validate/haproxy-unified
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b6460c4ea3b8e249e2bc38f20a874a76b592878a
haproxy-unified/haproxy/values.yaml
Scaffolder b6460c4ea3
All checks were successful
Build and Publish TechDocs / build-and-publish (push) Successful in 1m15s
Details
initial commit 
Change-Id: I2e2564a72b6be9af536235fc3795fd788fd9257b
2026-04-15 15:41:22 +00:00

644 lines
20 KiB
YAML
Raw Blame History

# Copyright 2020 HAProxy Technologies LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
## Default values for HAProxy
## Configure Service Account
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
serviceAccount:
annotations: {}
create: true
name:
automountServiceAccountToken: true
## Override namespace for for the whole chart
## If namespaceOverride is set, helm will use it's value instead of .Release.Namespace for all chart components.
## It is useful in case Haproxy is used as a dependency for another helm chart. Value can be overridden in parent chart values.yaml
## Example values.yaml of parent chart:
# namespaceOverride: haproxytech
## Default values for image
image:
repository: docker.io/haproxytech/haproxy-alpine # can be changed to use CE or EE images
tag: "" # overrides the image tag whose default is the chart appVersion
pullPolicy: IfNotPresent
## Automatically Roll Deployments
# ref: https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksumConfigMap:
enabled: true
## Share Process Namespace between Containers in a Pod
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/
shareProcessNamespace:
enabled: false
## Pods: How Pods manage multiple containers
# ref: https://kubernetes.io/docs/concepts/workloads/pods/#workload-resources-for-managing-pods
# ref: https://kubernetes.io/docs/concepts/workloads/pods/#how-pods-manage-multiple-containers
sidecarContainers: []
## Reflex
# ref: https://github.com/cespare/reflex
# ref: https://hub.docker.com/r/acim/go-reflex
# - name: reflex
# image: acim/go-reflex:1.17.3
# command: ["reflex", "-d", "fancy"]
# workingDir: /usr/local/etc/haproxy
# args:
# - -svr
# - "..data"
# - --
# - bash
# - -c
# - 'pkill -SIGUSR2 "haproxy|hapee-lb"'
# ports:
# - name: tcp
# containerPort: 3000
# protocol: TCP
# imagePullPolicy: IfNotPresent
# volumeMounts:
# - name: haproxy-config
# mountPath: /usr/local/etc/haproxy
# resources:
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 50m
# memory: 64Mi
## Deployment or DaemonSet pod mode
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
kind: Deployment # can be 'Deployment' or 'DaemonSet'
replicaCount: 1 # used only for Deployment mode
## minReadySeconds setting of Deployment or DaemonSet
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#min-ready-seconds
minReadySeconds: 0
## Command line arguments to pass to HAProxy
args:
enabled: true # EE images require disabling this due to S6-overlay
# ref: http://cbonte.github.io/haproxy-dconv/2.6/management.html#3
defaults: ["-f", "/usr/local/etc/haproxy/haproxy.cfg"]
extraArgs: [] # EE images require disabling this due to S6-overlay
## Annotations to add to the deployment metadata
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
deploymentAnnotations: {}
# key: value
deploymentLabels: {}
# key: value
## Controller Container liveness/readiness probe configuration
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
livenessProbe:
{}
# failureThreshold: 3
# successThreshold: 1
# initialDelaySeconds: 0
# timeoutSeconds: 1
# tcpSocket:
# port: 80
# periodSeconds: 10
readinessProbe:
{}
# failureThreshold: 3
# successThreshold: 1
# initialDelaySeconds: 0
# timeoutSeconds: 1
# tcpSocket:
# port: 80
# periodSeconds: 10
startupProbe:
{}
# failureThreshold: 20
# successThreshold: 1
# initialDelaySeconds: 0
# timeoutSeconds: 1
# tcpSocket:
# port: 80
# periodSeconds: 1
## DaemonSet configuration
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
daemonset:
useHostNetwork: false # also modify dnsPolicy accordingly
useHostPort: false
hostPorts:
http: 80
https: 443
stat: 1024
## Init Containers
## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
initContainers: []
# - name: sysctl
# image: "busybox:musl"
# command:
# - /bin/sh
# - -c
# - sysctl -w net.core.somaxconn=65536
# securityContext:
# privileged: true
## Pod termination grace period
## ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
terminationGracePeriodSeconds: 60
## Private Registry configuration
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
imageCredentials:
registry: null # EE images require setting this
username: null # EE images require setting this
password: null # EE images require setting this
existingImagePullSecret: null
## Container listener port configuration
## ref: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/
containerPorts: # has to match hostPorts when useHostNetwork is true
http: 80
https: 443
stat: 1024
## Raw container ports configuration (alternative to containerPorts for more control)
## Allows specifying container ports in full Kubernetes format with custom protocols, names, etc.
## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#containerport-v1-core
rawContainerPorts: []
# Example:
# - containerPort: 9090
# name: metrics-port
# protocol: TCP
# - containerPort: 8080
# name: custom-http
# protocol: TCP
## Deployment strategy definition
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
strategy: {}
# rollingUpdate:
# maxSurge: 25%
# maxUnavailable: 25%
# type: RollingUpdate
## Pod PriorityClass
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
priorityClassName: ""
## Container lifecycle handlers
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
lifecycle: {}
## Example preStop for graceful shutdown
# preStop:
# exec:
# command: ["/bin/sh", "-c", "kill -USR1 $(pidof haproxy); while killall -0 haproxy; do sleep 1; done"]
## Additional envs to the main container
extraEnvs: []
## Example passing the pod IP into a container
# - name: POD_IP
# valueFrom:
# fieldRef:
# fieldPath: status.podIP
## Use envFrom to add env vars from a secret or ConfigMap to the HAProxy container
## ref: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/
extraEnvFrom: []
## Example passing the pod IP into a container
# - configMapRef:
# name: ha-env-config
## Additional volumeMounts to the controller main container
extraVolumeMounts: []
## Example empty volume mounts when using securityContext->readOnlyRootFilesystem
# - name: etc-haproxy
# mountPath: /etc/haproxy
# - name: tmp
# mountPath: /tmp
# - name: var-state-haproxy
# mountPath: /var/state/haproxy
## Additional volumes to the controller pod
extraVolumes: []
## Example empty volumes when using securityContext->readOnlyRootFilesystem
# - name: etc-haproxy
# emptyDir: {}
# - name: tmp
# emptyDir: {}
# - name: var-state-haproxy
# emptyDir: {}
## HAProxy daemon configuration
# ref: https://www.haproxy.org/download/2.6/doc/configuration.txt
config: |
global
log stdout format raw local0
maxconn 1024
defaults
log global
timeout client 60s
timeout connect 60s
timeout server 60s
frontend fe_main
bind :80
default_backend be_main
backend be_main
server web1 10.0.0.1:8080 check
# Mount path and sub path for config file
configMount:
mountPath: /usr/local/etc/haproxy # EE images use /etc/hapee-VERSION/hapee-lb.cfg
subPath: "" # EE images use hapee-lb.cfg
## Basic features : Maps
# ref: http://cbonte.github.io/haproxy-dconv/2.6/configuration.html#7.3.1-map
# ref: http://cbonte.github.io/haproxy-dconv/2.6/intro.html#3.3.8
includes:
# routes.map: |
# www.example.com/v1 www.example2.com/v2
# api.example.com/v1 api.example2.com/v2
# static.example.com/v1 static.example2.com/v2
# 200.http: |
# HTTP/1.1 200 OK
# Cache-Control: no-cache
# Connection: close
# Content-Type: text/html
# <html><body><h1>200 OK</h1>
# Check passed.
# </body></html>
## Mount path for includes and maps
includesMountPath: /usr/local/etc/haproxy/includes # EE images use /etc/hapee-VERSION
## Additional secrets to mount as volumes
## This is expected to be an array of dictionaries specifying the volume name, secret name and mount path
mountedSecrets: []
# - volumeName: ssl-certificate
# secretName: star-example-com
# mountPath: /usr/local/etc/ssl
## Pod Node assignment
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
nodeSelector: {}
## Node Taints and Tolerations for pod-node cheduling through attraction/repelling
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
tolerations: []
# - key: "key"
# operator: "Equal|Exists"
# value: "value"
# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
## Node Affinity for pod-node scheduling constraints
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
affinity: {}
## Topology spread constraints (only used in kind: Deployment)
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
topologySpreadConstraints: []
# - maxSkew: 1
# topologyKey: kubernetes.io/zone
# whenUnsatisfiable: DoNotSchedule
# labelSelector:
# matchLabels:
# app.kubernetes.io/name: kubernetes-ingress
# app.kubernetes.io/instance: kubernetes-ingress
## Pod DNS Config
## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/
dnsConfig: {}
## Pod DNS Policy
## Change this to ClusterFirstWithHostNet in case you have useHostNetwork set to true
## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
dnsPolicy: ClusterFirst
## Additional labels to add to the pod container metadata
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
podLabels: {}
# key: value
## Additional annotations to add to the pod container metadata
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
podAnnotations: {}
# key: value
## Enable RBAC Authorization
## ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
rbac:
create: true
## Disableable use of Pod Security Policy
## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
podSecurityPolicy:
annotations: {}
## Specify pod annotations
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl
### WARNING!!! "Apparmor is only available Ubuntu/Debian distributions of Linux."
# apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
# apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
# seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default
# seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
enabled: false
# ref: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
# Enable only when added kublet arg: --allowed-unsafe-sysctls strings
allowedUnsafeSysctls:
# - net.*
## Pod Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
podSecurityContext: {}
### ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
### Sysctls enable only when added kublet arg: --allowed-unsafe-sysctls strings
# sysctls:
# - name: net.ipv4.tcp_rmem
# value: 4096 16060 262144
# - name: net.ipv4.tcp_wmem
# value: 4096 16384 262144
# - name: net.ipv4.tcp_tw_reuse
# value: "1"
# - name: net.ipv4.ip_local_port_range
# value: 1024 65023
# - name: net.ipv4.tcp_max_syn_backlog
# value: "60000"
# - name: net.ipv4.tcp_fin_timeout
# value: "30"
# - name: net.ipv4.tcp_synack_retries
# value: "3"
# - name: net.ipv4.ip_nonlocal_bind
# value: "1"
# - name: net.core.somaxconn
# value: "60000"
## Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
securityContext: {}
# enabled: true
# runAsNonRoot: true
# runAsUser: 1000
# runAsGroup: 1000
# allowPrivilegeEscalation: true
# capabilities:
# drop:
# - ALL
# add:
# - NET_BIND_SERVICE
# seccompProfile:
# type: RuntimeDefault
## Compute Resources
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
resources:
# limits:
# cpu: 250m
# memory: 128Mi
requests:
cpu: 250m
memory: 128Mi
## Horizontal Pod Scaler
## Only to be used with Deployment kind
## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
autoscaling:
enabled: false
minReplicas: 1
maxReplicas: 7
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
# additionalMetrics:
# - type: Object
# object:
# metric:
# name: requests-per-second
# describedObject:
# apiVersion: networking.k8s.io/v1
# kind: Ingress
# name: main-route
# target:
# type: Value
# value: 10k
## Behavior
## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#configurable-scaling-behavior
# behavior:
# scaleDown:
# stabilizationWindowSeconds: 3600
keda:
enabled: false
minReplicas: 2
maxReplicas: 20
pollingInterval: 30
cooldownPeriod: 300
restoreToOriginalReplicaCount: false
# fallback:
# failureThreshold: 3
# replicas: 6
# behavior: static
scaledObject:
annotations: {}
behavior: {}
# scaleDown:
# stabilizationWindowSeconds: 300
# policies:
# - type: Percent
# value: 100
# periodSeconds: 15
triggers: []
# - type: prometheus
# metadata:
# serverAddress: http://<prometheus-host>:9090
# metricName: haproxy_process_idle_time_percent
# threshold: '50'
# query: avg(100-avg_over_time(haproxy_process_idle_time_percent{container="kubernetes-ingress-controller",service="mytest-kubernetes-ingress"}[2m]))
## Pod Disruption Budget
## Only to be used with Deployment kind
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
PodDisruptionBudget:
enable: false
# maxUnavailable: 1
# minAvailable: 1
## Service configuration
## ref: https://kubernetes.io/docs/concepts/services-networking/service/
service:
type: ClusterIP # can be 'ClusterIP', 'NodePort', 'LoadBalancer'
## Service ClusterIP
## ref: https://kubernetes.io/docs/concepts/services-networking/service/
clusterIP: ""
## LoadBalancer IP
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
loadBalancerIP: ""
## Source IP ranges permitted to access Network Load Balancer
# ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/
loadBalancerSourceRanges: []
## Service ExternalIPs
# ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
externalIPs: []
## Service annotations
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
annotations: {}
## Service labels
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
labels: {}
## IPv4/IPv6 dual-stack
## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
##
# ipFamilies: [IPv4, IPv6]
# ipFamilyPolicy: PreferDualStack
## Service externalTrafficPolicy
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
# externalTrafficPolicy: Cluster
## Service internalTrafficPolicy
## ref: https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy/
# internalTrafficPolicy: Cluster
## Additional Service ports to use(e.g. port of side container haproxy exporter)
## ref: https://kubernetes.io/docs/concepts/services-networking/service/
additionalPorts: {}
# prometheus: 9101
## Raw additional service ports configuration (alternative to additionalPorts for more control)
## Allows specifying service ports in full Kubernetes format with custom protocols, names, etc.
## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#serviceport-v1-core
rawAdditionalPorts: []
# Example:
# - name: metrics-port
# port: 9090
# targetPort: 9090
# protocol: TCP
# - name: custom-service
# port: 8080
# targetPort: custom-http
# protocol: TCP
## NodePort custom port
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport-custom-port
nodePorts: {}
# http: 32080
# https: 32443
serviceMonitor:
## Toggle the ServiceMonitor true if you have Prometheus Operator installed and configured
enabled: false
## Specify the labels to add to the ServiceMonitors to be selected for target discovery
extraLabels: {}
## Specify the endpoints
## ref: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/design.md#servicemonitor
endpoints:
- port: prometheus
path: /metrics
scheme: http
interval: 30s
## Configure Ingress
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
ingress:
enabled: false
servicePort: 80
## Ingress class
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
className: ""
## Ingress labels
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
labels: {}
## Ingress annotations
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
## Ingress hosts
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
hosts:
- host: haproxy.domain.com
paths:
- path: /
pathType: ImplementationSpecific
## Ingress TLS
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
tls: []
# - secretName: chart-example-tls
# hosts:
# - haproxy.domain.com
# -- Expose the service via gateway-api HTTPRoute
# Requires Gateway API resources and suitable controller installed within the cluster
# (see: https://gateway-api.sigs.k8s.io/guides/)
httpRoute:
# HTTPRoute enabled.
enabled: false
# HTTPRoute servicePort to route to
servicePort: 80
# HTTPRoute labels
labels: {}
# HTTPRoute annotations.
annotations: {}
# Which Gateways this Route is attached to.
parentRefs:
- name: gateway
sectionName: http
# namespace: default
# Hostnames matching HTTP header.
hostnames:
- chart-example.local
# List of rules and filters applied.
rules:
- matches:
- path:
type: PathPrefix
value: /
# filters:
# - type: RequestHeaderModifier
# requestHeaderModifier:
# set:
# - name: My-Overwrite-Header
# value: this-is-the-only-value
# remove:
# - User-Agent
# - matches:
# - path:
# type: PathPrefix
# value: /echo
# headers:
# - name: version
# value: v2
Reference in New Issue View Git Blame Copy Permalink