terdut-operator/charts/terdut-operator/values.yaml

## String to partially override chart.fullname template (will maintain the release name)
##
# nameOverride: ""

## String to fully override chart.fullname template
##
# fullnameOverride: ""

## Configure the controller manager deployment
##
manager:
  ## Set to false to skip manager installation
  ##
  enabled: true

  replicas: 1

  image:
    repository: git.ryuvia.com/niklas/terdut-operator
    ## Image tag (defaults to Chart.appVersion if not set) -- the release
    ## process (`make helm-package`) always passes --app-version from the
    ## tag, so leaving this unset here is what tracks a release correctly.
    ##
    # tag: ""
    pullPolicy: IfNotPresent

  ## Arguments
  ##
  args:
    - --leader-elect

  ## Health probes.
  ## The manager serves the liveness (/healthz) and readiness (/readyz) endpoints on this port.
  ##
  healthProbe:
    # Health probe server port
    port: 8081

  ## Environment variables
  ##
  env:
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace

  ## Env overrides (--set manager.envOverrides.VAR=value)
  ## Same name in env above: this value takes precedence.
  ##
  envOverrides: {}

  ## Image pull secrets
  ##
  # imagePullSecrets:
  #   - name: myregistrykey

  ## Pod-level security settings
  ##
  podSecurityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault

  ## Container-level security settings
  ##
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true

  ## Resource limits and requests
  ##
  resources:
    limits:
      cpu: 500m
      memory: 128Mi
    requests:
      cpu: 10m
      memory: 64Mi

  ## Manager pod's affinity
  ##
  affinity: {}

  ## Manager pod's node selector
  ##
  nodeSelector: {}

  ## Manager pod's tolerations
  ##
  tolerations: []

  ## Deployment strategy
  ##
  # strategy:
  #   type: RollingUpdate
  #   rollingUpdate:
  #     maxSurge: 25%
  #     maxUnavailable: 25%

  ## Priority class name
  ##
  # priorityClassName: ""

  ## Topology spread constraints
  ##
  # topologySpreadConstraints: []

  ## Termination grace period seconds
  ##
  terminationGracePeriodSeconds: 10

  ## Custom Deployment labels
  ##
  # labels: {}

  ## Custom Deployment annotations
  ##
  # annotations: {}

  ## Custom Pod labels and annotations
  ##
  # pod:
  #   labels: {}
  #   annotations: {}

## RBAC configuration
##
rbac:
  ## RBAC resource scope
  ## - false (default): ClusterRole/ClusterRoleBinding (all namespaces)
  ## - true: Role/RoleBinding (release namespace only)
  ##
  namespaced: false

  ## Helper roles for CRD management (admin/editor/viewer)
  ##
  helpers:
    ## Install convenience admin/editor/viewer roles for CRDs
    ##
    enabled: false

## ServiceAccount configuration
##
serviceAccount:
  # Install default ServiceAccount provided
  enabled: true

  ## Existing ServiceAccount name (required when enabled=false)
  ## Set to "default" to use the namespace default ServiceAccount
  ## Note: When enabled=true, respects nameOverride/fullnameOverride
  ##
  # name: ""

  ## Custom ServiceAccount annotations
  ##
  # annotations: {}

  ## Custom ServiceAccount labels
  ##
  # labels: {}

## Custom Resource Definitions
##
crd:
  # Install CRDs with the chart
  enabled: true
  # Keep CRDs when uninstalling
  keep: true

## Controller metrics endpoint.
## Enable to expose /metrics endpoint
##
metrics:
  enabled: true
  # Metrics server port
  port: 8443
  # Enable secure metrics: HTTPS with certs/auth (true) or HTTP (false).
  # Note: Metrics authn/authz needs ClusterRole access.
  secure: true

## Cert-manager integration for TLS certificates.
## Required for webhook certificates and metrics endpoint certificates.
##
certManager:
  enabled: false

## Webhook server configuration
##
webhook:
  enabled: false
  # Webhook server port
  port: 9443

## Prometheus ServiceMonitor for metrics scraping.
## Requires prometheus-operator to be installed in the cluster.
##
prometheus:
  enabled: false

  ## Custom ServiceMonitor labels
  ##
  # labels: {}

  ## Custom ServiceMonitor annotations
  ##
  # annotations: {}

## Network policies for controlling traffic flow.
## Enable to restrict ingress to the controller manager.
##
networkPolicy:
  enabled: false

## Optionally render one TerdutServer CR from this chart -- "helm install
## and get a server" without hand-writing a CR (DESIGN.md §10). Off by
## default: most installs only want the operator and CRDs here, then apply
## their own TerdutServer (and TerdutTeam, and so on) separately. The shape
## below mirrors api/v1alpha1/terdutserver_types.go's TerdutServerSpec
## directly -- see that file for what each field means and which are
## required.
##
terdutServer:
  enabled: false

  ## This CR's own metadata.name. Defaults to the chart's own fullname if unset.
  # name: ""

  image:
    repository: git.ryuvia.com/niklas/terdut-server
    ## Required when terdutServer.enabled.
    # tag: ""

  ## Safe above 1 since terdut-server v0.36.0 (image.tag above must be that or
  ## newer): the sweeper, notifier and migration runner are each behind a
  ## Postgres advisory lock, and incident creation resolves its own insert
  ## conflict, matching this CRD's own spec.replicas default.
  replicas: 2

  networking:
    ## Required when terdutServer.enabled -- terdut-server's own public
    ## URL, used for absolute links it generates itself (notifications,
    ## OIDC redirect URIs). This chart/operator never creates any
    ## ingress/HTTPRoute for it -- see examples/networking in the repo for
    ## how to expose the Service this chart's TerdutServer CR causes to
    ## be created, if you want to expose it at all.
    # hostname: ""
    servicePort: 8080

  ## Exactly one of dsn or postgresClusterRef, matching DatabaseSpec's own
  ## CEL rule -- required when terdutServer.enabled. Bring-your-own DSN:
  ##   database:
  ##     dsn: "postgres://terdut@terdut-postgres:5432/terdut?sslmode=require"
  ##     passwordSecretRef:
  ##       name: terdut-postgres-password
  ##       key: password
  ## Zalando postgres-operator instead:
  ##   database:
  ##     postgresClusterRef:
  ##       name: terdut-postgres
  database: {}

  ## All optional -- omit entirely for their terdut-server defaults.
  # sweeper:
  #   staleAfter: 6h
  #   archiveAfter: 168h
  # notify: {}
  # oidc: {}

  passwordLogin: true

  # allowedTeams: {}

  ## Pod-level customization of the Deployment this TerdutServer creates --
  ## see api/v1alpha1/terdutserver_types.go's PodSpec for the full shape
  ## (nodeSelector, tolerations, affinity, topologySpreadConstraints,
  ## securityContext, containerSecurityContext, serviceAccountName,
  ## extraEnv/extraEnvFrom, extraVolumes/extraVolumeMounts,
  ## imagePullSecrets, disruptionBudget). All optional; resources is the
  ## one most installs will want to set, since the container otherwise
  ## runs with no requests/limits at all:
  # pod:
  #   resources:
  #     requests:
  #       cpu: 100m
  #       memory: 128Mi
  #     limits:
  #       memory: 256Mi