values.yaml

# generic - values that uses by all nxs-universal-chart templates
generic:
  labels: {}
  #  general-label: general-label-value
  annotations: {}
  #  general-annotation: general-annotation-value
  extraSelectorLabels: {}
  #  label: special
  podLabels: {}
  #  pod-label: some
  podAnnotations: {}
  #  checksum/envs: '{{ include "helpers.workload.checksum" (printf "%s%s" $.Values.envs $.Values.envsString) }}'
  #  checksum/secret-envs: '{{ include "helpers.workload.checksum" (printf "%s%s" $.Values.secretEnvs $.Values.secretEnvsString) }}'
  #  pod-annotation: true
  extraVolumes: []
  #- name: cache
  #  emptyDir: {}
  extraImagePullSecrets: []
  #- name: regcred
  usePredefinedAffinity: true

# Predefined Affinity block
# Pod affinity preset
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
# Allowed values: soft, hard, nil
podAffinityPreset: soft

# Pod anti-affinity preset
# Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
# Allowed values: soft, hard, nil
podAntiAffinityPreset: soft

# Node affinity preset
# Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
nodeAffinityPreset:
  # Node affinity type
  # Allowed values: soft, hard
  type: ""
  # Node label key to match
  # E.g.
  # key: "kubernetes.io/e2e-az-name"
  key: ""
  # Node label values to match
  # E.g.
  # values:
  #   - e2e-az1
  #   - e2e-az2
  values: []

# Release name used by default. To make it empty use "-"
releasePrefix: ""

# --set "envs.FOO=bar,envs.TEST=true"
envs: {}
#  BAR: foo
#  TEST: true

# --set "envsString=$ENVS_STRING"
envsString: ""
#envsString: |
#  BAR2: foo2

# --set "secretEnvs.FOO=bar"
secretEnvs: {}
#  FOO: bar

# --set "secretEnvsString=$SECRET_ENVS_STRING"
secretEnvsString: ""
#secretEnvsString: |
#  FOO: BAR

imagePullSecrets: {}
#  registry.org: |
#    {"auths":{"registry.org":{"auth":"cnd1c2VyOnNlY3VyZVBANXM="}}}
#  registry.org-rw: b64:eyJhdXRocyI6eyJyZWdpc3RyeS5vcmciOnsiYXV0aCI6ImNuZDFjMlZ5T25ObFkzVnlaVkJBTlhNPSJ9fX0=

diagnosticMode:
  enbled: false
  command: ["sleep"]
  args: ["infinity"]

defaultImage: nginx
defaultImageTag: latest
defaultImagePullPolicy: "IfNotPresent"

ingresses: {}
#  nixys.io:
#    annotations:
#      nginx.ingress.kubernetes.io/ssl-redirect: "true"
#      nginx.ingress.kubernetes.io/proxy-body-size: "128m"
#    certManager:
#      issuerType: cluster-issuer
#      issuerName: letsencrypt
#    hosts:
#    - paths:
#      - serviceName: nginx
#        servicePort: http
#  nixys.org:
#    annotations:
#      nginx.ingress.kubernetes.io/ssl-redirect: "true"
#    hosts:
#    - paths:
#      - path: /api
#        servicePort: api
#    - hostname: nixys.com
#      paths:
#      - path: /api
#        servicePort: api
#    extraTls:
#    - hosts:
#      - nixys.com
#      - nixys.org
#      secretName: "nixys-tls"


services: {}
#  nginx:
#    clusterIP: None
#    ports:
#    - name: http
#      protocol: TCP
#      port: 8080
#    extraSelectorLabels:
#      app: my-nginx



deploymentsGeneral: {}
deployments: {}
#  nginx:
#    labels: {}
#    podLabels: {}
#    podAnnotations:
#      checksum/api-key: '{{ include "helpers.workload.checksum" $.Values.secrets.webadmin }}'
#    replicas: 2
#    extraSelectorLabels:
#      app: my-nginx
#    serviceAccountName: deployer
#    #affinity:
#    #  nodeAffinity:
#    #    requiredDuringSchedulingIgnoredDuringExecution:
#    #      nodeSelectorTerms:
#    #      - matchExpressions:
#    #        - key: node-role
#    #          operator: In
#    #          values:
#    #          - prod
#    containers:
#    - name: nginx
#      #image: nginx
#      #imageTag: 1.19
#      #imagePullPolicy: Always
#      env:
#      - name: MY_ENV
#        value: "1234"
#      - name: QTE
#        value: safn8
#      envsFromSecret:
#        webadmin:
#        - JAVA_OPTS: JVM_OPTS
#        - QWE
#      envSecrets:
#      - secret-envs
#      envsFromConfigmap:
#        some-cm:
#        - LEL: LOL
#      envConfigmaps:
#      - envs
#      #ports:
#      #- name: http
#      #  containerPort: 8080
#      volumeMounts:
#      - name: secret-file
#        mountPath: /var/lib/secret
#      - name: app-pvc
#        mountPath: /var/www/html/files
#    volumes:
#    - name: secret-file
#      type: secret
#    - name: app-data
#      type: pvc

statefulSetsGeneral: {}
statefulSets: {}

serviceAccount: {}
#  firstaccount:
#    role:
#      name: test-role
#      rules:
#      - apiGroups:
#        - ""
#        - apps
#        - extensions
#        resources:
#        - replicasets
#        - pods
#        - deployments
#        verbs:
#        - list
#        - watch
#        - create
#        - update
#        - get
#        - delete
#    clusterRole:
#      name: view
#  secondaccount: {}
#  thirdaccount:
#    clusterRole:
#      name: thirdaccountclusterrole
#      rules:
#      - apiGroups: ["stable.example.com"]
#        resources: ["crontabs"]
#        verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

secrets: {}
  # --set "secrets.secret-file.data.api\.key=$SOME_ENV"
  #secret-file:
  #  data:
  #    api.key: |-
  #      JFczZwReBkJFczZwReBkJFczZwReBkJFczZwReBk
  ## --set "secrets.test1.labels.blah=blah,secrets.test1.data.BAR=foo"
  #test1:
  #  labels:
  #    blah: blah
  #  data:
  #    BAR: foo
  ## --set-file "secrets.domain-tls.type=kubernetes.io\/tls,secrets.domain-tls.data.tls\.crt=path/to/tls.crt,secrets.domain-tls.data.tls\.key=path/to/tls.key"
  #nixys-tls:
  #  type: kubernetes.io/tls
  #  data:
  #    tls.crt: |-
  #      -----BEGIN CERTIFICATE-----
  #      MIIC2DCCAcCgAwIBAgIBATANBgkqh
  #      -----END CERTIFICATE-----
  #    tls.key: |-
  #      -----BEGIN RSA PRIVATE KEY-----
  #      MIIEowIBAAKCAQEA1//LmU7tdWt/fgbqh1Feh+JFczZwReBkkyW
  #      -----END RSA PRIVATE KEY-----
  ## --set "secrets.json-file.data.file\.json=$(printf %q $(cat file.json))"
  ## --set-file "secrets.json-file.data.file\.json=path/to/file.json"
  #json-file:
  #  data:
  #    file.json: {
  #      "arg": "value"
  #    }

configMaps: {}
  #some-cm:
  #  labels:
  #    kek: lol
  #  data:
  #    LOL: kek
  #json-file:
  # data:
  #   file.json: {
  #     "arg": "value"
#   }

# All PVSs will be added to `volumes` block in each workload excluding hooks
pvcs: {}
#  app-data:
#    accessModes:
#    - ReadWriteOnce
#    - ReadWriteMany
#    size: 8Gi

hooksGeneral: {}
hooks: {}
#  migration-up:
#    containers:
#    - image: registry.app.ru/app-migration
#      args:
#      - up
#      envFrom:
#      - secretRef:
#          name: server-env

cronJobsGeneral: {}
cronJobs: {}
#  generate-data:
#    schedule: "*/5 * * * *"
#    command: "php yii crontab/generate-data"
#    singleOnly: true
#    commandDurationAlert: 600
#    commandMaxDuration: 800
#    volumeMounts:
#    - name: secret-file
#      mountPath: /etc/app
#      readOnly: true
#    volumes:
#    - name: secret-file
#      type: secret
#      items:
#      - key: app.conf
#        mode: 0600
#        path: app.conf
#  auto-sender:
#    schedule: "*/5 * * * *"
#    command: "php yii crontab/auto-sender"

jobsGeneral: {}
jobs: {}
#  refresh-cache:
#    command: "php yii crontab/refresh-cache"
#    commandDurationAlert: 30
#    commandMaxDuration: 60

serviceAccountGeneral: {}
#  annotations:
#    test: test2

serviceMonitors: {}
#  app-sm:
#    endpoints:
#    - interval: 30s
#      port: exporter
#      path: /metrics
#    extraSelectorLabels:
#      app: nginx
#    labels:
#      foo: foo

extraDeploy: {}
#  net-pol: |-
#    apiVersion: networking.k8s.io/v1
#    kind: NetworkPolicy
#    metadata:
#      name: {{ include "helpers.app.fullname" (dict "name" "nw-policy" "context" $) }}
#      namespace: {{ .Release.Namespace | quote }}
#    spec:
#      podSelector:
#        matchLabels:
#          role: db
#      policyTypes:
#      - Ingress
#      - Egress
#      ingress:
#      - from:
#        - ipBlock:
#            cidr: 172.17.0.0/16
#            except:
#            - 172.17.1.0/24
#        - namespaceSelector:
#            matchLabels:
#              project: myproject
#        - podSelector:
#            matchLabels:
#              role: frontend
#        ports:
#        - protocol: TCP
#          port: 6379
#      egress:
#      - to:
#        - ipBlock:
#            cidr: 10.0.0.0/24
#        ports:
#        - protocol: TCP
#          port: 5978



ingressroutes: {}
  # test: 
  #   entryPoints: 
  #     - test
  #   routes:
  #     Host(`prod-vault.ru`):
  #       priority: 10
  #       services:
  #         vault-active:
  #           port: 8200
  #           serversTransport: vault
  #           responseForwardingflushInterval: 10ms
  #           stickyCookie: 
  #             httpOnly: true
  #             name: cookie
  #             secure: true
  #             sameSite: none
  #             maxAge: 42
  #         vault-active-2:
  #           port: 8201
  #           serversTransport: vault
  #           responseForwardingflushInterval: 10ms
  #           stickyCookie: 
  #             httpOnly: false
  #             name: cookie-2
  #             secure: false
  #             sameSite: none
  #             maxAge: 42
  #           weight: 12
  #           passHostHeader: true
  #       middlewares:
  #       - name: middleware1
  #         namespace: default
  #       - name: test
  #   tls:
  #     secretName: supersecret 
  #     store:
  #       name: storetets
  #       namespace: default
  #     options:
  #       name: opt
  #       namespace: default
  #     certResolver: foo 
  #     domains:
  #     - main: example.net
  #       sans:
  #       - a.example.net
  #       - b.example.net

middlewares: {}
  # testmdw:
  #   ipWhiteList:
  #     sourceRange:
  #     - 192.144.48.8
  #     - 192.144.48.9
  #     - 10.220.250.247
  # test-2:
  #   redirectScheme:
  #     permanent: true
  #     scheme: https

ingressroutesUDP: {}
  # test: 
  #   entryPoints: 
  #     - test
  #   routes:
  #     vault-active:
  #       port: 8200
  #     vault-passive:
  #       port: 8201
  #       weight: 12

traefikservices: {}
  # test:
  #   mirroring:
  #     name: svc1
  #     port: 80
  #     mirrors:
  #       - name: svc2
  #         port: 80
  #         percent: 20
  #       - name: svc3 
  #         kind: TraefikService
  #         percent: 15
  # test2:
  #   weighted:
  #     services:
  #       - name: whoami1
  #         kind: Service
  #         port: 80
  #         weight: 1
  #         sticky:
  #           cookie:
  #             name: lvl2
  #       - name: whoami2
  #         kind: Service
  #         weight: 1
  #         port: 80
  #         sticky:
  #           cookie:
  #             name: lvl2
  #     sticky:
  #       cookie:
  #         name: lvl1

TLSOptions: {}
  # testopt:
  #   minVersion: VersionTLS12
  #   maxVersion: VersionTLS13
  #   curvePreferences:
  #   - CurveP521
  #   - CurveP384
  #   cipherSuites:
  #   - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  #   - TLS_RSA_WITH_AES_256_GCM_SHA384
  #   clientAuth:
  #     secretNames:
  #     - secret-ca1
  #     - secret-ca2
  #     clientAuthType: VerifyClientCertIfGiven
  #   sniStrict: true
  #   alpnProtocols:
  #   - foobar
 
TLSStores: {}
  # teststore:
  #   certificates:
  #     - foo                      
  #     - bar
  #   defaultCertificate: secret
  #   defaultGeneratedCert:
  #     resolver: myresolver
  #     domain:
  #       main: example.org
  #       sans:
  #       - foo.example.org
  #       - bar.example.org


ServersTransport: {}
  # test: 
  #   serverName: foobar
  #   insecureSkipVerify: true 
  #   rootCAsSecrets:
  #     - foobar
  #     - foobar
  #   certificatesSecrets:
  #     - foobar
  #     - foobar
  #   maxIdleConnsPerHost: 1
  #   forwardingTimeouts:
  #     dialTimeout: 42s
  #     responseHeaderTimeout: 42s
  #     idleConnTimeout: 42s
  #   peerCertURI: foobar
  #   disableHTTP2: true
  #   spiffe:
  #     ids:
  #     - spiffe://trust-domain/id1
  #     - spiffe://trust-domain/id2
  #     trustDomain: "spiffe://trust-domain"

ServersTransportTCP: {}
  # testtc:
  #   dialTimeout: 42s
  #   dialKeepAlive: 42s
  #   terminationDelay: 42s
  #   tls:
  #     serverName: foobar
  #     insecureSkipVerify: true
  #     peerCertURI: foobar
  #     rootCAsSecrets:
  #       - foobar
  #       - foobar
  #     certificatesSecrets:
  #       - foobar
  #       - foobar
  #   spiffe:
  #     ids:
  #     - spiffe://trust-domain/id1
  #     - spiffe://trust-domain/id2
  #     trustDomain: "spiffe://trust-domain"

istiogateways: {}
  # nginx:
  #   name: nginx-gateway
  #   selector:
  #     istio: ingress
  #   servers:
  #     - port:
  #         number: 80
  #         name: http
  #         protocol: HTTP
  #       hosts:
  #         - "nginx.example.com"

istiovirtualservices: {}
  # nginx:
  #   name: nginx-virtualservice
  #   gateways:
  #     - nginx-gateway
  #   hosts:
  #     - "nginx.example.com"
  #   http:
  #     - match:
  #         - uri:
  #             prefix: "/"
  #       route:
  #         - destination:
  #             host: nginx-service.default.svc.cluster.local
  #             port:
  #               number: 80

istiodestinationrules: {}
  # nginx:
  #   name: nginx-destinationrule
  #   host: "nginx-service.default.svc.cluster.local"
  #   trafficPolicy:
  #     loadBalancer:
  #       simple: ROUND_ROBIN
  #     connectionPool:
  #       http:
  #         http1MaxPendingRequests: 500
  #         maxRequestsPerConnection: 50
  #     outlierDetection:
  #       consecutiveGatewayErrors: 3
  #       interval: 5s
  #       baseEjectionTime: 15s
  #   subsets:
  #     - name: v1
  #       labels:
  #         app: nginx
  #       trafficPolicy:
  #         loadBalancer:
  #           simple: LEAST_CONN
  #         connectionPool:
  #           tcp:
  #             maxConnections: 200
  #     - name: v2
  #       labels:
  #         version: v2
  #       trafficPolicy:
  #         loadBalancer:
  #           simple: RANDOM
  #         connectionPool:
  #           http:
  #             http2MaxRequests: 2000
  #   exportTo:
  #     - "."
  #     - "another-namespace"