kiali-operator

nameOverride: ""

fullnameOverride: ""

image: # see: https://quay.io/repository/kiali/kiali-operator?tab=tags

repo: chainreg.biz/chainguard-private/kiali-operator-fips

tag: 2.32.0-r0@sha256:1a3f58786f05fdcf496209a26e17c267a4e2b3c33d482f054880b30b01f5cb3f

digest: "" # use "sha256" if tag is a sha256 hash (do NOT prefix this value with a "@")

pullPolicy: Always

pullSecrets: []

# Deployment options for the operator pod.

extraLabels: {}

nodeSelector: {}

podAnnotations: {}

podLabels: {}

env: []

tolerations: []

resources:

requests:

cpu: "10m"

memory: "64Mi"

affinity: {}

replicaCount: 1

priorityClassName: ""

securityContext: {}

# Configures the liveness, readiness, and startup probes of the operator pod.

# The defaults are conservative so the operator comes up reliably on slow clusters.

# Note that the startup probe keeps the operator unready for at least

# probes.startup.initialDelaySeconds regardless of how fast it actually starts,

# so lower that value if you need the operator to report ready sooner.

probes:

liveness:

periodSeconds: 30

readiness:

periodSeconds: 30

startup:

failureThreshold: 6

initialDelaySeconds: 30

periodSeconds: 10

# This helm chart will create Kubernetes resources such as cluster roles, cluster role bindings, and service accounts.

# For very rare use-cases, users may want to manage some of these resources manually, outside

# of this helm chart. In cases like this, you can inform this helm chart to skip the creation of

# those resources that you want to manage yourself.

# For example, if you want to manage cluster roles and cluster role bindings yourself, but you still want this helm

# chart to create service accounts, set the value of "skipResources" to an array

# value of ["clusterrole", "clusterrolebinding"].

# If you use this feature, you must be aware that you then bear the responsibility of

# creating these resources yourself manually; if you do not then the installation

# will be broken. Therefore, only use this feature if you know what you are doing.

# Valid list item values are: "clusterrole", "clusterrolebinding", "sa"

skipResources: []

# metrics.enabled: set to true if you want Prometheus to collect metrics from the operator

metrics:

enabled: true

# debug.enabled: when true the full ansible logs are dumped after each reconciliation run

# debug.verbosity: defines the amount of details the operator will log (higher numbers are more noisy)

# debug.enableProfiler: when true (regardless of debug.enabled), timings for the most expensive tasks will be logged after each reconciliation loop

debug:

enabled: true

verbosity: "1"

enableProfiler: false

# Defines where the operator will look for Kial CR resources. "" means "all namespaces".

watchNamespace: ""

# Set to true if you want the operator to be able to create cluster roles. This is necessary

# if you want to support Kiali CRs with spec.deployment.cluster_wide_access=true.

# Setting this to "true" requires allowAllAccessibleNamespaces to be "true" also.

# Note that this will be overriden to "true" if cr.create is true and cr.spec.deployment.cluster_wide_access=true.

# This must be true to support impersonation on OpenShift.

clusterRoleCreator: true

# Set to true if you want the operator to be able to grant impersonation permissions to the

# Kiali service account. This is only relevant on OpenShift clusters where the openshift auth

# strategy is used with spec.auth.openshift.impersonation.enabled=true in the Kiali CR.

# When true, the operator's own ClusterRole includes the "impersonate" verb on users and groups,

# which is required by Kubernetes RBAC escalation rules (the operator cannot grant permissions

# it does not itself hold). When false, impersonation permissions are omitted from the operator's

# role entirely. Requires clusterRoleCreator to be true for this value to take effect.

supportImpersonation: false

# Set to true if you want to allow the operator to only be able to install Kiali in view-only-mode.

# The purpose for this setting is to allow you to restrict the permissions given to the operator itself.

onlyViewOnlyMode: false

# allowAdHocKialiNamespace tells the operator to allow a user to be able to install a Kiali CR in one namespace but

# be able to install Kiali in another namespace. In other words, it will allow the Kiali CR spec.deployment.namespace

# to be something other than the namespace where the CR is installed. You may want to disable this if you are

# running in a multi-tenant scenario in which you only want a user to be able to install Kiali in the same namespace

# where the user has permissions to install a Kiali CR.

allowAdHocKialiNamespace: true

# allowAdHocKialiImage tells the operator to allow a user to be able to install a custom Kiali image as opposed

# to the image the operator will install by default. In other words, it will allow the

# Kiali CR spec.deployment.image_name and spec.deployment.image_version to be configured by the user.

# You may want to disable this if you do not want users to install their own Kiali images.

allowAdHocKialiImage: false

# allowAdHocOSSMConsoleImage tells the operator to allow a user to be able to install a custom OSSMC image as opposed

# to the image the operator will install by default. In other words, it will allow the

# OSSMConsole CR spec.deployment.imageName and spec.deployment.imageVersion to be configured by the user.

# You may want to disable this if you do not want users to install their own OSSMC images.

# This is only applicable when running on OpenShift.

allowAdHocOSSMConsoleImage: false

# allowAdHocContainers tells the operator to allow a user to be able to install additional pod containers and initContainers to the Kiali pod.

# In other words, it will allow the Kiali CR spec.deployment.additional_pod_containers_yaml and

# spec.deployment.additional_pod_init_containers_yaml to be configured by the user.

# The operator will apply a restrictive security context to user-defined containers and will prevent

# write access to secret-backed volumes. These restrictions cannot be overridden.

allowAdHocContainers: false

# allowSecurityContextOverride tells the operator to allow a user to be able to fully override the Kiali

# container securityContext. If this is false, certain securityContext settings must exist on the Kiali

# container and any attempt to override them will be ignored.

allowSecurityContextOverride: false

# allowAllAccessibleNamespaces tells the operator to allow a user to be able to configure Kiali

# to access all namespaces in the cluster via spec.deployment.cluster_wide_access=true.

# If this is false, the user must specify an explicit set of namespaces in the Kiali CR via spec.deployment.discovery_selectors.

# Setting this to "true" requires clusterRoleCreator to be "true" also.

# Note that this will be overriden to "true" if cr.create is true and cr.spec.deployment.cluster_wide_access=true.

allowAllAccessibleNamespaces: true

# watchesFile: If specified, this determines what watches file will be used to configure the operator. There are four different

# files that can be selected: (a) `watches-os.yaml`, (b) `watches-os-ns.yaml`, (c) `watches-k8s.yaml` or (d) `watches-k8s-ns.yaml`.

# The first two are for OpenShift only, the last two are for non-OpenShift Kubernetes clusters. The two with "-ns" in their name

# enable the operator to automatically update the Kiali Server with access to new namespaces as those namespaces are created in

# the cluster. This namespace watching feature provides some advanced capabilities but is never required. It is also not

# the default behavior and is not necessary if your Kiali CRs will have `spec.deployment.cluster_wide_access` set to `true`.

watchesFile: ""

# For what a Kiali CR spec can look like, see: https://kiali.io/docs/configuration/kialis.kiali.io/

cr:

create: false

name: kiali

# If you elect to create a Kiali CR (--set cr.create=true)

# and the operator is watching all namespaces (--set watchNamespace="")

# then this is the namespace where the CR will be created (the default will be the operator namespace).

namespace: ""

# Annotations to place in the Kiali CR metadata.

annotations: {}

spec:

deployment:

cluster_wide_access: true