kates

# -- Global configuration

global:

# -- Override the image registry for all images in the chart

# Useful for air-gapped clusters that mirror images to an internal registry

imageRegistry: ""

# -- Override image pull secrets globally

imagePullSecrets: []

# -- Kubernetes cluster DNS domain

clusterDomain: "cluster.local"

# -- Enable production guard rails: template rendering fails if insecure

# chart defaults (e.g. the default database password) would reach the

# cluster. Enabled in values-prod.yaml; leave false for dev/kind.

productionMode: false

# -- Number of KATES replicas

replicaCount: 1

# -- Container image configuration

image:

# -- Image repository

repository: chainreg.biz/chainguard-private/kates-fips

# -- Image tag. Must be the release that carries the non-blocking health

# endpoints the probe defaults below depend on (>= 1.22.0).

tag: 1.24.0-r1@sha256:c690097b5bc51234a5e3184847038e6bb18ca283d47815a1da1af5022bf93446

# -- Image pull policy

pullPolicy: IfNotPresent

# -- Secrets for pulling images from private registries

imagePullSecrets: []

# -- Override the chart name

nameOverride: ""

# -- Override the full release name

fullnameOverride: ""

# -- DNS policy for pods (ClusterFirst, Default, None, ClusterFirstWithHostNet)

dnsPolicy: ""

# -- Custom DNS configuration (nameservers, searches, options)

dnsConfig: {}

# -- Service account configuration

serviceAccount:

# -- Create a ServiceAccount

create: true

# -- ServiceAccount name (auto-generated if empty)

name: ""

# -- Extra annotations for the ServiceAccount

annotations: {}

# -- Automount the service account token

automount: true

# -- RBAC configuration

rbac:

# -- Create ClusterRole and ClusterRoleBinding

create: true

# -- Grant the writes the direct Kubernetes chaos backend makes itself

# (KATES_CHAOS_PROVIDER=kubernetes, or hybrid without Litmus): NetworkPolicies,

# StatefulSet scaling, and pod ephemeral containers. Litmus runs its

# experiments as litmus-admin and needs none of this.

directChaos: false

# -- Extra RBAC rules (e.g. for Litmus Chaos integration)

extraRules: []

# -- Extra annotations to add to pods

podAnnotations: {}

# -- Extra labels to add to pods

podLabels: {}

# -- Kubernetes Service configuration

service:

# -- Service type

type: ClusterIP

# -- HTTP service port

port: 8080

# -- NodePort value (only when type=NodePort)

nodePort: ""

# -- Application protocol hint for service mesh

appProtocol: http

# -- Extra annotations for the Service

annotations: {}

# -- gRPC port configuration

grpc:

# -- gRPC container/service port

port: 9000

# -- gRPC NodePort value (only when type=NodePort)

nodePort: ""

# -- Ingress configuration

ingress:

# -- Enable Ingress

enabled: false

# -- Ingress class name (e.g. nginx)

className: ""

# -- Extra Ingress annotations

annotations: {}

# -- cert-manager integration

certManager:

# -- Enable cert-manager annotations

enabled: false

# -- Issuer or ClusterIssuer name

issuerName: ""

# -- Issuer kind (ClusterIssuer or Issuer)

issuerKind: ClusterIssuer

# -- Ingress hosts

hosts:

- host: kates.local

paths:

- path: /

pathType: Prefix

# -- TLS configuration

tls: []

# -- gRPC Ingress (separate Ingress resource for gRPC traffic)

grpc:

# -- Enable gRPC Ingress

enabled: false

# -- gRPC Ingress hostname

host: grpc.kates.local

# -- Extra gRPC Ingress annotations

annotations: {}

# -- gRPC TLS configuration

tls: []

# -- Resource requests and limits for the KATES container

resources:

requests:

memory: "2Gi"

cpu: "500m"

limits:

memory: "4Gi"

cpu: "2"

# -- Flyway schema migration behaviour

flyway:

# -- Repair the schema history on startup before migrating.

#

# DEVELOPMENT ONLY. It fixes "Migration checksum mismatch", which happens when

# an unreleased migration is edited after a local database already applied it.

# On a real database that mismatch means the file and the schema genuinely

# disagree, and silently rewriting the history hides it — so this stays off by

# default and is enabled in the local overlays.

repairAtStart: false

# -- Container args, replacing the image's CMD. Empty means "use the image's

# own default". The native image sets its heap percentage through CMD, since a

# native binary ignores JAVA_TOOL_OPTIONS; override it here rather than

# rebuilding the image.

containerArgs: []

# -- JVM configuration

#

# JVM IMAGE ONLY. A GraalVM native image does not read JAVA_TOOL_OPTIONS, so

# everything here is silently ignored when running a `-native` tag — see

# values-native.yaml, which empties it for that reason.

jvm:

# -- JVM options passed via JAVA_TOOL_OPTIONS (ignored by the native image)

options: "-Xms512m -Xmx2560m -XX:+UseZGC -XX:+ZGenerational"

# -- Pod-level security context (PSS restricted compliant)

# NOTE: runAsUser and fsGroup are intentionally unset so that platforms

# like OpenShift can assign random UIDs via their Security Context Constraints.

# Set them explicitly in your environment values file if needed.

securityContext:

runAsNonRoot: true

runAsUser: 100

fsGroup: 100

seccompProfile:

type: RuntimeDefault

# -- Container-level security context (PSS restricted compliant)

containerSecurityContext:

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

runAsNonRoot: true

capabilities:

drop:

- ALL

# -- Grace period for pod termination (seconds)

terminationGracePeriodSeconds: 60

# -- Deployment update strategy

strategy:

type: RollingUpdate

rollingUpdate:

maxSurge: 1

maxUnavailable: 0

# -- Horizontal Pod Autoscaler configuration

autoscaling:

# -- Enable HPA

enabled: false

# -- Minimum replicas

minReplicas: 1

# -- Maximum replicas

maxReplicas: 5

# -- Target CPU utilization percentage

targetCPUUtilizationPercentage: 80

# -- Target memory utilization percentage (empty to disable)

targetMemoryUtilizationPercentage: ""

# -- Custom metrics for HPA

customMetrics: []

# -- Scale behavior policies

behavior:

scaleDown:

stabilizationWindowSeconds: 300

policies:

- type: Pods

value: 1

periodSeconds: 60

scaleUp:

stabilizationWindowSeconds: 30

policies:

- type: Pods

value: 2

periodSeconds: 60

# -- Pod Disruption Budget configuration

podDisruptionBudget:

# -- Enable PDB

enabled: false

# -- Minimum available pods (overrides maxUnavailable)

minAvailable: ""

# -- Maximum unavailable pods

maxUnavailable: 1

# -- Unhealthy pod eviction policy

unhealthyPodEvictionPolicy: IfHealthy

# -- Priority class name for pod scheduling

priorityClassName: ""

# -- Topology spread constraints for pod scheduling

topologySpreadConstraints: []

# -- Node selector for pod scheduling

nodeSelector: {}

# -- Tolerations for pod scheduling

tolerations: []

# -- Affinity rules (includes default pod anti-affinity for HA)

affinity:

podAntiAffinity:

preferredDuringSchedulingIgnoredDuringExecution:

- weight: 100

podAffinityTerm:

labelSelector:

matchExpressions:

- key: app.kubernetes.io/name

operator: In

values:

- kates

topologyKey: kubernetes.io/hostname

# -- Extra environment variables for the KATES container

extraEnv: []

# -- Extra init containers (e.g. for Vault secret fetching, schema migration)

extraInitContainers: []

# -- Extra volumes

extraVolumes: []

# -- Extra volume mounts

extraVolumeMounts: []

# -- API key authentication

apiKey:

# -- Enable API key authentication

enabled: true

# -- API key value (auto-generated 32-char key if empty)

value: ""

# -- Use an existing Secret instead of creating one

existingSecret: ""

# -- Key in the existing Secret

secretKey: "api-key"

# -- Health probe configuration

#

# Every probe points at a MicroProfile health endpoint, never at a business

# endpoint. `/api/health` looks like the obvious readiness URL but calls

# ClusterHealthService.isReachable() — an uncached AdminClient round-trip with a

# 5s blocking get — on every request. Since a probe's timeoutSeconds defaults to

# 1s, a cluster whose Kafka is still coming up fails EVERY readiness probe and

# the pod never goes Ready, even though the app is fine. `/q/health/ready` reads

# the periodically-refreshed KafkaReachabilityCache instead and never blocks on a

# broker.

probes:

# -- Startup probe (gates readiness/liveness probes)

startup:

path: /q/health/started

# 60 x 2s = 120s of JVM boot budget. 30 (60s) is not enough on a

# CPU-constrained node: the kubelet kills the container mid-boot and the

# restart loop reads as "kates takes forever to start".

failureThreshold: 60

periodSeconds: 2

timeoutSeconds: 3

# -- Readiness probe

readiness:

path: /q/health/ready

initialDelaySeconds: 5

periodSeconds: 10

timeoutSeconds: 5

failureThreshold: 3

# -- Liveness probe

liveness:

path: /q/health/live

initialDelaySeconds: 15

periodSeconds: 30

timeoutSeconds: 5

failureThreshold: 3

# -- Container lifecycle hooks

lifecycle:

# -- Seconds to sleep in preStop hook (allows LB drain)

preStopSleepSeconds: 5

# -- Init container configuration

initContainers:

# -- Busybox image for wait-for-postgres init container

waitForPostgres:

image: chainreg.biz/chainguard-private/netcat:1.238-r1@sha256:b961470bd7a9a1ece5f8bf51b2accd244cebc7a83767ab08da80821e403eb140

pullPolicy: IfNotPresent

# -- Kafka connection configuration

kafka:

# -- Kafka bootstrap servers

bootstrapServers: "krafter-kafka-bootstrap.kafka.svc:9092"

# -- Namespace where CDC integration test KafkaTopic CRs are managed (empty = auto-detect)

topicNamespace: ""

# -- Client rack ID for rack-aware consumption

clientRack: ""

# -- Security protocol

security:

protocol: SASL_PLAINTEXT

# -- SASL authentication

sasl:

# -- Enable SASL

enabled: true

# -- SASL mechanism

mechanism: SCRAM-SHA-512

# -- SASL username

username: kates-backend

# -- K8s Secret name containing the SASL password

secretName: kates-backend

# -- Key in the Secret containing the SASL password

secretKey: password

# -- OAuthBearer configuration (when mechanism=OAUTHBEARER)

oauthbearer:

tokenEndpointUrl: ""

clientId: ""

clientSecretName: ""

clientSecretKey: client-secret

# -- SSL/TLS configuration

ssl:

# -- Enable SSL

enabled: false

# -- Truststore configuration

truststore:

secretName: ""

key: truststore.jks

password: ""

# -- Keystore configuration

keystore:

secretName: ""

key: keystore.jks

password: ""

# -- Trogdor coordinator configuration

trogdor:

# -- Trogdor coordinator URL

coordinatorUrl: "http://trogdor-coordinator.kafka.svc:8889"

# -- Trogdor agents that run tasks (KATES_TROGDOR_AGENT_NODES): node names

# from the coordinator's platform config, comma-separated; a run's tasks take

# them in turn. node0 is the name in the trogdor.conf Kafka ships. A name the

# coordinator does not know fails the task with "Unknown node names".

agentNodes: "node0"

# -- Prometheus the backend queries for a disruption's Kafka metrics

prometheus:

# -- Prometheus base URL (KATES_PROMETHEUS_URL). The default is the Service

# kube-prometheus-stack creates for charts/monitoring installed as release

# `monitoring` in namespace `monitoring`, which is what `kates deploy` does

# (it sets this for the namespace it uses). `make monitoring` installs that

# release in namespace `kafka`: set

# http://monitoring-kube-prometheus-prometheus.kafka.svc:9090 there, and

# networkPolicy.prometheus.namespace to kafka. Unreachable, a disruption's

# Prometheus metrics are missing and its SLA verdict lists them unevaluated.

url: "http://monitoring-kube-prometheus-prometheus.monitoring.svc:9090"

# -- Benchmark engine configuration

engine:

# -- Default benchmark backend (native or trogdor)

defaultBackend: "native"

# -- Fault tolerance timeout configuration (ms)

faultTolerance:

topicService:

# -- Timeout for all TopicService operations

timeoutMs: "35000"

clusterHealthService:

# -- Default timeout for cluster health operations

defaultTimeoutMs: "35000"

# -- Timeout for reachability check

reachableTimeoutMs: "10000"

# -- Timeout for full health check

healthCheckTimeoutMs: "60000"

consumerGroupService:

# -- Timeout for consumer group operations

timeoutMs: "35000"

# -- NetworkPolicy configuration

networkPolicy:

# -- Enable NetworkPolicy

enabled: true

# -- Ingress rules

ingressRules:

- from:

- namespaceSelector: {}

ports:

- port: 8080

protocol: TCP

- from:

- namespaceSelector: {}

ports:

- port: 8080

protocol: TCP

# -- Kafka egress configuration

kafka:

namespace: kafka

port: 9092

# -- Prometheus egress configuration: the namespace prometheus.url points

# into. The policy used to allow `monitoring` whatever this said.

prometheus:

namespace: monitoring

port: 9090

# -- Extra egress rules

egressRules: []

# -- Observability and monitoring

metrics:

# -- Prometheus ServiceMonitor

serviceMonitor:

# -- Enable ServiceMonitor

enabled: false

# -- Target namespace for the ServiceMonitor

namespace: ""

# -- Scrape interval

interval: "30s"

# -- Scrape timeout

scrapeTimeout: ""

# -- Extra labels for ServiceMonitor

labels: {}

# -- Metric relabeling rules

metricRelabelings: []

# -- Relabeling rules

relabelings: []

# -- PrometheusRule for alerting

prometheusRule:

# -- Enable PrometheusRule

enabled: false

# -- Target namespace for the PrometheusRule

namespace: ""

# -- Extra labels

labels: {}

# -- Alert rules

rules:

- alert: KatesDown

expr: up{job="{{ include \"kates.fullname\" . }}"} == 0

for: 5m

labels:

severity: critical

annotations:

summary: "KATES instance is down"

description: "KATES pod {{ $labels.pod }} has been down for more than 5 minutes."

- alert: KatesHighErrorRate

expr: rate(http_server_requests_seconds_count{job="{{ include \"kates.fullname\" . }}", status=~"5.."}[5m]) > 0.1

for: 5m

labels:

severity: warning

annotations:

summary: "KATES high error rate"

description: "KATES is returning more than 10% 5xx responses."

# -- GONE in 0.9.0: the "KATES — Overview" board (dashboards/kates-overview/)

# is delivered by charts/monitoring with every other board in dashboards/

# (its `dashboards.enabled`), scoped to a release by its `$job` template

# variable. A release that still sets any `metrics.grafanaDashboard.*` key

# is REFUSED with the new location named (this chart has no values schema,

# so without the refusal the key would be accepted and silently ignored).

# -- Bundled PostgreSQL configuration.

# A self-contained single-instance StatefulSet on the official `postgres`

# image (no Bitnami). For production HA, set enabled=false and point

# externalDatabase at a managed cluster (CloudNativePG recommended).

postgresql:

# -- Deploy bundled PostgreSQL

enabled: true

# -- PostgreSQL image (official library image; Alpine variants also work)

image:

repository: chainreg.biz/chainguard-private/postgres-fips

tag: 16.15-r5@sha256:720d154c20c41279f2872ee0e158fc60d9a11fecd6d4ac793f3e1e49b0022f08

# -- Database authentication

auth:

# -- Database name

database: kates

# -- Database username

username: kates

# -- Database password (ignored if existingSecret is set)

password: kates

# -- Use an existing Secret for DB credentials

existingSecret: ""

# -- Key in the existing Secret

passwordKey: "password"

# -- Node selector for the embedded PostgreSQL pod (dev/test only)

nodeSelector: {}

# -- Tolerations for the embedded PostgreSQL pod

tolerations: []

# -- Affinity rules for the embedded PostgreSQL pod

affinity: {}

# -- PVC storage configuration

storage:

# -- Storage size

size: 1Gi

# -- Storage class (empty for default)

storageClass: ""

# -- PostgreSQL resource requests and limits

resources:

requests:

memory: "128Mi"

cpu: "100m"

limits:

memory: "256Mi"

cpu: "250m"

# -- PostgreSQL pod security context

securityContext:

runAsNonRoot: true

runAsUser: 999

fsGroup: 999

# -- PostgreSQL container security context

containerSecurityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

# -- JDBC connection pool settings

connectionPool:

# -- Maximum pool size

maxSize: "20"

# -- Minimum pool size

minSize: "5"

# -- External database configuration (when postgresql.enabled=false).

# Recommended for production HA: run a CloudNativePG `Cluster` (official

# postgres images, streaming replication, backups) and point host/port at its

# `-rw` service, e.g. host: kates-db-rw.database.svc — no Bitnami involved.

externalDatabase:

# -- Enable external database

enabled: false

# -- Database host

host: ""

# -- Database port

port: 5432

# -- Database name

database: kates

# -- Database username

username: kates

# -- Database password (ignored if existingSecret is set)

password: ""

# -- Use an existing Secret for DB credentials

existingSecret: ""

# -- Key in the existing Secret

passwordKey: "password"

# -- Default benchmark parameters (fallback for all test types)

defaults:

replicationFactor: "3"

partitions: "3"

minInsyncReplicas: "2"

acks: "all"

batchSize: "65536"

lingerMs: "5"

compressionType: "lz4"

recordSize: "1024"

numRecords: "1000000"

throughput: "-1"

durationMs: "600000"

numProducers: "1"

numConsumers: "1"

# -- Per-test-type parameter overrides

tests:

# -- LOAD: baseline throughput test

load:

partitions: "3"

batchSize: "65536"

lingerMs: "5"

numRecords: "1000000"

durationMs: "600000"

numProducers: "1"

# -- STRESS: high-concurrency, large batches

stress:

partitions: "6"

batchSize: "131072"

lingerMs: "10"

numRecords: "5000000"

durationMs: "900000"

numProducers: "3"

# -- SPIKE: burst traffic, low-latency

spike:

acks: "1"

batchSize: "131072"

lingerMs: "0"

compressionType: "none"

numRecords: "2000000"

durationMs: "300000"

# -- ENDURANCE: long-running, rate-limited

endurance:

numRecords: "10000000"

throughput: "5000"

durationMs: "3600000"

# -- VOLUME: large records, high batch size

volume:

partitions: "6"

batchSize: "262144"

lingerMs: "50"

recordSize: "10240"

numRecords: "2000000"

# -- CAPACITY: max parallelism

capacity:

partitions: "12"

batchSize: "131072"

lingerMs: "10"

numRecords: "10000000"

durationMs: "1200000"

numProducers: "5"

# -- ROUNDTRIP: latency-focused

roundtrip:

batchSize: "16384"

lingerMs: "0"

compressionType: "none"

numRecords: "500000"

throughput: "10000"

# -- PostgreSQL backup CronJob

backup:

# -- Enable backup CronJob

enabled: false

# -- Cron schedule expression

schedule: "0 2 * * *"

# -- PostgreSQL image for pg_dump

image: chainreg.biz/chainguard-private/postgres-fips:16.15-r5@sha256:720d154c20c41279f2872ee0e158fc60d9a11fecd6d4ac793f3e1e49b0022f08

# -- Days to retain backups

retention: 7

# -- Backup persistence

persistence:

enabled: false

existingClaim: ""

storageClass: ""

size: 5Gi

# -- Backup job resources

resources:

requests:

memory: "64Mi"

cpu: "50m"

limits:

memory: "256Mi"

cpu: "250m"

# -- Pre-upgrade Flyway migration Job

migration:

# -- Enable migration Job (runs as pre-upgrade Helm hook)

enabled: false

# -- Override image (defaults to KATES app image)

image: chainreg.biz/chainguard-private/kates-fips:1.24.0-r1@sha256:c690097b5bc51234a5e3184847038e6bb18ca283d47815a1da1af5022bf93446

# -- Custom command (overrides default Flyway migration)

command: []

# -- Maximum retry attempts

backoffLimit: 3

# -- Maximum Job duration (seconds)

activeDeadlineSeconds: 600

# -- Migration job resources

resources:

requests:

memory: "256Mi"

cpu: "100m"

limits:

memory: "512Mi"

cpu: "500m"

# -- Stale test run cleanup CronJob

cleanup:

# -- Enable cleanup CronJob

enabled: false

# -- Cron schedule expression

schedule: "0 4 * * 0"

# -- Delete completed test runs older than N days

retentionDays: 30

# -- Curl image for API calls

image: chainreg.biz/chainguard-private/min-toolkit-debug-fips:latest@sha256:76f732b60df11113cc47422ea95d65543229da16b6e23f5f8d551f8bb0c3ccce

# -- Kyverno pod security policies (requires Kyverno controller in cluster)

kyvernoPolicy:

# -- Enable Kyverno ClusterPolicy for the kates namespace

enabled: false

# -- Policy action: Audit (observe only) or Enforce (block non-compliant)

action: Audit

# -- Enable mutation rules to auto-inject security contexts

mutate: true

# -- Enable image registry restriction

restrictRegistries: false

# -- Allowed image registries (when restrictRegistries is true)

allowedRegistries:

- ghcr.io/bmscomp/

- docker.io/bitnami/

- registry.k8s.io/

- quay.io/strimzi/

- curlimages/

# -- GONE in 0.9.0: the Kyverno board (dashboards/kyverno-security/) is

# delivered by charts/monitoring with every other board in dashboards/ (its

# `dashboards.enabled`) — one Kyverno per cluster, one board, and it belongs

# where the rest of the cluster's boards live. `grafanaDashboard` (both the

# bool and the map shape) and `grafanaDashboardNamespace` are REFUSED if

# set, with the new location named.

# -- Cosign image signature verification

cosign:

# -- Enable image signature verification via Cosign

enabled: false

# -- Image patterns requiring valid signatures

imagePatterns:

- "ghcr.io/bmscomp/*"

# -- Cosign public key (PEM format) — set via --set-file or Secrets

publicKey: ""

# -- Auto-generate default-deny NetworkPolicies for new namespaces

networkPolicyGeneration:

enabled: false

# -- Namespaces to exclude from default-deny generation

excludeNamespaces:

- kube-system

- kube-public

- kube-node-lease

- kyverno

- strimzi-operator

- monitoring

- kafka

- cert-manager

- litmus

- "kates-detect-*"

# -- PolicyExceptions for dev/test namespaces

policyExceptions:

# -- Enable PolicyException resources

enabled: false

# -- Dev namespaces where policies are relaxed

namespaces:

- kates-dev

- kates-staging

# -- Policies to create exceptions for

exemptPolicies:

- kates-pod-security-standards

# -- Rules to exempt in dev namespaces

exemptRules:

- validate-readonly-rootfs

- require-resource-limits

- disallow-latest-tag

# -- Monitoring integration

monitoring:

# -- Enable telemetry export (Jaeger)

enabled: true