community-grafana

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

global:

# -- Overrides the Docker registry globally for all images

imageRegistry: null

# To help compatibility with other charts which use global.imagePullSecrets.

# Allow either an array of {name: pullSecret} maps (k8s-style), or an array of strings (more common helm-style).

# Can be templated.

# global:

# imagePullSecrets:

# - name: pullSecret1

# - name: pullSecret2

# or

# global:

# imagePullSecrets:

# - pullSecret1

# - pullSecret2

imagePullSecrets: []

rbac:

create: true

## Use an existing ClusterRole/Role (depending on rbac.namespaced false/true)

# useExistingRole: name-of-some-role

# useExistingClusterRole: name-of-some-clusterRole

pspEnabled: false

pspUseAppArmor: false

namespaced: false

# Only has an effect if namespaced: true is set

namespaces: []

extraRoleRules: []

# - apiGroups: []

# resources: []

# verbs: []

extraClusterRoleRules: []

# - apiGroups: []

# resources: []

# verbs: []

serviceAccount:

create: true

name: ""

nameTest: ""

## ServiceAccount labels.

labels: {}

## Service account annotations. Can be templated.

# annotations:

# eks.amazonaws.com/role-arn: arn:aws:iam::123456789000:role/iam-role-name-here

## autoMount is deprecated in favor of automountServiceAccountToken

# autoMount: false

automountServiceAccountToken: false

replicas: 1

## Create a headless service for the deployment

headlessService: false

## Should the service account be auto mounted on the pod

automountServiceAccountToken: true

## Create HorizontalPodAutoscaler object for deployment type

autoscaling:

enabled: false

minReplicas: 1

maxReplicas: 5

targetCPU: "60"

targetMemory: ""

behavior: {}

## See `kubectl explain poddisruptionbudget.spec` for more

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

podDisruptionBudget: {}

# apiVersion: ""

# minAvailable: 1

# maxUnavailable: 1

# unhealthyPodEvictionPolicy: IfHealthyBudget

## See `kubectl explain deployment.spec.strategy` for more

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy

deploymentStrategy:

type: RollingUpdate

## The maximum time in seconds for a Deployment to make progress before it is considered to be failed.

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds

progressDeadlineSeconds: null

## Startup probe. Holds off the liveness and readiness probes until it succeeds, useful for slow starts.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

startupProbe: {}

readinessProbe:

httpGet:

path: /api/health

port: grafana

livenessProbe:

httpGet:

path: /api/health

port: grafana

initialDelaySeconds: 60

timeoutSeconds: 30

failureThreshold: 10

## Use an alternate scheduler, e.g. "stork".

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

# schedulerName: "default-scheduler"

image:

# -- The Docker registry

registry: chainreg.biz

# -- Docker image repository

repository: scratch-images/test-tmp/grafana

100

# Overrides the Grafana image tag whose default is the chart appVersion

101

tag: v13.1.1-r7

102

sha: sha256:d05cc2469421562f79042fcd0a062c5c02ef885c2db79d74da6abf4dbebe88fa

103

pullPolicy: IfNotPresent

104

## Optionally specify an array of imagePullSecrets.

105

## Secrets must be manually created in the namespace.

106

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

107

## Can be templated.

108

109

pullSecrets: []

110

# - myRegistrKeySecretName

111

testFramework:

112

enabled: true

113

## The type of Helm hook used to run this test. Defaults to test.

114

## ref: https://helm.sh/docs/topics/charts_hooks/#the-available-hooks

115

116

# hookType: test

117

image:

118

# -- The Docker registry

119

registry: docker.io

120

repository: bats/bats

121

tag: "1.14.0"

122

imagePullPolicy: IfNotPresent

123

securityContext: {}

124

containerSecurityContext: {}

125

resources: {}

126

# limits:

127

# cpu: 100m

128

# memory: 128Mi

129

# requests:

130

# cpu: 100m

131

# memory: 128Mi

132

# dns configuration for pod

133

dnsPolicy: ~

134

dnsConfig: {}

135

# nameservers:

136

# - 8.8.8.8

137

# options:

138

# - name: ndots

139

# value: "2"

140

# - name: edns0

141

142

hostUsers: ~

143

securityContext:

144

runAsNonRoot: true

145

runAsUser: 472

146

runAsGroup: 472

147

fsGroup: 472

148

containerSecurityContext:

149

allowPrivilegeEscalation: false

150

privileged: false

151

capabilities:

152

drop:

153

- ALL

154

seccompProfile:

155

type: RuntimeDefault

156

# Enable creating the grafana configmap

157

createConfigmap: true

158

# Extra configmaps to mount in grafana pods

159

# Values are templated.

160

extraConfigmapMounts: []

161

# - name: certs-configmap

162

# mountPath: /etc/grafana/ssl/

163

# subPath: certificates.crt # (optional)

164

# configMap: certs-configmap

165

# readOnly: true

166

# optional: false

167

168

extraEmptyDirMounts: []

169

# - name: provisioning-notifiers

170

# mountPath: /etc/grafana/provisioning/notifiers

171

172

# Shadow `/usr/share/grafana/data/plugins-bundled` with an emptyDir so plugins

173

# listed under `plugins:` install cleanly into `/var/lib/grafana/plugins` instead

174

# of failing on the read-only bundled directory shipped in the Grafana image.

175

# Required for plugins moved out of core in Grafana 13 (e.g. `elasticsearch`,

176

# `cloudwatch`) when listed in `plugins:`. Side effect: any bundled plugin not

177

# explicitly listed in `plugins:` will not be available.

178

shadowBundledPlugins: false

179

# Apply extra labels to common labels.

180

extraLabels: {}

181

## Assign a PriorityClassName to pods if set

182

# priorityClassName:

183

downloadDashboardsImage:

184

# -- The Docker registry

185

registry: chainreg.biz

186

repository: chainguard-private/curl

187

tag: latest-dev

188

sha: sha256:a9fdb3087c946cfce7094ed5714d547a3ac32fed3b7bc32125aeecd2917d12c2

189

pullPolicy: IfNotPresent

190

downloadDashboards:

191

env: {}

192

envFromSecret: ""

193

resources: {}

194

securityContext:

195

allowPrivilegeEscalation: false

196

capabilities:

197

drop:

198

- ALL

199

seccompProfile:

200

type: RuntimeDefault

201

envValueFrom: {}

202

# ENV_NAME:

203

# configMapKeyRef:

204

# name: configmap-name

205

# key: value_key

206

## Pod Annotations

207

# podAnnotations: {}

208

209

## ConfigMap Annotations

210

# configMapAnnotations: {}

211

# argocd.argoproj.io/sync-options: Replace=true

212

213

## Pod Labels

214

# podLabels: {}

215

podPortName: grafana

216

gossipPortName: gossip

217

## Deployment annotations

218

# annotations: {}

219

220

## Expose the grafana service to be accessed from outside the cluster (LoadBalancer service).

221

## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.

222

## ref: http://kubernetes.io/docs/user-guide/services/

223

224

service:

225

enabled: true

226

type: ClusterIP

227

# Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)

228

ipFamilyPolicy: ""

229

# Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.

230

ipFamilies: []

231

loadBalancerIP: ""

232

loadBalancerClass: ""

233

loadBalancerSourceRanges: []

234

port: 80

235

targetPort: 3000

236

# targetPort: 4181 To be used with a proxy extraContainer

237

## Service annotations. Can be templated.

238

annotations: {}

239

labels: {}

240

portName: service

241

# Adds the appProtocol field to the service. This allows to work with istio protocol selection. Ex: "http" or "tcp"

242

appProtocol: ""

243

sessionAffinity: ""

244

# trafficDistribution allows specifying how traffic is distributed to Service endpoints.

245

# Valid values: "" (default - standard load balancing),"PreferSameZone" (K8s 1.34+), "PreferSameNode" (K8s 1.35+), "PreferClose" (deprecated, use PreferSameZone),

246

trafficDistribution: ""

247

serviceMonitor:

248

## If true, a ServiceMonitor CR is created for a prometheus operator

249

## https://github.com/coreos/prometheus-operator

250

251

enabled: false

252

path: /metrics

253

# namespace: monitoring (defaults to use the namespace this chart is deployed to)

254

labels: {}

255

# Set these to override the Prometheus global scrape interval/timeout.

256

# interval: 30s

257

# scrapeTimeout: 30s

258

scheme: http

259

tlsConfig: {}

260

relabelings: []

261

metricRelabelings: []

262

basicAuth: {}

263

targetLabels: []

264

extraExposePorts: []

265

# - name: keycloak

266

# port: 8080

267

# targetPort: 8080

268

269

# overrides pod.spec.hostAliases in the grafana deployment's pods

270

hostAliases: []

271

# - ip: "1.2.3.4"

272

# hostnames:

273

# - "my.host.com"

274

275

ingress:

276

enabled: false

277

# ingressClassName: nginx

278

# Values can be templated

279

annotations: {}

280

# kubernetes.io/ingress.class: nginx

281

# kubernetes.io/tls-acme: "true"

282

labels: {}

283

path: /

284

pathType: Prefix

285

hosts:

286

- chart-example.local

287

## Extra paths to prepend to every host configuration. This is useful when working with annotation based services.

288

extraPaths: []

289

# - path: /*

290

# pathType: Prefix

291

# backend:

292

# service:

293

# name: ssl-redirect

294

# port:

295

# name: use-annotation

296

297

tls: []

298

# - secretName: chart-example-tls

299

# hosts:

300

# - chart-example.local

301

# -- BETA: Configure the gateway routes for the chart here.

302

# More routes can be added by adding a dictionary key like the 'main' route.

303

# Be aware that this is an early beta of this feature,

304

# kube-prometheus-stack does not guarantee this works and is subject to change.

305

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

306

# [[ref]](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io%2fv1alpha2)

307

route:

308

main:

309

# -- Enables or disables the route

310

enabled: false

311

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

312

apiVersion: gateway.networking.k8s.io/v1

313

# -- Set the route kind

314

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

315

kind: HTTPRoute

316

annotations: {}

317

labels: {}

318

hostnames: []

319

# - my-filter.example.com

320

parentRefs: []

321

# - name: acme-gw

322

323

matches:

324

- path:

325

type: PathPrefix

326

value: /

327

## Timeouts define the timeouts that can be configured for an HTTP request.

328

## Ref. https://gateway-api.sigs.k8s.io/api-types/httproute/#timeouts-optional

329

timeouts: {}

330

# request: 10s

331

# backendRequest: 5s

332

333

## SessionPersistence defines and configures session persistence for the route rule.

334

## Ref. https://gateway-api.sigs.k8s.io/geps/gep-1619/

335

sessionPersistence: {}

336

# sessionName: grafana-session

337

# type: Cookie

338

# absoluteTimeout: 48h

339

# cookieConfig:

340

# lifetimeType: Permanent

341

342

## Filters define the filters that are applied to requests that match this rule.

343

filters: []

344

## Additional custom rules that can be added to the route

345

additionalRules: []

346

## httpsRedirect adds a filter for redirecting to https (HTTP 301 Moved Permanently).

347

## To redirect HTTP traffic to HTTPS, you need to have a Gateway with both HTTP and HTTPS listeners.

348

## Matches and filters do not take effect if enabled.

349

## Ref. https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/

350

httpsRedirect: false

351

# -- BETA: Configure Gateway API ListenerSet resources for the chart here.

352

# ListenerSet allows attaching additional listeners to an existing Gateway.

353

# More listener sets can be added by adding a dictionary key like the 'main' entry.

354

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

355

# [[ref]](https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#listenerset)

356

listenerSet:

357

main:

358

# -- Enables or disables the listener set

359

enabled: false

360

# -- Set the ListenerSet apiVersion, e.g. gateway.networking.k8s.io/v1

361

apiVersion: gateway.networking.k8s.io/v1

362

annotations: {}

363

labels: {}

364

# -- Reference to the parent Gateway this ListenerSet attaches to

365

parentRef: {}

366

# name: my-gateway

367

# namespace: default

368

# group: gateway.networking.k8s.io

369

# kind: Gateway

370

371

# -- List of listeners to attach to the parent Gateway

372

listeners: []

373

# - name: https

374

# port: 443

375

# protocol: HTTPS

376

# hostname: grafana.example.com

377

# tls:

378

# mode: Terminate

379

# certificateRefs:

380

# - name: grafana-tls

381

# allowedRoutes:

382

# namespaces:

383

# from: Same

384

resources: {}

385

# limits:

386

# cpu: 100m

387

# memory: 128Mi

388

# requests:

389

# cpu: 100m

390

# memory: 128Mi

391

392

## Node labels for pod assignment

393

## ref: https://kubernetes.io/docs/user-guide/node-selection/

394

395

nodeSelector: {}

396

## Tolerations for pod assignment

397

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

398

399

tolerations: []

400

## Affinity for pod assignment (evaluated as template)

401

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

402

403

affinity: {}

404

## Topology Spread Constraints

405

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

406

407

topologySpreadConstraints: []

408

## Additional init containers (evaluated as template)

409

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

410

411

extraInitContainers: []

412

## Enable an Specify container in extraContainers. This is meant to allow adding an authentication proxy to a grafana pod

413

extraContainers: ""

414

# extraContainers: |

415

# - name: proxy

416

# image: quay.io/gambol99/keycloak-proxy:latest

417

# args:

418

# - -provider=github

419

# - -client-id=

420

# - -client-secret=

421

# - -github-org=<ORG_NAME>

422

# - -email-domain=*

423

# - -cookie-secret=

424

# - -http-address=http://0.0.0.0:4181

425

# - -upstream-url=http://127.0.0.1:3000

426

# ports:

427

# - name: proxy-web

428

# containerPort: 4181

429

430

## Volumes that can be used in init containers that will not be mounted to deployment pods

431

extraContainerVolumes: []

432

# - name: volume-from-secret

433

# secret:

434

# secretName: secret-to-mount

435

# - name: empty-dir-volume

436

# emptyDir: {}

437

438

## Enable persistence using Persistent Volume Claims

439

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

440

441

persistence:

442

type: pvc

443

enabled: false

444

# storageClassName: default

445

## (Optional) Use this to bind the claim to an existing PersistentVolume (PV) by name.

446

volumeName: ""

447

accessModes:

448

- ReadWriteOnce

449

size: 10Gi

450

# annotations: {}

451

finalizers:

452

- kubernetes.io/pvc-protection

453

# selectorLabels: {}

454

## Sub-directory of the PV to mount. Can be templated.

455

# subPath: ""

456

## Name of an existing PVC. Can be templated.

457

# existingClaim:

458

## Extra labels to apply to a PVC.

459

extraPvcLabels: {}

460

disableWarning: false

461

## Configure StatefulSet persistent volume claim retention policy.

462

## This is ignored when Grafana is configured to use a Deployment with a PVC.

463

## By default, Kubernetes uses Retain for both whenDeleted and whenScaled.

464

persistentVolumeClaimRetentionPolicy: {}

465

# whenDeleted: Retain

466

# whenScaled: Retain

467

468

## If persistence is not enabled, this allows to mount the

469

## local storage in-memory to improve performance

470

471

inMemory:

472

enabled: false

473

## The maximum usage on memory medium EmptyDir would be

474

## the minimum value between the SizeLimit specified

475

## here and the sum of memory limits of all containers in a pod

476

477

# sizeLimit: 300Mi

478

## If 'lookupVolumeName' is set to true, Helm will attempt to retrieve

479

## the current value of 'spec.volumeName' and incorporate it into the template.

480

lookupVolumeName: true

481

initChownData:

482

## If false, data ownership will not be reset at startup

483

## This allows the grafana-server to be run with an arbitrary user

484

485

enabled: true

486

## initChownData container image

487

488

image:

489

# -- The Docker registry

490

registry: chainreg.biz

491

repository: scratch-images/test-tmp/busybox

492

tag: glibc-1.37.0-r61

493

sha: sha256:4f399a5baa0b754857bd8ccd5878d7748ded9b25978eb760ea5d2f3e64ef36ab

494

pullPolicy: IfNotPresent

495

## initChownData resource requests and limits

496

## Ref: http://kubernetes.io/docs/user-guide/compute-resources/

497

498

resources: {}

499

# limits:

500

# cpu: 100m

501

# memory: 128Mi

502

# requests:

503

# cpu: 100m

504

# memory: 128Mi

505

securityContext:

506

readOnlyRootFilesystem: false

507

runAsNonRoot: false

508

runAsUser: 0

509

seccompProfile:

510

type: RuntimeDefault

511

capabilities:

512

add:

513

- CHOWN

514

- DAC_OVERRIDE

515

drop:

516

- ALL

517

# Administrator credentials when not using an existing secret (see below)

518

adminUser: admin

519

# adminPassword: strongpassword

520

521

# Use an existing secret for the admin user.

522

admin:

523

## Name of the secret. Can be templated.

524

existingSecret: ""

525

userKey: admin-user

526

passwordKey: admin-password

527

## Define command to be executed at startup by grafana container

528

## Needed if using `vault-env` to manage secrets (ref: https://banzaicloud.com/blog/inject-secrets-into-pods-vault/)

529

## Default is "run.sh" as defined in grafana's Dockerfile

530

# command:

531

# - "sh"

532

# - "/run.sh"

533

534

## Optionally define args if command is used

535

## Needed if using `hashicorp/envconsul` to manage secrets

536

## By default no arguments are set

537

# args:

538

# - "-secret"

539

# - "secret/grafana"

540

# - "./grafana"

541

542

## Extra environment variables that will be pass onto deployment pods

543

544

## to provide grafana with access to CloudWatch on AWS EKS:

545

## 1. create an iam role of type "Web identity" with provider oidc.eks.* (note the provider for later)

546

## 2. edit the "Trust relationships" of the role, add a line inside the StringEquals clause using the

547

## same oidc eks provider as noted before (same as the existing line)

548

## also, replace NAMESPACE and prometheus-operator-grafana with the service account namespace and name

549

550

## "oidc.eks.us-east-1.amazonaws.com/id/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:sub": "system:serviceaccount:NAMESPACE:prometheus-operator-grafana",

551

552

## 3. attach a policy to the role, you can use a built in policy called CloudWatchReadOnlyAccess

553

## 4. use the following env: (replace 123456789000 and iam-role-name-here with your aws account number and role name)

554

555

## env:

556

## AWS_ROLE_ARN: arn:aws:iam::123456789000:role/iam-role-name-here

557

## AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/eks.amazonaws.com/serviceaccount/token

558

## AWS_REGION: us-east-1

559

560

## 5. uncomment the EKS section in extraSecretMounts: below

561

## 6. uncomment the annotation section in the serviceAccount: above

562

## make sure to replace arn:aws:iam::123456789000:role/iam-role-name-here with your role arn

563

env: {}

564

## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.

565

## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core

566

## Renders in container spec as:

567

## env:

568

## ...

569

## - name: <key>

570

## valueFrom:

571

## <value rendered as YAML>

572

envValueFrom: {}

573

# ENV_NAME:

574

# configMapKeyRef:

575

# name: configmap-name

576

# key: value_key

577

578

## The name of a secret in the same kubernetes namespace which contain values to be added to the environment

579

## This can be useful for auth tokens, etc. Value is templated.

580

envFromSecret: ""

581

## Sensible environment variables that will be rendered as new secret object

582

## This can be useful for auth tokens, etc.

583

## If the secret values contains "{{", they'll need to be properly escaped so that they are not interpreted by Helm

584

## ref: https://helm.sh/docs/howto/charts_tips_and_tricks/#using-the-tpl-function

585

envRenderSecret: {}

586

## The names of secrets in the same kubernetes namespace which contain values to be added to the environment

587

## Each entry should contain a name key, and can optionally specify whether the secret must be defined with an optional key.

588

## Name is templated.

589

envFromSecrets: []

590

## - name: secret-name

591

## prefix: prefix

592

## optional: true

593

594

## The names of configmaps in the same kubernetes namespace which contain values to be added to the environment

595

## Each entry should contain a name key, and can optionally specify whether the configmap must be defined with an optional key.

596

## Name is templated.

597

## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#configmapenvsource-v1-core

598

envFromConfigMaps: []

599

## - name: configmap-name

600

## prefix: prefix

601

## optional: true

602

603

# Inject Kubernetes services as environment variables.

604

# See https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#environment-variables

605

enableServiceLinks: true

606

## Additional grafana server secret mounts

607

# Defines additional mounts with secrets. Secrets must be manually created in the namespace.

608

extraSecretMounts: []

609

# - name: secret-files

610

# mountPath: /etc/secrets

611

# secretName: grafana-secret-files

612

# readOnly: true

613

# optional: false

614

# subPath: ""

615

616

# for AWS EKS (cloudwatch) use the following (see also instruction in env: above)

617

# - name: aws-iam-token

618

# mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount

619

# readOnly: true

620

# projected:

621

# defaultMode: 420

622

# sources:

623

# - serviceAccountToken:

624

# audience: sts.amazonaws.com

625

# expirationSeconds: 86400

626

# path: token

627

628

# for CSI e.g. Azure Key Vault use the following

629

# - name: secrets-store-inline

630

# mountPath: /run/secrets/vault.azure.com

631

# readOnly: true

632

# csi:

633

# driver: secrets-store.csi.k8s.io

634

# readOnly: true

635

# volumeAttributes:

636

# secretProviderClass: "akv-grafana-spc"

637

# nodePublishSecretRef: # Only required when using service principal mode

638

# name: grafana-akv-creds # Only required when using service principal mode

639

640

## Additional grafana server volume mounts

641

# Defines additional volume mounts.

642

extraVolumeMounts: []

643

# - name: extra-volume-0

644

# mountPath: /mnt/volume0

645

# readOnly: true

646

# - name: extra-volume-1

647

# mountPath: /mnt/volume1

648

# readOnly: true

649

# - name: grafana-secrets

650

# mountPath: /mnt/volume2

651

652

## Additional Grafana server volumes

653

extraVolumes: []

654

# - name: extra-volume-0

655

# existingClaim: volume-claim

656

# - name: extra-volume-1

657

# hostPath:

658

# path: /usr/shared/

659

# type: ""

660

# - name: grafana-secrets

661

# csi:

662

# driver: secrets-store.csi.k8s.io

663

# readOnly: true

664

# volumeAttributes:

665

# secretProviderClass: "grafana-env-spc"

666

667

## Container Lifecycle Hooks. Execute a specific bash command or make an HTTP request

668

lifecycleHooks: {}

669

# postStart:

670

# exec:

671

# command: []

672

673

## Pass the plugins you want installed as a list.

674

675

plugins: []

676

# - digrich-bubblechart-panel

677

# - grafana-clock-panel

678

## You can also use other plugin download URL, as long as they are valid zip files,

679

## and specify the name of the plugin as prefix, with an version. Like this:

680

# - marcusolsson-json-datasource@1.3.24@https://grafana.com/api/plugins/marcusolsson-json-datasource/versions/1.3.24/download

681

682

## Configure grafana datasources

683

## ref: http://docs.grafana.org/administration/provisioning/#datasources

684

685

datasources: {}

686

# datasources.yaml:

687

# apiVersion: 1

688

# datasources:

689

# - name: Prometheus

690

# type: prometheus

691

# url: http://prometheus-prometheus-server

692

# access: proxy

693

# isDefault: true

694

# - name: CloudWatch

695

# type: cloudwatch

696

# access: proxy

697

# uid: cloudwatch

698

# editable: false

699

# jsonData:

700

# authType: default

701

# defaultRegion: us-east-1

702

# deleteDatasources: []

703

# - name: Prometheus

704

705

## Configure grafana alerting (can be templated)

706

## ref: https://docs.grafana.com/alerting/set-up/provision-alerting-resources/file-provisioning/

707

708

alerting: {}

709

# policies.yaml:

710

# apiVersion: 1

711

# policies:

712

# - orgId: 1

713

# receiver: first_uid

714

715

# rules.yaml:

716

# apiVersion: 1

717

# groups:

718

# - orgId: 1

719

# name: '{{ .Chart.Name }}_my_rule_group'

720

# folder: my_first_folder

721

# interval: 60s

722

# rules:

723

# - uid: my_id_1

724

# title: my_first_rule

725

# condition: A

726

# data:

727

# - refId: A

728

# datasourceUid: '-100'

729

# model:

730

# conditions:

731

# - evaluator:

732

# params:

733

# - 3

734

# type: gt

735

# operator:

736

# type: and

737

# query:

738

# params:

739

# - A

740

# reducer:

741

# type: last

742

# type: query

743

# datasource:

744

# type: __expr__

745

# uid: '-100'

746

# expression: 1==0

747

# intervalMs: 1000

748

# maxDataPoints: 43200

749

# refId: A

750

# type: math

751

# dashboardUid: my_dashboard

752

# panelId: 123

753

# noDataState: Alerting

754

# for: 60s

755

# annotations:

756

# some_key: some_value

757

# labels:

758

# team: sre_team_1

759

760

# contactpoints.yaml:

761

# secret:

762

# apiVersion: 1

763

# contactPoints:

764

# - orgId: 1

765

# name: cp_1

766

# receivers:

767

# - uid: first_uid

768

# type: pagerduty

769

# settings:

770

# integrationKey: XXX

771

# severity: critical

772

# class: ping failure

773

# component: Grafana

774

# group: app-stack

775

# summary: |

776

# {{ `{{ include "default.message" . }}` }}

777

778

# templates.yaml:

779

# apiVersion: 1

780

# templates:

781

# - orgId: 1

782

# name: my_first_template

783

# template: |

784

# {{ `

785

# {{ define "my_first_template" }}

786

# Custom notification message

787

# {{ end }}

788

# ` }}

789

790

# mutetimes.yaml

791

# apiVersion: 1

792

# muteTimes:

793

# - orgId: 1

794

# name: mti_1

795

# # refer to https://prometheus.io/docs/alerting/latest/configuration/#time_interval-0

796

# time_intervals: {}

797

798

## Configure notifiers

799

## ref: http://docs.grafana.org/administration/provisioning/#alert-notification-channels

800

801

notifiers: {}

802

# notifiers.yaml:

803

# notifiers:

804

# - name: email-notifier

805

# type: email

806

# uid: email1

807

# # either:

808

# org_id: 1

809

# # or

810

# org_name: Main Org.

811

# is_default: true

812

# settings:

813

# addresses: an_email_address@example.com

814

# delete_notifiers:

815

816

## Configure grafana dashboard providers

817

## ref: http://docs.grafana.org/administration/provisioning/#dashboards

818

819

## `path` must be /var/lib/grafana/dashboards/<provider_name>

820

821

dashboardProviders: {}

822

# dashboardproviders.yaml:

823

# apiVersion: 1

824

# providers:

825

# - name: 'default'

826

# orgId: 1

827

# folder: ''

828

# type: file

829

# disableDeletion: false

830

# editable: true

831

# options:

832

# path: /var/lib/grafana/dashboards/default

833

834

## Configure how curl fetches remote dashboards. The beginning dash is required.

835

## NOTE: This sets the default short flags for all dashboards, but these

836

## defaults can be overridden individually for each dashboard by setting

837

## curlOptions. See the example dashboards section below.

838

839

## -s - silent mode

840

## -k - allow insecure (eg: non-TLS) connections

841

## -f - fail fast

842

## See the curl documentation for additional options

843

844

defaultCurlOptions: "-skf"

845

## Configure grafana dashboard to import

846

## NOTE: To use dashboards you must also enable/configure dashboardProviders

847

## ref: https://grafana.com/dashboards

848

849

## dashboards per provider, use provider name as key.

850

## For dashboards downloaded via gnetId or url, the optional "title" key overrides

851

## the dashboard title in the downloaded JSON so the UI displays your custom title.

852

853

dashboards: {}

854

# default:

855

# some-dashboard:

856

# json: |

857

# $RAW_JSON

858

# custom-dashboard:

859

# file: dashboards/custom-dashboard.json

860

# prometheus-stats:

861

# title: My Custom Dashboard Title # optional; overrides the dashboard title in the downloaded JSON

862

# gnetId: 2

863

# revision: 2

864

# datasource: Prometheus

865

# local-dashboard:

866

# url: https://example.com/repository/test.json

867

# curlOptions: "-sLf"

868

# token: ''

869

# local-dashboard-base64:

870

# url: https://example.com/repository/test-b64.json

871

# token: ''

872

# b64content: true

873

# local-dashboard-gitlab:

874

# url: https://example.com/repository/test-gitlab.json

875

# gitlabToken: ''

876

# local-dashboard-bitbucket:

877

# url: https://example.com/repository/test-bitbucket.json

878

# bearerToken: ''

879

# local-dashboard-azure:

880

# url: https://example.com/repository/test-azure.json

881

# basic: ''

882

# acceptHeader: '*/*'

883

884

## Reference to external ConfigMap per provider. Use provider name as key and ConfigMap name as value.

885

## A provider dashboards must be defined either by external ConfigMaps or in values.yaml, not in both.

886

## ConfigMap data example:

887

888

## data:

889

## example-dashboard.json: |

890

## RAW_JSON

891

892

dashboardsConfigMaps: {}

893

# default: ""

894

895

## Grafana's primary configuration

896

## NOTE: values in map will be converted to ini format

897

## ref: http://docs.grafana.org/installation/configuration/

898

899

grafana.ini:

900

paths:

901

data: /var/lib/grafana/

902

logs: /var/log/grafana

903

plugins: /var/lib/grafana/plugins

904

provisioning: /etc/grafana/provisioning

905

analytics:

906

check_for_updates: true

907

log:

908

mode: console

909

server:

910

domain: "{{ if (and .Values.ingress.enabled .Values.ingress.hosts) }}{{ tpl (.Values.ingress.hosts | first) . }}{{ else if (and .Values.route.main.enabled .Values.route.main.hostnames) }}{{ tpl (.Values.route.main.hostnames | first) . }}{{ else }}''{{ end }}"

911

unified_storage:

912

index_path: /var/lib/grafana-search/bleve

913

## grafana Authentication can be enabled with the following values on grafana.ini

914

# server:

915

# The full public facing url you use in browser, used for redirects and emails

916

# root_url:

917

# https://grafana.com/docs/grafana/latest/auth/github/#enable-github-in-grafana

918

# auth.github:

919

# enabled: false

920

# allow_sign_up: false

921

# scopes: user:email,read:org

922

# auth_url: https://github.com/login/oauth/authorize

923

# token_url: https://github.com/login/oauth/access_token

924

# api_url: https://api.github.com/user

925

# team_ids:

926

# allowed_organizations:

927

# client_id:

928

# client_secret:

929

## LDAP Authentication can be enabled with the following values on grafana.ini

930

## NOTE: Grafana will fail to start if the value for ldap.toml is invalid

931

# auth.ldap:

932

# enabled: true

933

# allow_sign_up: true

934

# config_file: /etc/grafana/ldap.toml

935

## Grafana's alerting configuration

936

# unified_alerting:

937

# enabled: true

938

# rule_version_record_limit: "5"

939

940

## Grafana's LDAP configuration

941

## Templated by the template in _helpers.tpl

942

## NOTE: To enable the grafana.ini must be configured with auth.ldap.enabled

943

## ref: http://docs.grafana.org/installation/configuration/#auth-ldap

944

## ref: http://docs.grafana.org/installation/ldap/#configuration

945

ldap:

946

enabled: false

947

# `existingSecret` is a reference to an existing secret containing the ldap configuration

948

# for Grafana in a key `ldap-toml`.

949

existingSecret: ""

950

# `config` is the content of `ldap.toml` that will be stored in the created secret

951

config: ""

952

# config: |-

953

# verbose_logging = true

954

# [[servers]]

955

# host = "my-ldap-server"

956

# port = 636

957

# use_ssl = true

958

# start_tls = false

959

# ssl_skip_verify = false

960

# bind_dn = "uid=%s,ou=users,dc=myorg,dc=com"

961

962

# When process namespace sharing is enabled, processes in a container are visible to all other containers in the same pod

963

# This parameter is added because the ldap reload api is not working https://grafana.com/docs/grafana/latest/developers/http_api/admin/#reload-ldap-configuration

964

# To allow an extraContainer to restart the Grafana container

965

shareProcessNamespace: false

966

## Grafana's SMTP configuration

967

## NOTE: To enable, grafana.ini must be configured with smtp.enabled

968

## ref: http://docs.grafana.org/installation/configuration/#smtp

969

smtp:

970

# `existingSecret` is a reference to an existing secret containing the smtp configuration

971

# for Grafana.

972

existingSecret: ""

973

userKey: "user"

974

passwordKey: "password"

975

## Sidecars that collect the configmaps with specified label and stores the included files them into the respective folders

976

## Requires at least Grafana 5 to work and can't be used together with parameters dashboardProviders, datasources and dashboards

977

sidecar:

978

image:

979

# -- The Docker registry

980

registry: chainreg.biz

981

repository: scratch-images/test-tmp/k8s-sidecar

982

tag: 2.10.1-r0

983

sha: sha256:0e00533a0444150958422e66e1ee30a759d6df2b5beaf521ad20c4b381b94c61

984

imagePullPolicy: IfNotPresent

985

resources: {}

986

# limits:

987

# cpu: 100m

988

# memory: 100Mi

989

# requests:

990

# cpu: 50m

991

# memory: 50Mi

992

securityContext:

993

allowPrivilegeEscalation: false

994

capabilities:

995

drop:

996

- ALL

997

seccompProfile:

998

type: RuntimeDefault

999

# Set to true to skip tls verification for kube api calls. Can be overridden per sidecar

1000

# skipTlsVerify: true

1001

enableUniqueFilenames: false

1002

readinessProbe: {}

1003

livenessProbe: {}

1004

# Log level default for all sidecars. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL. Defaults to INFO

1005

# logLevel: INFO

1006

alerts:

1007

enabled: false

1008

# Additional environment variables for the alerts sidecar

1009

env: {}

1010

## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.

1011

## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core

1012

## Renders in container spec as:

1013

## env:

1014

## ...

1015

## - name: <key>

1016

## valueFrom:

1017

## <value rendered as YAML>

1018

envValueFrom: {}

1019

# ENV_NAME:

1020

# configMapKeyRef:

1021

# name: configmap-name

1022

# key: value_key

1023

# Do not reprocess already processed unchanged resources on k8s API reconnect.

1024

# ignoreAlreadyProcessed: true

1025

# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify

1026

# skipTlsVerify: true

1027

# label that the configmaps with alert are marked with (can be templated)

1028

label: grafana_alert

1029

# value of label that the configmaps with alert are set to (can be templated)

1030

labelValue: ""

1031

# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.

1032

# logLevel: INFO

1033

# If specified, the sidecar will search for alert config-maps inside this namespace.

1034

# Otherwise the namespace in which the sidecar is running will be used.

1035

# It's also possible to specify ALL to search in all namespaces

1036

searchNamespace: null

1037

# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.

1038

watchMethod: WATCH

1039

# search in configmap, secret or both

1040

resource: both

1041

1042

# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.

1043

# per default all resources of the type defined in {{ .Values.sidecar.alerts.resource }} will be checked.

1044

# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.

1045

# resourceName: "secret/alerts-1,configmap/alerts-0"

1046

resourceName: ""

1047

1048

# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.

1049

# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S

1050

# watchServerTimeout: 3600

1051

1052

# watchClientTimeout: is a client-side timeout, configuring your local socket.

1053

# If you have a network outage dropping all packets with no RST/FIN,

1054

# this is how long your client waits before realizing & dropping the connection.

1055

# defaults to 66sec (sic!)

1056

# watchClientTimeout: 60

1057

1058

# maxTotalRetries: Total number of retries to allow for any http request.

1059

# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.

1060

# Set to 0 to fail on the first retry.

1061

# maxTotalRetries: 5

1062

1063

# maxConnectRetries: How many connection-related errors to retry on for any http request.

1064

# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.

1065

# Applies to all requests to reloadURL and k8s api requests.

1066

# Set to 0 to fail on the first retry of this type.

1067

# maxConnectRetries: 10

1068

1069

# maxReadRetries: How many times to retry on read errors for any http request

1070

# These errors are raised after the request was sent to the server, so the request may have side-effects.

1071

# Applies to all requests to reloadURL and k8s api requests.

1072

# Set to 0 to fail on the first retry of this type.

1073

# maxReadRetries: 5

1074

1075

# Endpoint to send request to reload alerts

1076

reloadURL: "http://localhost:3000/api/admin/provisioning/alerting/reload"

1077

# Absolute path to a script to execute after a configmap got reloaded.

1078

# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.

1079

# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python

1080

script: null

1081

skipReload: false

1082

# This is needed if skipReload is true, to load any alerts defined at startup time.

1083

# Deploy the alert sidecar as an initContainer.

1084

initAlerts: false

1085

# Use native sidecar https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

1086

# restartPolicy: Always

1087

# # only applies to native sidecars

1088

# startupProbe:

1089

# httpGet:

1090

# path: /healthz

1091

# port: 8080

1092

# initialDelaySeconds: 5

1093

# periodSeconds: 5

1094

# failureThreshold: 60 # 5 minutes

1095

# Additional alerts sidecar volume mounts

1096

extraMounts: []

1097

# Sets the size limit of the alert sidecar emptyDir volume

1098

sizeLimit: ""

1099

dashboards:

1100

enabled: false

1101

# Additional environment variables for the dashboards sidecar

1102

env: {}

1103

## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.

1104

## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core

1105

## Renders in container spec as:

1106

## env:

1107

## ...

1108

## - name: <key>

1109

## valueFrom:

1110

## <value rendered as YAML>

1111

envValueFrom: {}

1112

# ENV_NAME:

1113

# configMapKeyRef:

1114

# name: configmap-name

1115

# key: value_key

1116

# Do not reprocess already processed unchanged resources on k8s API reconnect.

1117

# ignoreAlreadyProcessed: true

1118

# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify

1119

# skipTlsVerify: true

1120

SCProvider: true

1121

# label that the configmaps with dashboards are marked with (can be templated)

1122

label: grafana_dashboard

1123

# value of label that the configmaps with dashboards are set to (can be templated)

1124

labelValue: ""

1125

# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.

1126

# logLevel: INFO

1127

# folder in the pod that should hold the collected dashboards (unless `defaultFolderName` is set)

1128

folder: /tmp/dashboards

1129

# The default folder name, it will create a subfolder under the `folder` and put dashboards in there instead

1130

defaultFolderName: null

1131

# Namespaces list. If specified, the sidecar will search for config-maps/secrets inside these namespaces.

1132

# Otherwise the namespace in which the sidecar is running will be used.

1133

# It's also possible to specify ALL to search in all namespaces.

1134

searchNamespace: null

1135

# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.

1136

watchMethod: WATCH

1137

# search in configmap, secret or both

1138

resource: both

1139

# If specified, the sidecar will look for annotation with this name to create folder and put graph here.

1140

# You can use this parameter together with `provider.foldersFromFilesStructure`to annotate configmaps and create folder structure.

1141

folderAnnotation: null

1142

1143

# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.

1144

# per default all resources of the type defined in {{ .Values.sidecar.dashboards.resource }} will be checked.

1145

# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.

1146

# resourceName: "secret/dashboards-0,configmap/dashboards-1"

1147

resourceName: ""

1148

1149

# maxTotalRetries: Total number of retries to allow for any http request.

1150

# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.

1151

# Set to 0 to fail on the first retry.

1152

# maxTotalRetries: 5

1153

1154

# maxConnectRetries: How many connection-related errors to retry on for any http request.

1155

# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.

1156

# Applies to all requests to reloadURL and k8s api requests.

1157

# Set to 0 to fail on the first retry of this type.

1158

# maxConnectRetries: 10

1159

1160

# maxReadRetries: How many times to retry on read errors for any http request

1161

# These errors are raised after the request was sent to the server, so the request may have side-effects.

1162

# Applies to all requests to reloadURL and k8s api requests.

1163

# Set to 0 to fail on the first retry of this type.

1164

# maxReadRetries: 5

1165

1166

# Endpoint to send request to reload alerts

1167

reloadURL: "http://localhost:3000/api/admin/provisioning/dashboards/reload"

1168

# Absolute path to a script to execute after a configmap got reloaded.

1169

# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.

1170

# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python

1171

script: null

1172

skipReload: false

1173

# This is needed if skipReload is true, to load any dashboards defined at startup time.

1174

# Deploy the dashboard sidecar as an initContainer.

1175

initDashboards: false

1176

# Use native sidecar https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

1177

# restartPolicy: Always

1178

# # only applies to native sidecars

1179

# startupProbe:

1180

# httpGet:

1181

# path: /healthz

1182

# port: 8083

1183

# initialDelaySeconds: 5

1184

# periodSeconds: 5

1185

# failureThreshold: 60 # 5 minutes

1186

# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.

1187

# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S

1188

# watchServerTimeout: 3600

1189

1190

# watchClientTimeout: is a client-side timeout, configuring your local socket.

1191

# If you have a network outage dropping all packets with no RST/FIN,

1192

# this is how long your client waits before realizing & dropping the connection.

1193

# defaults to 66sec (sic!)

1194

# watchClientTimeout: 60

1195

1196

# provider configuration that lets grafana manage the dashboards

1197

provider:

1198

# name of the provider, should be unique

1199

name: sidecarProvider

1200

# orgid as configured in grafana

1201

orgid: 1

1202

# folder in which the dashboards should be imported in grafana

1203

folder: ''

1204

# <string> folder UID. will be automatically generated if not specified

1205

folderUid: ''

1206

# type of the provider

1207

type: file

1208

# disableDelete to activate a import-only behaviour

1209

disableDelete: false

1210

# allow updating provisioned dashboards from the UI

1211

allowUiUpdates: false

1212

# allow Grafana to replicate dashboard structure from filesystem

1213

foldersFromFilesStructure: false

1214

# Additional dashboards sidecar volume mounts

1215

extraMounts: []

1216

# Sets the size limit of the dashboard sidecar emptyDir volume

1217

sizeLimit: ""

1218

datasources:

1219

enabled: false

1220

# Additional environment variables for the datasourcessidecar

1221

env: {}

1222

## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.

1223

## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core

1224

## Renders in container spec as:

1225

## env:

1226

## ...

1227

## - name: <key>

1228

## valueFrom:

1229

## <value rendered as YAML>

1230

envValueFrom: {}

1231

# ENV_NAME:

1232

# configMapKeyRef:

1233

# name: configmap-name

1234

# key: value_key

1235

# Do not reprocess already processed unchanged resources on k8s API reconnect.

1236

# ignoreAlreadyProcessed: true

1237

# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify

1238

# skipTlsVerify: true

1239

# label that the configmaps with datasources are marked with (can be templated)

1240

label: grafana_datasource

1241

# value of label that the configmaps with datasources are set to (can be templated)

1242

labelValue: ""

1243

# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.

1244

# logLevel: INFO

1245

# If specified, the sidecar will search for datasource config-maps inside this namespace.

1246

# Otherwise the namespace in which the sidecar is running will be used.

1247

# It's also possible to specify ALL to search in all namespaces

1248

searchNamespace: null

1249

# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.

1250

watchMethod: WATCH

1251

# search in configmap, secret or both

1252

resource: both

1253

1254

# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.

1255

# per default all resources of the type defined in {{ .Values.sidecar.datasources.resource }} will be checked.

1256

# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.

1257

# resourceName: "secret/datasources-0,configmap/datasources-15"

1258

resourceName: ""

1259

1260

# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.

1261

# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S

1262

# watchServerTimeout: 3600

1263

1264

# watchClientTimeout: is a client-side timeout, configuring your local socket.

1265

# If you have a network outage dropping all packets with no RST/FIN,

1266

# this is how long your client waits before realizing & dropping the connection.

1267

# defaults to 66sec (sic!)

1268

# watchClientTimeout: 60

1269

1270

# maxTotalRetries: Total number of retries to allow for any http request.

1271

# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.

1272

# Set to 0 to fail on the first retry.

1273

# maxTotalRetries: 5

1274

1275

# maxConnectRetries: How many connection-related errors to retry on for any http request.

1276

# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.

1277

# Applies to all requests to reloadURL and k8s api requests.

1278

# Set to 0 to fail on the first retry of this type.

1279

# maxConnectRetries: 10

1280

1281

# maxReadRetries: How many times to retry on read errors for any http request

1282

# These errors are raised after the request was sent to the server, so the request may have side-effects.

1283

# Applies to all requests to reloadURL and k8s api requests.

1284

# Set to 0 to fail on the first retry of this type.

1285

# maxReadRetries: 5

1286

1287

# Endpoint to send request to reload datasources

1288

reloadURL: "http://localhost:3000/api/admin/provisioning/datasources/reload"

1289

# Absolute path to a script to execute after a configmap got reloaded.

1290

# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.

1291

# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python

1292

script: null

1293

skipReload: false

1294

# This is needed if skipReload is true, to load any datasources defined at startup time.

1295

# Deploy the datasources sidecar as an initContainer.

1296

initDatasources: false

1297

# Use native sidecar https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

1298

# restartPolicy: Always

1299

# # only applies to native sidecars

1300

# startupProbe:

1301

# httpGet:

1302

# path: /healthz

1303

# port: 8081

1304

# initialDelaySeconds: 5

1305

# periodSeconds: 5

1306

# failureThreshold: 60 # 5 minutes

1307

# Additional datasources sidecar volume mounts

1308

extraMounts: []

1309

# Sets the size limit of the datasource sidecar emptyDir volume

1310

sizeLimit: ""

1311

plugins:

1312

enabled: false

1313

# Additional environment variables for the plugins sidecar

1314

env: {}

1315

# Do not reprocess already processed unchanged resources on k8s API reconnect.

1316

# ignoreAlreadyProcessed: true

1317

# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify

1318

# skipTlsVerify: true

1319

# label that the configmaps with plugins are marked with (can be templated)

1320

label: grafana_plugin

1321

# value of label that the configmaps with plugins are set to (can be templated)

1322

labelValue: ""

1323

# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.

1324

# logLevel: INFO

1325

# If specified, the sidecar will search for plugin config-maps inside this namespace.

1326

# Otherwise the namespace in which the sidecar is running will be used.

1327

# It's also possible to specify ALL to search in all namespaces

1328

searchNamespace: null

1329

# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.

1330

watchMethod: WATCH

1331

# search in configmap, secret or both

1332

resource: both

1333

1334

# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.

1335

# per default all resources of the type defined in {{ .Values.sidecar.plugins.resource }} will be checked.

1336

# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.

1337

# resourceName: "secret/plugins-0,configmap/plugins-1"

1338

resourceName: ""

1339

1340

# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.

1341

# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S

1342

# watchServerTimeout: 3600

1343

1344

# watchClientTimeout: is a client-side timeout, configuring your local socket.

1345

# If you have a network outage dropping all packets with no RST/FIN,

1346

# this is how long your client waits before realizing & dropping the connection.

1347

# defaults to 66sec (sic!)

1348

# watchClientTimeout: 60

1349

1350

# maxTotalRetries: Total number of retries to allow for any http request.

1351

# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.

1352

# Set to 0 to fail on the first retry.

1353

# maxTotalRetries: 5

1354

1355

# maxConnectRetries: How many connection-related errors to retry on for any http request.

1356

# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.

1357

# Applies to all requests to reloadURL and k8s api requests.

1358

# Set to 0 to fail on the first retry of this type.

1359

# maxConnectRetries: 10

1360

1361

# maxReadRetries: How many times to retry on read errors for any http request

1362

# These errors are raised after the request was sent to the server, so the request may have side-effects.

1363

# Applies to all requests to reloadURL and k8s api requests.

1364

# Set to 0 to fail on the first retry of this type.

1365

# maxReadRetries: 5

1366

1367

# Endpoint to send request to reload plugins

1368

reloadURL: "http://localhost:3000/api/admin/provisioning/plugins/reload"

1369

# Absolute path to a script to execute after a configmap got reloaded.

1370

# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.

1371

# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python

1372

script: null

1373

skipReload: false

1374

# Deploy the datasource sidecar as an initContainer in addition to a container.

1375

# This is needed if skipReload is true, to load any plugins defined at startup time.

1376

initPlugins: false

1377

# Additional plugins sidecar volume mounts

1378

extraMounts: []

1379

# Sets the size limit of the plugin sidecar emptyDir volume

1380

sizeLimit: ""

1381

notifiers:

1382

enabled: false

1383

# Additional environment variables for the notifierssidecar

1384

env: {}

1385

# Do not reprocess already processed unchanged resources on k8s API reconnect.

1386

# ignoreAlreadyProcessed: true

1387

# Set to true to skip tls verification for kube api calls. Overrides sidecar.skipTlsVerify

1388

# skipTlsVerify: true

1389

# label that the configmaps with notifiers are marked with (can be templated)

1390

label: grafana_notifier

1391

# value of label that the configmaps with notifiers are set to (can be templated)

1392

labelValue: ""

1393

# Log level. Can be one of: DEBUG, INFO, WARN, ERROR, CRITICAL.

1394

# logLevel: INFO

1395

# If specified, the sidecar will search for notifier config-maps inside this namespace.

1396

# Otherwise the namespace in which the sidecar is running will be used.

1397

# It's also possible to specify ALL to search in all namespaces

1398

searchNamespace: null

1399

# Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.

1400

watchMethod: WATCH

1401

# search in configmap, secret or both

1402

resource: both

1403

1404

# resourceName: comma separated list of resource names to be fetched/checked by this sidecar.

1405

# per default all resources of the type defined in {{ .Values.sidecar.notifiers.resource }} will be checked.

1406

# This e.g. allows stricter RBAC rules which are limited to the resources meant for the sidecars.

1407

# resourceName: "secret/notifiers-2,configmap/notifiers-1"

1408

resourceName: ""

1409

1410

# watchServerTimeout: request to the server, asking it to cleanly close the connection after that.

1411

# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S

1412

# watchServerTimeout: 3600

1413

1414

# watchClientTimeout: is a client-side timeout, configuring your local socket.

1415

# If you have a network outage dropping all packets with no RST/FIN,

1416

# this is how long your client waits before realizing & dropping the connection.

1417

# defaults to 66sec (sic!)

1418

# watchClientTimeout: 60

1419

1420

# maxTotalRetries: Total number of retries to allow for any http request.

1421

# Takes precedence over other counts. Applies to all requests to reloadURL and k8s api requests.

1422

# Set to 0 to fail on the first retry.

1423

# maxTotalRetries: 5

1424

1425

# maxConnectRetries: How many connection-related errors to retry on for any http request.

1426

# These are errors raised before the request is sent to the remote server, which we assume has not triggered the server to process the request.

1427

# Applies to all requests to reloadURL and k8s api requests.

1428

# Set to 0 to fail on the first retry of this type.

1429

# maxConnectRetries: 10

1430

1431

# maxReadRetries: How many times to retry on read errors for any http request

1432

# These errors are raised after the request was sent to the server, so the request may have side-effects.

1433

# Applies to all requests to reloadURL and k8s api requests.

1434

# Set to 0 to fail on the first retry of this type.

1435

# maxReadRetries: 5

1436

1437

# Endpoint to send request to reload notifiers

1438

reloadURL: "http://localhost:3000/api/admin/provisioning/notifications/reload"

1439

# Absolute path to a script to execute after a configmap got reloaded.

1440

# It runs before calls to REQ_URI. If the file is not executable it will be passed to sh.

1441

# Otherwise, it's executed as is. Shebangs known to work are #!/bin/sh and #!/usr/bin/env python

1442

script: null

1443

skipReload: false

1444

# Deploy the notifier sidecar as an initContainer in addition to a container.

1445

# This is needed if skipReload is true, to load any notifiers defined at startup time.

1446

initNotifiers: false

1447

# Use native sidecar https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

1448

# restartPolicy: Always

1449

# # only applies to native sidecars

1450

# startupProbe:

1451

# httpGet:

1452

# path: /healthz

1453

# port: 8082

1454

# initialDelaySeconds: 5

1455

# periodSeconds: 5

1456

# failureThreshold: 60 # 5 minutes

1457

# Additional notifiers sidecar volume mounts

1458

extraMounts: []

1459

# Sets the size limit of the notifier sidecar emptyDir volume

1460

sizeLimit: ""

1461

## Override the deployment namespace

1462

1463

namespaceOverride: ""

1464

## Number of old ReplicaSets to retain

1465

1466

revisionHistoryLimit: 10

1467

## Add a separate remote image renderer deployment/service

1468

imageRenderer:

1469

deploymentStrategy: {}

1470

## The maximum time in seconds for the image renderer Deployment to make progress before it is

1471

## considered to be failed.

1472

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds

1473

progressDeadlineSeconds: null

1474

# Enable the image-renderer deployment & service

1475

enabled: false

1476

replicas: 1

1477

autoscaling:

1478

enabled: false

1479

minReplicas: 1

1480

maxReplicas: 5

1481

targetCPU: "60"

1482

targetMemory: ""

1483

behavior: {}

1484

# The url of remote image renderer if it is not in the same namespace with the grafana instance

1485

serverURL: ""

1486

# The callback url of grafana instances if it is not in the same namespace with the remote image renderer

1487

renderingCallbackURL: ""

1488

# Token used for authentication between Grafana and the remote image renderer.

1489

token: ""

1490

# Use an existing secret for the image renderer token. Must contain a key named "token".

1491

existingSecret: ""

1492

image:

1493

# -- The Docker registry

1494

registry: chainreg.biz

1495

# image-renderer Image repository

1496

repository: scratch-images/test-tmp/grafana-image-renderer

1497

# image-renderer Image tag

1498

tag: 5.11.1-r0

1499

# image-renderer Image sha (optional)

1500

sha: sha256:26ea28c176e41a0f0434ecf5bce0a7201d0f06f6ddfe31699e11d014154e87ca

1501

# image-renderer Image pull secrets (optional)

1502

pullSecrets: []

1503

# image-renderer ImagePullPolicy

1504

pullPolicy: Always

1505

dnsPolicy: ~

1506

dnsConfig: {}

1507

# nameservers:

1508

# - 8.8.8.8

1509

# options:

1510

# - name: ndots

1511

# value: "2"

1512

# - name: edns0

1513

# extra environment variables

1514

env:

1515

HTTP_HOST: "0.0.0.0"

1516

# Fixes "Error: Failed to launch the browser process!\nchrome_crashpad_handler: --database is required"

1517

XDG_CONFIG_HOME: /tmp/.chromium

1518

XDG_CACHE_HOME: /tmp/.chromium

1519

# RENDERING_ARGS: --no-sandbox,--disable-gpu,--window-size=1280x758

1520

# RENDERING_MODE: clustered

1521

# IGNORE_HTTPS_ERRORS: true

1522

## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.

1523

## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core

1524

## Renders in container spec as:

1525

## env:

1526

## ...

1527

## - name: <key>

1528

## valueFrom:

1529

## <value rendered as YAML>

1530

envValueFrom: {}

1531

# ENV_NAME:

1532

# configMapKeyRef:

1533

# name: configmap-name

1534

# key: value_key

1535

1536

# image-renderer deployment serviceAccount

1537

serviceAccountName: ""

1538

automountServiceAccountToken: false

1539

# image-renderer deployment hostUsers

1540

hostUsers: ~

1541

# image-renderer deployment securityContext

1542

securityContext: {}

1543

# image-renderer deployment container securityContext

1544

containerSecurityContext:

1545

seccompProfile:

1546

type: RuntimeDefault

1547

capabilities:

1548

drop: ['ALL']

1549

allowPrivilegeEscalation: false

1550

readOnlyRootFilesystem: true

1551

## image-renderer pod annotation

1552

podAnnotations: {}

1553

# image-renderer deployment Host Aliases

1554

hostAliases: []

1555

# image-renderer deployment priority class

1556

priorityClassName: ''

1557

# Path to the healthcheck endpoint. On Image Renderer v5.0.0 or newer, this is '/healthz'. Older versions use '/'.

1558

healthcheckPath: '/healthz'

1559

service:

1560

# Enable the image-renderer service

1561

enabled: true

1562

# image-renderer service port name

1563

portName: 'http'

1564

# image-renderer service port used by both service and deployment

1565

port: 8081

1566

targetPort: 8081

1567

# Adds the appProtocol field to the image-renderer service. This allows to work with istio protocol selection. Ex: "http" or "tcp"

1568

appProtocol: ""

1569

serviceMonitor:

1570

## If true, a ServiceMonitor CRD is created for a prometheus operator

1571

## https://github.com/coreos/prometheus-operator

1572

1573

enabled: false

1574

path: /metrics

1575

# namespace: monitoring (defaults to use the namespace this chart is deployed to)

1576

labels: {}

1577

# Set these to override the Prometheus global scrape interval/timeout.

1578

# interval: 1m

1579

# scrapeTimeout: 30s

1580

scheme: http

1581

tlsConfig: {}

1582

relabelings: []

1583

# See: https://doc.crds.dev/github.com/prometheus-operator/kube-prometheus/monitoring.coreos.com/ServiceMonitor/v1@v0.11.0#spec-targetLabels

1584

targetLabels: []

1585

# - targetLabel1

1586

# - targetLabel2

1587

# If https is enabled in Grafana, this needs to be set as 'https' to correctly configure the callback used in Grafana

1588

grafanaProtocol: http

1589

# In case a sub_path is used this needs to be added to the image renderer callback

1590

grafanaSubPath: ""

1591

# name of the image-renderer port on the pod

1592

podPortName: http

1593

# number of image-renderer replica sets to keep

1594

revisionHistoryLimit: 10

1595

networkPolicy:

1596

# Enable a NetworkPolicy to limit inbound traffic to only the created grafana pods

1597

limitIngress: true

1598

# Enable a NetworkPolicy to limit outbound traffic to only the created grafana pods

1599

limitEgress: false

1600

# Allow additional services to access image-renderer (eg. Prometheus operator when ServiceMonitor is enabled)

1601

extraIngressSelectors: []

1602

resources: {}

1603

# limits:

1604

# cpu: 100m

1605

# memory: 100Mi

1606

# requests:

1607

# cpu: 50m

1608

# memory: 50Mi

1609

## Node labels for pod assignment

1610

## ref: https://kubernetes.io/docs/user-guide/node-selection/

1611

1612

nodeSelector: {}

1613

## Tolerations for pod assignment

1614

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1615

1616

tolerations: []

1617

## Affinity for pod assignment (evaluated as template)

1618

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

1619

1620

affinity: {}

1621

## Use an alternate scheduler, e.g. "stork".

1622

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

1623

1624

# schedulerName: "default-scheduler"

1625

1626

# Extra configmaps to mount in image-renderer pods

1627

extraConfigmapMounts: []

1628

# Extra secrets to mount in image-renderer pods

1629

extraSecretMounts: []

1630

# Extra volumes to mount in image-renderer pods

1631

extraVolumeMounts: []

1632

# Extra volumes for image-renderer pods

1633

extraVolumes: []

1634

networkPolicy:

1635

# -- networkPolicy.enabled Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.

1636

enabled: false

1637

# --networkPolicy.allowExternal Don't require client label for connections

1638

# The Policy model to apply. When set to false, only pods with the correct

1639

# client label will have network access to grafana port defined.

1640

# When true, grafana will accept connections from any source

1641

# (with the correct destination port).

1642

1643

ingress: true

1644

# -- networkPolicy.ingress When true enables the creation

1645

# an ingress network policy

1646

allowExternal: true

1647

# -- networkPolicy.explicitNamespacesSelector A Kubernetes LabelSelector to explicitly select namespaces from which traffic could be allowed

1648

# If explicitNamespacesSelector is missing or set to {}, only client Pods that are in the networkPolicy's namespace

1649

# and that match other criteria, the ones that have the good label, can reach the grafana.

1650

# But sometimes, we want the grafana to be accessible to clients from other namespaces, in this case, we can use this

1651

# LabelSelector to select these namespaces, note that the networkPolicy's namespace should also be explicitly added.

1652

# </br>

1653

1654

# Example:

1655

1656

# ```

1657

# explicitNamespacesSelector:

1658

# matchLabels:

1659

# role: frontend

1660

# matchExpressions:

1661

# - {key: role, operator: In, values: [frontend]}

1662

# ```

1663

explicitNamespacesSelector: {}

1664

# -- networkPolicy.explicitIpBlocks List of CIDR blocks allowed as ingress sources.

1665

# Each entry must be a valid CIDR notation string (e.g. 10.0.0.0/8).

1666

# When defined, the specified CIDR ranges are added to the ingress `from` rules

1667

# using `ipBlock` entries and complement the other configured ingress sources.

1668

# </br>

1669

1670

# Example:

1671

1672

# ```

1673

# explicitIpBlocks:

1674

# - 35.191.0.0/16

1675

# - 130.211.0.0/22

1676

# ```

1677

1678

explicitIpBlocks: []

1679

egress:

1680

# -- networkPolicy.egress.enabled When enabled, an egress network policy will be

1681

# created allowing grafana to connect to external data sources from kubernetes cluster.

1682

enabled: false

1683

# -- networkPolicy.egress.blockDNSResolution When enabled, DNS resolution will be blocked

1684

# for all pods in the grafana namespace.

1685

blockDNSResolution: false

1686

# -- networkPolicy.egress.ports Add individual ports to be allowed by the egress

1687

ports: []

1688

# Add ports to the egress by specifying - port: <port number>

1689

# E.X.

1690

# - port: 80

1691

# - port: 443

1692

1693

# -- networkPolicy.egress.to Allow egress traffic to specific destinations

1694

to: []

1695

# -- destinations to the egress by specifying - ipBlock: <CIDR>

1696

# E.X.

1697

# to:

1698

# - namespaceSelector:

1699

# matchExpressions:

1700

# - {key: role, operator: In, values: [grafana]}

1701

# Enable backward compatibility of kubernetes where version below 1.13 doesn't have the enableServiceLinks option

1702

enableKubeBackwardCompatibility: false

1703

useStatefulSet: false

1704

# extraObjects could be utilized to add dynamic manifests via values

1705

extraObjects: []

1706

# Examples:

1707

# extraObjects:

1708

# - apiVersion: kubernetes-client.io/v1

1709

# kind: ExternalSecret

1710

# metadata:

1711

# name: grafana-secrets-{{ .Release.Name }}

1712

# spec:

1713

# backendType: gcpSecretsManager

1714

# data:

1715

# - key: grafana-admin-password

1716

# name: adminPassword

1717

# Alternatively, you can use strings, which lets you use additional templating features:

1718

# extraObjects:

1719

# - |

1720

# apiVersion: kubernetes-client.io/v1

1721

# kind: ExternalSecret

1722

# metadata:

1723

# name: grafana-secrets-{{ .Release.Name }}

1724

# spec:

1725

# backendType: gcpSecretsManager

1726

# data:

1727

# - key: grafana-admin-password

1728

# name: {{ include "some-other-template" }}

1729

1730

# assertNoLeakedSecrets is a helper function defined in _helpers.tpl that checks if secret

1731

# values are not exposed in the rendered grafana.ini configmap. It is enabled by default.

1732

1733

# To pass values into grafana.ini without exposing them in a configmap, use variable expansion:

1734

# https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion

1735

1736

# Alternatively, if you wish to allow secret values to be exposed in the rendered grafana.ini configmap,

1737

# you can disable this check by setting assertNoLeakedSecrets to false.

1738

assertNoLeakedSecrets: true

1739

# updateMode options are:

1740

# Off: n the Off update mode, the VPA recommender still analyzes resource usage and generates recommendations, but these recommendations are not automatically applied to Pods. The recommendations are only stored in the VPA object's .status field.

1741

# Initial: In Initial mode, VPA only sets resource requests when Pods are first created. It does not update resources for already running Pods, even if recommendations change over time. The recommendations apply only during Pod creation.

1742

# Recreate: In Recreate mode, VPA actively manages Pod resources by evicting Pods when their current resource requests differ significantly from recommendations. When a Pod is evicted, the workload controller (managing a Deployment, StatefulSet, etc) creates a replacement Pod, and the VPA admission controller applies the updated resource requests to the new Pod.

1743

# InPlaceOrRecreate: In Recreate mode, VPA actively manages Pod resources by evicting Pods when their current resource requests differ significantly from recommendations. When a Pod is evicted, the workload controller (managing a Deployment, StatefulSet, etc) creates a replacement Pod, and the VPA admission controller applies the updated resource requests to the new Pod.

1744

# Auto (deprecated): The Auto update mode is deprecated since VPA version 1.4.0. Use Recreate for eviction-based updates, or InPlaceOrRecreate for in-place updates with eviction fallback.

1745

verticalPodAutoscaler:

1746

enabled: false

1747

updateMode: "Off"

1748

controlledResources:

1749

cpu: true

1750

memory: true

1751

# Default safety bounds

1752

minAllowed:

1753

cpu: "25m"

1754

memory: "128Mi"

1755

maxAllowed:

1756

cpu: "1000m"

1757

memory: "1Gi"

1758

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

community-grafana

The trusted source for open source

Product

Solutions

Customers

Resources

Company