rules prepended to the route rules
178
additionalRules: []
179
# -- redirect all traffic to HTTPS (301)
180
httpsRedirect: false
181
# -- resource limits and requests for server pod
182
resources:
183
limits:
184
memory: 128Mi
185
requests:
186
cpu: 10m
187
memory: 128Mi
188
# -- resize policy for the server container (requires Kubernetes 1.27+ with InPlacePodVerticalScaling feature gate)
189
resizePolicy: []
190
# - resourceName: cpu
191
# restartPolicy: NotRequired
192
# - resourceName: memory
193
# restartPolicy: RestartContainer
194
195
# -- All settings related to the "operator" kubernetes container
196
operator:
197
# -- resource limits and requests
198
resources:
199
limits:
200
memory: 128Mi
201
requests:
202
cpu: 10m
203
memory: 128Mi
204
# -- resize policy for the operator container (requires Kubernetes 1.27+ with InPlacePodVerticalScaling feature gate)
205
resizePolicy: []
206
# - resourceName: cpu
207
# restartPolicy: NotRequired
208
# - resourceName: memory
209
# restartPolicy: RestartContainer
210
leaderElection:
211
# -- enables leader election for the operator (required when running multiple replicas)
212
enabled: true
213
# -- namespace where the leader election lease resource will be created (defaults to release namespace)
214
namespace: ""
215
# -- node selector for scheduling server pod
216
nodeSelector: {}
217
# -- tolerations for scheduling server pod
218
tolerations: {}
219
serviceMonitor:
220
# -- enables servicemonitor for server monitoring
221
enabled: false
222
# -- Set labels for the ServiceMonitor, use this to define your scrape label for Prometheus Operator
223
labels: {}
224
# -- provides the possibility to override the jobName if needed
225
jobLabel: ""
226
# -- Set interval for scraping metrics
227
interval: ""
228
# -- Set metric relabelings for the ServiceMonitor
229
metricRelabelings: []
230
# -- Set relabelings for the ServiceMonitor
231
relabelings: []
232
serviceMonitorOperator:
233
# -- enables servicemonitor for operator monitoring
234
enabled: false
235
# -- Set labels for the ServiceMonitor, use this to define your scrape label for Prometheus Operator
236
labels: {}
237
# -- provides the possibility to override the jobName if needed
238
jobLabel: ""
239
# -- Set interval for scraping metrics
240
interval: ""
241
# -- Set metric relabelings for the ServiceMonitor
242
metricRelabelings: []
243
# -- Set relabelings for the ServiceMonitor
244
relabelings: []
245
prometheusRule:
246
# -- enables creation of PrometheusRules to monitor Pyrra
247
enabled: false
248
# -- Set labels that will be applied on all PrometheusRules (alerts)
249
labels: {}
250
pyrraReconciliationError:
251
# -- Set severity for PyrraReconciliationError alert
252
severity: warning
253
genericRules:
254
# -- enables generate Pyrra generic recording rules. Pyrra generates metrics with the same name for each SLO.
255
enabled: false
256
validatingWebhookConfiguration:
257
# -- enables admission webhook for server to validate SLOs, this requires cert-manager to be installed
258
enabled: false
259
# -- 'Fail' or 'Ignore' are valid values
260
failurePolicy: Fail
261
dashboards:
262
# -- enables Grafana dashboards being deployed via configmap
263
enabled: false
264
namespace: ~
265
# -- default value from the Grafana chart
266
label: grafana_dashboard
267
# -- default value from the Grafana chart
268
labelValue: "1"
269
annotations: {}
270
extraLabels: {}
271
# -- Extra Kubernetes objects to deploy with the chart. Supports a list (or map) of manifests, each entry either a YAML map or a templated string rendered with tpl.
272
extraObjects: []
273
# - apiVersion: v1
274
# kind: ConfigMap
275
# metadata:
276
# name: '{{ include "pyrra.fullname" . }}-extra'
277
# data:
278
# key: value
279
# - |
280
# apiVersion: v1
281
# kind: Secret
282
# metadata:
283
# name: {{ include "pyrra.fullname" . }}-secret
284
# stringData:
285
# key: value
286
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.