moodle

Helm chart

iamguarded

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

# This file has been modified by Chainguard, Inc.

# Chainguard, Inc. modifications are subject to the license

# available at: https://www.chainguard.dev/legal/software-license-agreement

# SPDX-License-Identifier: APACHE-2.0

## @section Global parameters

## Global Docker image parameters

## Please, note that this will override the image parameters, including dependencies, configured to use the global value

## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass

## @param global.imageRegistry Global Docker image registry

## @param global.imagePullSecrets Global Docker registry secret names as an array

## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)

global:

imageRegistry: ""

## E.g.

## imagePullSecrets:

## - myRegistryKeySecretName

imagePullSecrets: []

defaultStorageClass: ""

## Security parameters

security:

## @param global.security.allowInsecureImages Allows skipping image verification

allowInsecureImages: false

## Compatibility adaptations for Kubernetes platforms

compatibility:

## Compatibility adaptations for Openshift

openshift:

## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)

adaptSecurityContext: auto

org: ""

## @section Common parameters

## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)

kubeVersion: ""

## @param nameOverride String to partially override moodle.fullname template

nameOverride: ""

## @param fullnameOverride String to fully override moodle.fullname template

fullnameOverride: ""

## @param commonAnnotations Common annotations to add to all Harbor resources (sub-charts are not considered). Evaluated as a template

commonAnnotations: {}

## @param commonLabels Common labels to add to all Harbor resources (sub-charts are not considered). Evaluated as a template

commonLabels: {}

## @param extraDeploy Array with extra yaml to deploy with the chart. Evaluated as a template

extraDeploy: []

## @param usePasswordFiles Mount credentials as files instead of using environment variables

usePasswordFiles: true

## @section Moodle™ parameters

## Iamguarded Moodle™ image version

## @param image.registry [default: REGISTRY_NAME] Moodle image registry

## @param image.repository [default: REPOSITORY_NAME/moodle] Moodle image repository

## @skip image.tag Moodle image tag (immutable tags are recommended)

## @param image.digest Moodle image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

## @param image.pullPolicy Moodle image pull policy

## @param image.pullSecrets Specify docker-registry secret names as an array

## @param image.debug Specify if debug logs should be enabled

image:

registry: chainreg.biz

repository: chainguard-private/moodle-iamguarded

tag: 5.2.1

digest: ""

## Specify a imagePullPolicy

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

## e.g:

## pullSecrets:

## - myRegistryKeySecretName

pullSecrets: []

## Set to true if you would like to see extra information on logs

debug: false

## @param replicaCount Number of Moodle replicas (requires ReadWriteMany PVC support)

## Setting this will fix the number replica count needed for Moodle™

## This can be overridden by setting autoscaling.enabled to true

## For upgrades set the autoscaling.enabled to false and replicaCount to the desired number of replicas

100

101

replicaCount: 1

102

## When enabled, the number of Moodle™ replicas will be automatically adjusted based on targets on given metrics.

103

## Enabling this feature will override the replicaCount value

104

## When disabled, the number of Moodle™ replicas will be fixed and set by the replicaCount parameter

105

## Warning: Before enabling ensure that your persistent volume claim has `Access Modes: RWX` since Autoscaling requires ReadWriteMany PVC support.

106

## Moodle Autoscaling parameters

107

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

108

## @param autoscaling.enabled Enable Horizontal POD autoscaling for Moodle™

109

## @param autoscaling.minReplicas Minimum number of Moodle™ replicas

110

## @param autoscaling.maxReplicas Maximum number of Moodle™ replicas

111

## @param autoscaling.targetCPU Target CPU utilization percentage

112

## @param autoscaling.targetMemory Target Memory utilization percentage

113

114

autoscaling:

115

enabled: false

116

minReplicas: 1

117

maxReplicas: 10

118

targetCPU: 80

119

targetMemory: 80

120

## @param moodleSkipInstall Skip Moodle™ installation wizard. Useful for migrations and restoring from SQL dump

121

122

moodleSkipInstall: false

123

## @param moodleSiteName Site name

124

125

moodleSiteName: ""

126

## @param moodleLang Site language

127

128

moodleLang: ""

129

## @param moodleUsername User of the application

130

131

moodleUsername: user

132

## @param moodlePassword Application password

133

## Defaults to a random 10-character alphanumeric string if not set

134

135

moodlePassword: ""

136

## @param moodleEmail Admin email

137

138

moodleEmail: user@example.com

139

## @param allowEmptyPassword Allow DB blank passwords

140

141

allowEmptyPassword: true

142

## @param command Override default container command (useful when using custom images)

143

144

command: []

145

## @param args Override default container args (useful when using custom images)

146

147

args: []

148

## @param updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached

149

## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the

150

## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will

151

## terminate the single previous pod, so that the new, incoming pod can attach to the PV

152

153

updateStrategy:

154

type: RollingUpdate

155

## @param extraEnvVars An array to add extra env vars

156

## For example:

157

## - name: BEARER_AUTH

158

## value: true

159

160

extraEnvVars: []

161

## @param extraEnvVarsCM ConfigMap with extra environment variables

162

163

extraEnvVarsCM: ""

164

## @param extraEnvVarsSecret Secret with extra environment variables (in case of sensitive data)

165

166

extraEnvVarsSecret: ""

167

## @param extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts`

168

169

extraVolumes: []

170

## @param extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`.

171

172

extraVolumeMounts: []

173

## @param initContainers Extra init containers to add to the deployment

174

175

initContainers: []

176

## Pod Disruption Budget configuration

177

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

178

## @param pdb.create Enable/disable a Pod Disruption Budget creation

179

## @param pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

180

## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty.

181

182

pdb:

183

create: true

184

minAvailable: ""

185

maxUnavailable: ""

186

## @param sidecars Extra sidecar containers to add to the deployment

187

188

sidecars: []

189

## @param automountServiceAccountToken Mount Service Account token in pod

190

191

automountServiceAccountToken: false

192

## @param hostAliases [array] Moodle™ pods host aliases

193

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

194

195

hostAliases:

196

- ip: "127.0.0.1"

197

hostnames:

198

- "status.localhost"

199

## @param tolerations Tolerations for pod assignment

200

## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

201

202

tolerations: []

203

## @param priorityClassName Moodle™ pods' priorityClassName

204

205

priorityClassName: ""

206

## @param schedulerName Name of the k8s scheduler (other than default)

207

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

208

209

schedulerName: ""

210

## @param topologySpreadConstraints Topology Spread Constraints for pod assignment

211

## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

212

## The value is evaluated as a template

213

214

topologySpreadConstraints: []

215

## @param existingSecret Name of a secret with the application password

216

217

existingSecret: ""

218

## SMTP mail delivery configuration

219

## @param smtpHost SMTP host

220

## @param smtpPort SMTP port

221

## @param smtpUser SMTP user

222

## @param smtpPassword SMTP password

223

## @param smtpProtocol SMTP Protocol (options: ssl,tls, nil)

224

225

smtpHost: ""

226

smtpPort: ""

227

smtpUser: ""

228

smtpPassword: ""

229

smtpProtocol: ""

230

## @param containerPorts [object] Container ports

231

232

containerPorts:

233

http: 8080

234

https: 8443

235

## @param extraContainerPorts Optionally specify extra list of additional ports for Moodle&trade container(s)

236

## e.g:

237

## extraContainerPorts:

238

## - name: myservice

239

## containerPort: 9090

240

241

extraContainerPorts: []

242

## @param sessionAffinity Control where client requests go, to the same pod or round-robin

243

## Values: ClientIP or None

244

## ref: https://kubernetes.io/docs/concepts/services-networking/service/

245

246

sessionAffinity: "None"

247

## Enable persistence using Persistent Volume Claims

248

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

249

250

persistence:

251

## @param persistence.enabled Enable persistence using PVC

252

253

enabled: true

254

## @param persistence.customStorageClass Create a custom storage class

255

## Requires persistence.enabled: true

256

## Requires persistence.storageClass: name

257

## ref: https://kubernetes.io/docs/concepts/storage/storage-classes/

258

## E.g.

259

## provisioner: efs.csi.aws.com

260

## parameters:

261

## provisioningMode: efs-ap

262

## fileSystemId: fs-12345678

263

## directoryPerms: "700"

264

## gidRangeStart: "1000" # optional

265

## gidRangeEnd: "2000" # optional

266

267

customStorageClass: {}

268

## @param persistence.storageClass PVC Storage Class for Moodle

269

## If defined, storageClassName: <storageClass>

270

## If set to "-", storageClassName: "", which disables dynamic provisioning

271

## If undefined (the default) or set to null, no storageClassName spec is

272

## set, choosing the default provisioner. (gp2 on AWS, standard on

273

## GKE, AWS & OpenStack)

274

275

storageClass: ""

276

## @param persistence.accessModes PVC Access Mode for Moodle

277

## Requires persistence.enabled: true

278

## If defined, and no customStorageClass is defined, then

279

## PVC must be created manually before volume will be bound

280

281

accessModes:

282

- ReadWriteOnce

283

## @param persistence.size PVC Storage Request for Moodle

284

285

size: 8Gi

286

## @param persistence.existingClaim An Existing PVC name

287

## Requires persistence.enabled: true

288

## If defined, PVC must be created manually before volume will be bound

289

290

existingClaim: ""

291

## @param persistence.hostPath Host mount path for Moodle

292

## Requires persistence.enabled: true

293

## Requires persistence.existingClaim: nil|false

294

## Default: nil.

295

296

hostPath: ""

297

## @param persistence.annotations Persistent Volume Claim annotations

298

299

annotations: {}

300

## @param podAffinityPreset Pod affinity preset

301

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

302

## Allowed values: soft, hard

303

304

podAffinityPreset: ""

305

## @param podAntiAffinityPreset Pod anti-affinity preset

306

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

307

## Allowed values: soft, hard

308

309

podAntiAffinityPreset: soft

310

## Node affinity preset

311

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

312

## Allowed values: soft, hard

313

314

nodeAffinityPreset:

315

## @param nodeAffinityPreset.type Node affinity type

316

## Allowed values: soft, hard

317

318

type: ""

319

## @param nodeAffinityPreset.key Node label key to match

320

## E.g.

321

## key: "kubernetes.io/e2e-az-name"

322

323

key: ""

324

## @param nodeAffinityPreset.values Node label values to match

325

## E.g.

326

## values:

327

## - e2e-az1

328

## - e2e-az2

329

330

values: []

331

## @param affinity Map of node/pod affinities

332

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

333

## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set

334

335

affinity: {}

336

## @param nodeSelector Node labels for pod assignment

337

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

338

339

nodeSelector: {}

340

## Configure resource requests and limits

341

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

342

## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).

343

344

resourcesPreset: "micro"

345

## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

346

## Example:

347

## resources:

348

## requests:

349

## cpu: 2

350

## memory: 512Mi

351

## limits:

352

## cpu: 3

353

## memory: 1024Mi

354

355

resources: {}

356

## Configure Pods Security Context

357

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

358

## @param podSecurityContext.enabled Enable Moodle™ pods' Security Context

359

## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

360

## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface

361

## @param podSecurityContext.supplementalGroups Set filesystem extra groups

362

## @param podSecurityContext.fsGroup Moodle™ pods' group ID

363

364

podSecurityContext:

365

enabled: true

366

fsGroupChangePolicy: Always

367

sysctls: []

368

supplementalGroups: []

369

fsGroup: 1001

370

## Configure Container Security Context (only main container)

371

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

372

## @param containerSecurityContext.enabled Enabled containers' Security Context

373

## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

374

## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser

375

## @param containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup

376

## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot

377

## @param containerSecurityContext.privileged Set container's Security Context privileged

378

## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem

379

## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation

380

## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped

381

## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

382

383

containerSecurityContext:

384

enabled: true

385

seLinuxOptions: {}

386

runAsUser: 1001

387

runAsGroup: 0

388

runAsNonRoot: true

389

privileged: false

390

readOnlyRootFilesystem: false

391

allowPrivilegeEscalation: false

392

capabilities:

393

drop: ["ALL"]

394

seccompProfile:

395

type: "RuntimeDefault"

396

## Configure extra options for liveness and readiness probes

397

## Moodle™ core exposes /user/login to unauthenticated requests, making it a good

398

## default startup and readiness path. However, that may not always be the

399

## case. For example, if the image value is overridden to an image containing a

400

## module that alters that route, or an image that does not auto-install Moodle™.

401

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

402

## @param startupProbe.enabled Enable startupProbe

403

## @param startupProbe.path Request path for startupProbe

404

## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

405

## @param startupProbe.periodSeconds Period seconds for startupProbe

406

## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe

407

## @param startupProbe.failureThreshold Failure threshold for startupProbe

408

## @param startupProbe.successThreshold Success threshold for startupProbe

409

410

startupProbe:

411

enabled: false

412

path: /login/index.php

413

initialDelaySeconds: 30

414

periodSeconds: 10

415

timeoutSeconds: 5

416

failureThreshold: 60

417

successThreshold: 1

418

## @param livenessProbe.enabled Enable livenessProbe

419

## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

420

## @param livenessProbe.periodSeconds Period seconds for livenessProbe

421

## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

422

## @param livenessProbe.failureThreshold Failure threshold for livenessProbe

423

## @param livenessProbe.successThreshold Success threshold for livenessProbe

424

425

livenessProbe:

426

enabled: true

427

initialDelaySeconds: 600

428

periodSeconds: 10

429

timeoutSeconds: 5

430

failureThreshold: 6

431

successThreshold: 1

432

## Configure extra options for readiness probe

433

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

434

## @param readinessProbe.enabled Enable readinessProbe

435

## @param readinessProbe.path Request path for readinessProbe

436

## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

437

## @param readinessProbe.periodSeconds Period seconds for readinessProbe

438

## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

439

## @param readinessProbe.failureThreshold Failure threshold for readinessProbe

440

## @param readinessProbe.successThreshold Success threshold for readinessProbe

441

442

readinessProbe:

443

enabled: true

444

path: /login/index.php

445

initialDelaySeconds: 30

446

periodSeconds: 5

447

timeoutSeconds: 3

448

failureThreshold: 6

449

successThreshold: 1

450

## @param customStartupProbe Override default startup probe

451

452

customStartupProbe: {}

453

## @param customLivenessProbe Override default liveness probe

454

455

customLivenessProbe: {}

456

## @param customReadinessProbe Override default readiness probe

457

458

customReadinessProbe: {}

459

## @param lifecycleHooks LifecycleHook to set additional configuration at startup Evaluated as a template

460

461

lifecycleHooks: ""

462

## @param podAnnotations Pod annotations

463

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

464

465

podAnnotations: {}

466

## @param podLabels Add additional labels to the pod (evaluated as a template)

467

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

468

469

podLabels: {}

470

## Service Account

471

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

472

473

serviceAccount:

474

## @param serviceAccount.create Enable creation of ServiceAccount for Moodle pod

475

476

create: true

477

## @param serviceAccount.name The name of the ServiceAccount to use.

478

## If not set and create is true, a name is generated using the common.names.fullname template

479

480

name: ""

481

## @param serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created

482

## Can be set to false if pods using this serviceAccount do not need to use K8s API

483

484

automountServiceAccountToken: false

485

## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount

486

487

annotations: {}

488

## @section Traffic Exposure Parameters

489

490

## Kubernetes configuration

491

## For minikube, set this to NodePort, for ingress ClusterIP, elsewhere use LoadBalancer

492

493

service:

494

## @param service.type Service type

495

496

type: LoadBalancer

497

## @param service.ports.http Service HTTP port

498

## @param service.ports.https Service HTTPS port

499

500

ports:

501

http: 80

502

https: 443

503

## @param service.nodePorts.http Kubernetes HTTP node port

504

## @param service.nodePorts.https Kubernetes HTTPS node port

505

## nodePorts:

506

## http: <to set explicitly, choose port between 30000-32767>

507

## https: <to set explicitly, choose port between 30000-32767>

508

509

nodePorts:

510

http: ""

511

https: ""

512

## @param service.clusterIP Service Cluster IP

513

514

clusterIP: ""

515

## @param service.loadBalancerSourceRanges Service load balancer source ranges

516

## Control hosts connecting to "LoadBalancer" only

517

## loadBalancerSourceRanges:

518

## - 0.0.0.0/0

519

520

loadBalancerSourceRanges: []

521

## @param service.loadBalancerIP loadBalancerIP for the Moodle™ Service (optional, cloud specific)

522

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

523

524

loadBalancerIP: ""

525

## @param service.externalTrafficPolicy Enable client source IP preservation

526

## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

527

528

externalTrafficPolicy: Cluster

529

## @param service.extraPorts Extra ports to expose (normally used with the `sidecar` value)

530

531

extraPorts: []

532

## @param service.annotations Additional custom annotations for Moodle™ service

533

534

annotations: {}

535

## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"

536

## If "ClientIP", consecutive client requests will be directed to the same Pod

537

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

538

539

sessionAffinity: None

540

## @param service.sessionAffinityConfig Additional settings for the sessionAffinity

541

## sessionAffinityConfig:

542

## clientIP:

543

## timeoutSeconds: 300

544

545

sessionAffinityConfig: {}

546

## Configure the ingress resource that allows you to access the

547

## Moodle™ installation. Set up the URL

548

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/

549

550

ingress:

551

## @param ingress.enabled Set to true to enable ingress record generation

552

553

enabled: false

554

## @param ingress.pathType Ingress Path type

555

556

pathType: ImplementationSpecific

557

## @param ingress.apiVersion Override API Version (automatically detected if not set)

558

559

apiVersion: ""

560

## @param ingress.hostname When the ingress is enabled, a host pointing to this will be created

561

562

hostname: moodle.local

563

## @param ingress.path The Path to Moodle™. You may need to set this to '/*' in order to use this with ALB ingress controllers.

564

565

path: /

566

## @param ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

567

## For a full list of possible ingress annotations, please see

568

## ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md

569

## Use this parameter to set the required annotations for cert-manager, see

570

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

571

572

## e.g:

573

## annotations:

574

## kubernetes.io/ingress.class: nginx

575

## cert-manager.io/cluster-issuer: cluster-issuer-name

576

577

annotations: {}

578

## @param ingress.tls Enable TLS configuration for the hostname defined at ingress.hostname parameter

579

## TLS certificates will be retrieved from a TLS secret with name: {{- printf "%s-tls" .Values.ingress.hostname }}

580

## You can use the ingress.secrets parameter to create this TLS secret or relay on cert-manager to create it

581

582

tls: false

583

## @param ingress.extraHosts The list of additional hostnames to be covered with this ingress record.

584

## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array

585

## extraHosts:

586

## - name: minio.local

587

## path: /

588

589

extraHosts: []

590

## @param ingress.extraPaths Any additional arbitrary paths that may need to be added to the ingress under the main host.

591

## For example: The ALB ingress controller requires a special rule for handling SSL redirection.

592

## extraPaths:

593

## - path: /*

594

## backend:

595

## serviceName: ssl-redirect

596

## servicePort: use-annotation

597

598

extraPaths: []

599

## @param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record.

600

## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

601

## extraTls:

602

## - hosts:

603

## - minio.local

604

## secretName: minio.local-tls

605

606

extraTls: []

607

## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets

608

## key and certificate should start with -----BEGIN CERTIFICATE----- or

609

## -----BEGIN RSA PRIVATE KEY-----

610

611

## name should line up with a tlsSecret set further up

612

## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set

613

614

## It is also possible to create and manage the certificates outside of this helm chart

615

## Please see README.md for more information

616

## e.g:

617

## - name: minio.local-tls

618

## key:

619

## certificate:

620

621

secrets: []

622

## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

623

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .

624

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

625

626

ingressClassName: ""

627

## @param ingress.extraRules Additional rules to be covered with this ingress record

628

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

629

## e.g:

630

## extraRules:

631

## - host: example.local

632

## http:

633

## path: /

634

## backend:

635

## service:

636

## name: example-svc

637

## port:

638

## name: http

639

640

extraRules: []

641

## @section Database parameters

642

643

## MariaDB chart configuration

644

645

mariadb:

646

## @param mariadb.enabled Whether to deploy a mariadb server to satisfy the applications database requirements

647

## To use an external database set this to false and configure the externalDatabase parameters

648

649

enabled: true

650

## @param mariadb.architecture MariaDB architecture (`standalone` or `replication`)

651

652

architecture: standalone

653

## MariaDB Authentication parameters

654

655

auth:

656

## @param mariadb.auth.rootPassword Password for the MariaDB `root` user

657

658

rootPassword: ""

659

## @param mariadb.auth.database Database name to create

660

661

database: iamguarded_moodle

662

## @param mariadb.auth.username Database user to create

663

664

username: bn_moodle

665

## @param mariadb.auth.password Password for the database

666

667

password: ""

668

primary:

669

## Enable persistence using Persistent Volume Claims

670

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

671

672

persistence:

673

## @param mariadb.primary.persistence.enabled Enable database persistence using PVC

674

675

enabled: true

676

## @param mariadb.primary.persistence.storageClass MariaDB primary persistent volume storage Class

677

## If defined, storageClassName: <storageClass>

678

## If set to "-", storageClassName: "", which disables dynamic provisioning

679

## If undefined (the default) or set to null, no storageClassName spec is

680

## set, choosing the default provisioner. (gp2 on AWS, standard on

681

## GKE, AWS & OpenStack)

682

683

storageClass: ""

684

## @param mariadb.primary.persistence.accessModes PVC Access Modes for Moodle™ volume

685

686

accessModes:

687

- ReadWriteOnce

688

## @param mariadb.primary.persistence.size Database Persistent Volume Size

689

690

size: 8Gi

691

## @param mariadb.primary.persistence.hostPath Set path in case you want to use local host path volumes (not recommended in production)

692

693

hostPath: ""

694

## @param mariadb.primary.persistence.existingClaim Name of an existing `PersistentVolumeClaim` for MariaDB primary replicas

695

696

existingClaim: ""

697

## MariaDB primary container's resource requests and limits

698

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

699

## We usually recommend not to specify default resources and to leave this as a conscious

700

## choice for the user. This also increases chances charts run on environments with little

701

## resources, such as Minikube. If you do want to specify resources, uncomment the following

702

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

703

## @param mariadb.primary.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if primary.resources is set (primary.resources is recommended for production).

704

705

resourcesPreset: "micro"

706

## @param mariadb.primary.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

707

## Example:

708

## resources:

709

## requests:

710

## cpu: 2

711

## memory: 512Mi

712

## limits:

713

## cpu: 3

714

## memory: 1024Mi

715

716

resources: {}

717

image:

718

registry: chainreg.biz

719

repository: chainguard-private/mariadb-iamguarded

720

digest: ""

721

tag: 12.3.2

722

metrics:

723

image:

724

registry: chainreg.biz

725

repository: chainguard-private/prometheus-mysqld-exporter-iamguarded

726

digest: ""

727

tag: 0.19.0

728

volumePermissions:

729

image:

730

registry: chainreg.biz

731

repository: chainguard-private/os-shell-iamguarded

732

digest: ""

733

tag: 1.0.0

734

## External database configuration

735

736

externalDatabase:

737

## @param externalDatabase.type Type of the existing database

738

739

type: ""

740

## @param externalDatabase.host Host of the existing database

741

742

host: ""

743

## @param externalDatabase.port Port of the existing database

744

745

port: 3306

746

## @param externalDatabase.user Existing username in the external db

747

748

user: bn_moodle

749

## @param externalDatabase.password Password for the above username

750

751

password: ""

752

## @param externalDatabase.database Name of the existing database

753

754

database: iamguarded_moodle

755

## @param externalDatabase.existingSecret Name of an existing secret resource containing the DB password

756

757

existingSecret: ""

758

## @section Volume Permissions parameters

759

760

## Init containers parameters:

761

## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.

762

763

volumePermissions:

764

## @param volumePermissions.enabled Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work)

765

766

enabled: false

767

## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume-permissions image registry

768

## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume-permissions image repository

769

## @skip volumePermissions.image.tag Init container volume-permissions image tag (immutable tags are recommended)

770

## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

771

## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy

772

## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array

773

774

image:

775

registry: chainreg.biz

776

repository: chainguard-private/os-shell-iamguarded

777

tag: 1.0.0

778

digest: ""

779

pullPolicy: IfNotPresent

780

## Optionally specify an array of imagePullSecrets.

781

## Secrets must be manually created in the namespace.

782

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

783

784

pullSecrets: []

785

## - myRegistryKeySecretName

786

## Init containers' resource requests and limits

787

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

788

## We usually recommend not to specify default resources and to leave this as a conscious

789

## choice for the user. This also increases chances charts run on environments with little

790

## resources, such as Minikube. If you do want to specify resources, uncomment the following

791

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

792

## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).

793

794

resourcesPreset: "nano"

795

## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

796

## Example:

797

## resources:

798

## requests:

799

## cpu: 2

800

## memory: 512Mi

801

## limits:

802

## cpu: 3

803

## memory: 1024Mi

804

805

resources: {}

806

## @section Metrics parameters

807

metrics:

808

## @param metrics.enabled Start a side-car prometheus exporter

809

810

enabled: false

811

## @param metrics.image.registry [default: REGISTRY_NAME] Apache exporter image registry

812

## @param metrics.image.repository [default: REPOSITORY_NAME/apache-exporter] Apache exporter image repository

813

## @skip metrics.image.tag Apache exporter image tag (immutable tags are recommended)

814

## @param metrics.image.digest Apache exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

815

## @param metrics.image.pullPolicy Apache exporter image pull policy

816

## @param metrics.image.pullSecrets Specify docker-registry secret names as an array

817

818

image:

819

registry: chainreg.biz

820

repository: chainguard-private/apache-exporter-iamguarded

821

tag: 1.1.1

822

digest: ""

823

pullPolicy: IfNotPresent

824

## Optionally specify an array of imagePullSecrets.

825

## Secrets must be manually created in the namespace.

826

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

827

## e.g:

828

## pullSecrets:

829

## - myRegistryKeySecretName

830

831

pullSecrets: []

832

## Prometheus Exporter service configuration

833

834

service:

835

## @param metrics.service.type Prometheus metrics service type

836

837

type: LoadBalancer

838

## @param metrics.service.port Prometheus metrics service port

839

840

port: 9117

841

## @param metrics.service.loadBalancerIP Load Balancer IP if the Prometheus metrics server type is `LoadBalancer`, otherwise leave blank

842

843

loadBalancerIP: ""

844

## @param metrics.service.loadBalancerSourceRanges Prometheus metrics service service Load Balancer sources

845

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

846

## e.g:

847

## loadBalancerSourceRanges:

848

## - 10.10.10.0/24

849

850

loadBalancerSourceRanges: []

851

## @param metrics.service.clusterIP Prometheus metrics service Cluster IP

852

## e.g.:

853

## clusterIP: None

854

855

clusterIP: ""

856

## @param metrics.service.externalTrafficPolicy Prometheus metrics service service external traffic policy

857

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

858

859

externalTrafficPolicy: Cluster

860

## @param metrics.service.annotations [object] Annotations for Prometheus Exporter pods. Evaluated as a template.

861

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

862

863

annotations:

864

prometheus.io/scrape: "true"

865

prometheus.io/port: "{{ .Values.metrics.service.port }}"

866

## @param metrics.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"

867

## If "ClientIP", consecutive client requests will be directed to the same Pod

868

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

869

870

sessionAffinity: None

871

## @param metrics.service.sessionAffinityConfig Additional settings for the sessionAffinity

872

## sessionAffinityConfig:

873

## clientIP:

874

## timeoutSeconds: 300

875

876

sessionAffinityConfig: {}

877

## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production).

878

879

resourcesPreset: "nano"

880

## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

881

## Example:

882

## resources:

883

## requests:

884

## cpu: 2

885

## memory: 512Mi

886

## limits:

887

## cpu: 3

888

## memory: 1024Mi

889

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

890

891

resources: {}

892

## @param metrics.podAnnotations [object] Metrics exporter pod Annotation and Labels

893

894

podAnnotations:

895

prometheus.io/scrape: "true"

896

prometheus.io/port: "{{ .Values.metrics.service.port }}"

897

## @section Certificate injection parameters

898

899

## Add custom certificates and certificate authorities to Moodle™ container

900

901

certificates:

902

## @param certificates.customCertificate.certificateSecret Secret containing the certificate and key to add

903

## @param certificates.customCertificate.chainSecret.name Name of the secret containing the certificate chain

904

## @param certificates.customCertificate.chainSecret.key Key of the certificate chain file inside the secret

905

## @param certificates.customCertificate.certificateLocation Location in the container to store the certificate

906

## @param certificates.customCertificate.keyLocation Location in the container to store the private key

907

## @param certificates.customCertificate.chainLocation Location in the container to store the certificate chain

908

909

customCertificate:

910

certificateSecret: ""

911

chainSecret:

912

name: ""

913

key: ""

914

certificateLocation: /etc/ssl/certs/ssl-cert-snakeoil.pem

915

keyLocation: /etc/ssl/private/ssl-cert-snakeoil.key

916

chainLocation: /etc/ssl/certs/mychain.pem

917

## @param certificates.customCAs Defines a list of secrets to import into the container trust store

918

919

customCAs: []

920

## @param certificates.command Override default container command (useful when using custom images)

921

922

command: []

923

## @param certificates.args Override default container args (useful when using custom images)

924

## e.g:

925

## - secret: custom-CA

926

## - secret: more-custom-CAs

927

928

args: []

929

## @param certificates.extraEnvVars Container sidecar extra environment variables (eg proxy)

930

931

extraEnvVars: []

932

## @param certificates.extraEnvVarsCM ConfigMap with extra environment variables

933

934

extraEnvVarsCM: ""

935

## @param certificates.extraEnvVarsSecret Secret with extra environment variables

936

937

extraEnvVarsSecret: ""

938

## @param certificates.image.registry [default: REGISTRY_NAME] Container sidecar registry

939

## @param certificates.image.repository [default: REPOSITORY_NAME/os-shell] Container sidecar image repository

940

## @skip certificates.image.tag Container sidecar image tag (immutable tags are recommended)

941

## @param certificates.image.digest Container sidecar image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

942

## @param certificates.image.pullPolicy Container sidecar image pull policy

943

## @param certificates.image.pullSecrets Container sidecar image pull secrets

944

945

image:

946

registry: chainreg.biz

947

repository: chainguard-private/os-shell-iamguarded

948

tag: 1.0.0

949

digest: ""

950

## Specify a imagePullPolicy

951

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

952

953

pullPolicy: IfNotPresent

954

## Optionally specify an array of imagePullSecrets.

955

## Secrets must be manually created in the namespace.

956

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

957

## e.g:

958

## pullSecrets:

959

## - myRegistryKeySecretName

960

961

pullSecrets: []

962

## @section NetworkPolicy parameters

963

964

## Network Policy configuration

965

## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

966

967

networkPolicy:

968

## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created

969

970

enabled: true

971

## @param networkPolicy.allowExternal Don't require server label for connections

972

## The Policy model to apply. When set to false, only pods with the correct

973

## server label will have network access to the ports server is listening

974

## on. When true, server will accept connections from any source

975

## (with the correct destination port).

976

977

allowExternal: true

978

## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

979

980

allowExternalEgress: true

981

## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

982

## e.g:

983

## extraIngress:

984

## - ports:

985

## - port: 1234

986

## from:

987

## - podSelector:

988

## - matchLabels:

989

## - role: frontend

990

## - podSelector:

991

## - matchExpressions:

992

## - key: role

993

## operator: In

994

## values:

995

## - frontend

996

extraIngress: []

997

## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy

998

## e.g:

999

## extraEgress:

1000

## - ports:

1001

## - port: 1234

1002

## to:

1003

## - podSelector:

1004

## - matchLabels:

1005

## - role: frontend

1006

## - podSelector:

1007

## - matchExpressions:

1008

## - key: role

1009

## operator: In

1010

## values:

1011

## - frontend

1012

1013

extraEgress: []

1014

## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

1015

## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

1016

1017

ingressNSMatchLabels: {}

1018

ingressNSPodMatchLabels: {}

1019

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

moodle

The trusted source for open source

Product

Solutions

Customers

Resources

Company