victoria-metrics-auth
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Default values for victoria-metrics-auth.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
global:
5
# -- Image pull secrets, that can be shared across multiple helm charts
6
imagePullSecrets: []
7
image:
8
# -- Image registry, that can be shared across multiple helm charts
9
registry: ""
10
# -- Openshift security context compatibility configuration
11
compatibility:
12
openshift:
13
adaptSecurityContext: "auto"
14
cluster:
15
# -- K8s cluster domain suffix, uses for building storage pods' FQDN. Details are [here](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/)
16
dnsDomain: cluster.local.
17
# -- Labels added to all resources
18
extraLabels: {}
19
# -- Annotations added to all resources
20
extraAnnotations: {}
21
# -- Number of replicas of vmauth
22
replicaCount: 1
23
# -- Name of Priority Class
24
priorityClassName: ""
25
# -- Name of the [RuntimeClass](https://kubernetes.io/docs/concepts/containers/runtime-class/) used to run the pod, e.g. "gvisor"
26
runtimeClassName: ""
27
image:
28
# -- Image registry
29
registry: cgr.dev
30
# -- Victoria Metrics Auth Docker repository and image name
31
repository: chainguard-private/victoriametrics-vmauth
32
# -- Tag of Docker image
33
tag: 1.152.0-r0@sha256:6060f5a8988bed02cb887fcb588437e2a3ae0354ea8b3bba2dd50cf2ee058c03
34
# -- Variant of the image to use.
35
# e.g. enterprise, scratch
36
variant: ""
37
# -- Pull policy of Docker image
38
pullPolicy: IfNotPresent
39
# -- Override default container command. Use when the VictoriaMetrics binary is available at a custom path
40
command: []
41
# -- Image pull secrets
42
imagePullSecrets: []
43
# -- Override chart name
44
nameOverride: ""
45
# -- Override resources fullname
46
fullnameOverride: ""
47
containerWorkingDir: "/"
48
# -- Specify pod lifecycle
49
lifecycle: {}
50
# -- Init containers for vmauth
51
initContainers: []
52
# - name: example
53
# image: example-image
54
55
serviceAccount:
56
# -- Specifies whether a service account should be created
57
create: true
58
# -- Annotations to add to the service account
59
annotations: {}
60
# -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template
61
name:
62
# -- See `kubectl explain poddisruptionbudget.spec` for more. Official guide is [here](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
63
podDisruptionBudget:
64
enabled: false
65
# -- min number or percentage of pods that can be unavailable
66
minAvailable: 0
67
# -- max number or percentage of pods that can be unavailable
68
maxUnavailable: 0
69
# -- Defines criteria when unhealthy pods should be considered for eviction
70
unhealthyPodEvictionPolicy:
71
labels: {}
72
# -- See `kubectl explain networkpolicy.spec` for more. Details are [here](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
73
networkPolicy:
74
enabled: false
75
# -- Ingress rules
76
ingress: []
77
# -- Egress rules
78
egress: []
79
# -- Extra labels for NetworkPolicy
80
labels: {}
81
# -- Extra annotations for NetworkPolicy
82
annotations: {}
83
# -- HTTP listen address configuration. See https://docs.victoriametrics.com/helm/victoria-metrics-auth/#http-listen-address for details.
84
http:
85
- name: http
86
value: :8427
87
primary: true
88
# -- Extra command line arguments for container of component
89
extraArgs:
90
envflag.enable: true
91
envflag.prefix: VM_
92
loggerFormat: json
93
# Enable IPv6 support. Useful for running in IPv6-only Kubernetes clusters
94
# enableTCP6: true
95
# -- Additional environment variables (ex.: secret tokens, flags). Check [here](https://docs.victoriametrics.com/victoriametrics/#environment-variables) for details
96
env: []
97
# -- Pod topologySpreadConstraints
98
topologySpreadConstraints: []
99
# - maxSkew: 1
100
# topologyKey: topology.kubernetes.io/zone
101
# whenUnsatisfiable: DoNotSchedule
102
103
# -- Specify alternative source for env variables
104
envFrom: []
105
#- configMapRef:
106
# name: special-config
107
108
# -- Additional hostPath mounts
109
extraHostPathMounts: []
110
# - name: certs-dir
111
# mountPath: /etc/kubernetes/certs
112
# subPath: ""
113
# hostPath: /etc/kubernetes/certs
114
# readOnly: true
115
116
# -- Extra Volumes for the pod
117
extraVolumes: []
118
# - name: example
119
# configMap:
120
# name: example
121
122
# -- Extra Volume Mounts for the container
123
extraVolumeMounts: []
124
# - name: example
125
# mountPath: /example
126
127
# -- Extra containers to run in a pod with vmauth
128
extraContainers: []
129
# - name: config-reloader
130
# image: reloader-image
131
132
# -- Pod's security context. Details are [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
133
podSecurityContext:
134
enabled: true
135
# fsGroup: 2000
136
# -- Container security context. Check [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) for details.
137
securityContext:
138
enabled: true
139
# capabilities:
140
# drop:
141
# - ALL
142
# readOnlyRootFilesystem: true
143
# runAsNonRoot: true
144
# runAsUser: 1000
145
service:
146
# -- Service traffic distribution. Details are [here](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution)
147
trafficDistribution: ""
148
# -- Enable vmauth service
149
enabled: true
150
# -- Service annotations
151
annotations: {}
152
# -- Service labels
153
extraLabels: {}
154
# -- Service ClusterIP
155
clusterIP: ""
156
# -- Service external IPs. Check [here](https://kubernetes.io/docs/concepts/services-networking/service/#external-ips) for details
157
externalIPs: []
158
# -- Service load balancer IP
159
loadBalancerIP: ""
160
# -- Load balancer source range
161
loadBalancerSourceRanges: []
162
# -- Service port
163
servicePort: ""
164
# nodePort: 30000
165
# -- Service type
166
type: ClusterIP
167
# -- Service external traffic policy. Check [here](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) for details
168
externalTrafficPolicy: ""
169
# -- Health check node port for a service. Check [here](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) for details
170
healthCheckNodePort: ""
171
# -- Service IP family policy. Check [here](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services) for details.
172
ipFamilyPolicy: ""
173
# -- List of service IP families. Check [here](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services) for details.
174
ipFamilies: []
175
route:
176
# -- Enable deployment of HTTPRoute for VMAuth
177
enabled: false
178
# -- HTTPRoute annotations
179
annotations: {}
180
# -- HTTPRoute extra labels
181
extraLabels: {}
182
# -- HTTPGateway objects refs
183
parentRefs: []
184
# -- Array of hostnames
185
hostnames: []
186
# -- Extra rules to prepend to route. This is useful when working with annotation based services.
187
extraRules: []
188
# -- Filters for a default rule in HTTPRoute
189
filters: []
190
# -- Matches for a default rule in HTTPRoute
191
matches:
192
- path:
193
type: PathPrefix
194
value: /
195
ingress:
196
# -- Enable deployment of ingress for vmauth component
197
enabled: false
198
# -- Ingress annotations
199
annotations: {}
200
# kubernetes.io/ingress.class: nginx
201
# kubernetes.io/tls-acme: 'true'
202
203
# -- Ingress extra labels
204
extraLabels: {}
205
# -- Array of host objects
206
hosts:
207
- name: vmauth.local
208
path:
209
- /
210
port: http
211
# -- Array of TLS objects
212
tls: []
213
# - secretName: vmauth-ingress-tls
214
# hosts:
215
# - vmauth.local
216
217
# -- Ingress controller class name
218
ingressClassName: ""
219
# -- Ingress path type
220
pathType: Prefix
221
ingressInternal:
222
# -- Enable deployment of internal ingress for vmauth component
223
enabled: false
224
# -- Ingress annotations
225
annotations: {}
226
# kubernetes.io/ingress.class: nginx
227
# kubernetes.io/tls-acme: 'true'
228
229
# -- Ingress extra labels
230
extraLabels: {}
231
# -- Array of host objects
232
hosts:
233
- name: vmauth.local
234
path:
235
- /
236
port: http
237
# -- Array of TLS objects
238
tls: []
239
# - secretName: vmauth-ingress-tls
240
# hosts:
241
# - vmauth.local
242
243
# -- Ingress controller class name
244
ingressClassName: ""
245
# -- Ingress path type
246
pathType: Prefix
247
# -- We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after `resources:`.
248
resources: {}
249
# limits:
250
# cpu: 100m
251
# memory: 128Mi
252
# requests:
253
# cpu: 100m
254
# memory: 128Mi
255
256
# -- Annotations to be added to the deployment
257
annotations: {}
258
# -- Annotations to be added to pod
259
podAnnotations: {}
260
# -- Labels to be added to pod
261
podLabels: {}
262
# -- Labels to be added to the deployment
263
extraLabels: {}
264
# -- Custom DNS config for pod. Details are [here](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-config)
265
dnsConfig: {}
266
# -- NodeSelector configurations. Check [here](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) for details
267
nodeSelector: {}
268
# -- Tolerations configurations. Check [here](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) for details
269
tolerations: []
270
# - key: "key"
271
# operator: "Equal|Exists"
272
# value: "value"
273
# effect: "NoSchedule|PreferNoSchedule"
274
275
# -- Affinity configurations
276
affinity: {}
277
# -- vmauth mode: deployment, daemonSet
278
mode: deployment
279
# -- [K8s DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) specific variables
280
daemonSet:
281
spec: {}
282
# -- [K8s Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) specific variables
283
deployment:
284
spec:
285
strategy:
286
type: RollingUpdate
287
serviceMonitor:
288
# -- Enable deployment of Service Monitor for server component. This is Prometheus operator object
289
enabled: false
290
# -- Service Monitor labels
291
extraLabels: {}
292
# -- Service Monitor annotations
293
annotations: {}
294
# -- Service Monitor relabelings
295
relabelings: []
296
# -- Basic auth params for Service Monitor
297
basicAuth: {}
298
# -- Service Monitor metricRelabelings
299
metricRelabelings: []
300
# -- Service Monitor port. Uses primary http item name by default
301
port: ""
302
# -- Service Monitor target port. Overrides port when set
303
targetPort: ""
304
# interval: 15s
305
# scrapeTimeout: 5s
306
# -- Commented. HTTP scheme to use for scraping.
307
# scheme: https
308
# -- Commented. TLS configuration to use when scraping the endpoint
309
# tlsConfig:
310
# insecureSkipVerify: true
311
312
# -- Use existing secret if specified otherwise .config values will be used. Check [here](https://docs.victoriametrics.com/victoriametrics/vmauth/) for details.
313
# Configuration in the given secret must be stored under `auth.yml` key.
314
secretName: ""
315
# -- Config file content.
316
config:
317
# Arbitrary number of usernames may be put here.
318
# Usernames must be unique.
319
# users:
320
# The user for querying local single-node VictoriaMetrics.
321
# All the requests to http://vmauth:8427 with the given Basic Auth (username:password)
322
# will be routed to http://localhost:8428 .
323
# For example, http://vmauth:8427/api/v1/query is routed to http://localhost:8428/api/v1/query
324
# - username: "local-single-node"
325
# password: "***"
326
# url_prefix: "http://localhost:8428"
327
328
# The user for querying account 123 in VictoriaMetrics cluster
329
# See https://github.com/VictoriaMetrics/VictoriaMetrics/blob/cluster/README.md#url-format
330
# All the requests to http://vmauth:8427 with the given Basic Auth (username:password)
331
# will be routed to http://vmselect:8481/select/123/prometheus .
332
# For example, http://vmauth:8427/api/v1/query is routed to http://vmselect:8481/select/123/prometheus/api/v1/select
333
# - username: "cluster-select-account-123"
334
# password: "***"
335
# url_prefix: "http://vmselect:8481/select/123/prometheus"
336
337
# The user for inserting Prometheus data into VictoriaMetrics cluster under account 42
338
# See https://github.com/VictoriaMetrics/VictoriaMetrics/blob/cluster/README.md#url-format
339
# All the requests to http://vmauth:8427 with the given Basic Auth (username:password)
340
# will be routed to http://vminsert:8480/insert/42/prometheus .
341
# For example, http://vmauth:8427/api/v1/write is routed to http://vminsert:8480/insert/42/prometheus/api/v1/write
342
# - username: "cluster-insert-account-42"
343
# password: "***"
344
# url_prefix: "http://vminsert:8480/insert/42/prometheus"
345
346
# -- Raw config file content. Overrides `.Values.config` when set. Supports Helm templating,
347
# YAML anchors, and comments.
348
configRaw: ""
349
# -- Annotations for config secret
350
configAnnotations: {}
351
# -- Add extra specs dynamically to this chart
352
extraObjects: []
353
probe:
354
# -- Readiness probe
355
readiness:
356
tcpSocket: {}
357
initialDelaySeconds: 5
358
periodSeconds: 15
359
# -- Liveness probe
360
liveness:
361
tcpSocket: {}
362
initialDelaySeconds: 5
363
periodSeconds: 15
364
timeoutSeconds: 5
365
# -- Startup probe
366
startup: {}
367
# -- Enterprise license key configuration for VictoriaMetrics enterprise.
368
# Required only for VictoriaMetrics enterprise. Check docs [here](https://docs.victoriametrics.com/victoriametrics/enterprise/),
369
# for more information, visit [site](https://victoriametrics.com/products/enterprise/).
370
# Request a trial license [here](https://victoriametrics.com/products/enterprise/trial/)
371
# Supported starting from VictoriaMetrics v1.94.0
372
license:
373
# -- License key
374
key: ""
375
# -- Use existing secret with license key
376
secret:
377
# -- Existing secret name
378
name: ""
379
# -- Key in secret with license key
380
key: ""
381
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.