pgwatch

# ==============================================================================

# Global Settings

# ==============================================================================

# -- Global Security Context

# When enabled: false (default), only component-specific securityContext blocks are rendered as-is, if they exist.

# When enabled: true, global values are the baseline and component-specific values are merged on top (component wins).

securityContext:

# -- Master switch. Set to true to apply global defaults to all components.

enabled: false

# -- Pod-level security context. https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSecurityContext

pod:

runAsNonRoot: true

runAsUser: 1000

runAsGroup: 1000

fsGroup: 1000

fsGroupChangePolicy: "OnRootMismatch"

seccompProfile:

type: RuntimeDefault

# -- Container-level security context. https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#SecurityContext

container:

allowPrivilegeEscalation: false

readOnlyRootFilesystem: false

capabilities:

drop:

- ALL

# -- Extra arbitrary Kubernetes resources to deploy alongside the chart.

# Follows the Bitnami extraDeploy pattern: each item is rendered via `tpl`,

# so you can use Helm template expressions inside the objects.

# Ideal for ServiceMonitors, CRDs, additional ConfigMaps, or any resource

# not covered by the standard chart templates.

# No validation is performed; users are responsible for correctness.

#

extraDeploy: []

# ==============================================================================

# pgwatch

# ==============================================================================

pgwatch:

# == Core Settings ==

image:

repository: chainreg.biz/scratch-images/test-tmp/pgwatch

tag: 5.3.0-r6@sha256:866453ed13193d7e70784df9d0053e4501adb7687b11bc5927f063783a19785a

# -- Resource requests and limits for the pgwatch deployment.

resources: {}

# -- Web UI listen port. Must match PW_WEBADDR (default :8080). Used for containerPort and Service.

webPort: 8080

# -- Monitored sources: databases pgwatch should monitor (PW_SOURCES).

# If unset, pgwatch auto-generates a PostgreSQL URI from the metrics database settings (default).

# Set 'files' to use file-based source configuration instead.

# Source files are mounted under /tmp/pgwatch-sources and pgwatch reads the directory.

# This supports multiple source files; pgwatch v5 images including the fix for

# https://github.com/cybertec-postgresql/pgwatch/issues/1368 skip Kubernetes

# ConfigMap atomic-writer internals while walking the directory.

# See configs/sample-sources.yaml for the file format.

# Ref: https://pgwat.ch/v5.x/reference/cli_env.html#sources

sources:

# -- Multiple YAML source files to create inside the pod.

# Keys become filenames in /tmp/pgwatch-sources and values are raw YAML contents.

# For a single source file, provide one entry in this map.

# Escape dots in filenames when using --set-file, for example:

# --set-file pgwatch.sources.files.custom-sources\.yaml=./custom-sources.yaml

# --set-file pgwatch.sources.files.custom-sources2\.yml=./custom-sources2.yml

files: {}

# TODO: Implement existingConfigMap - mount an existing user-managed ConfigMap

# directly instead of creating one from 'files'.

# -- Ingress resource for the pgwatch web UI.

ingress:

enabled: false

# -- Ingress class (e.g. "nginx", "traefik"). Omitted if empty.

className: ""

# -- Annotations passed to the Ingress metadata (e.g. cert-manager.io/cluster-issuer).

annotations: {}

# -- Host rules with paths.

# Example:

# hosts:

# - host: pgwatch.example.com

# paths:

# - path: /

# pathType: Prefix

hosts: []

# -- TLS secret references. Secrets must already exist in the namespace

# (create them manually or via cert-manager triggered by the annotation above).

# Example:

# tls:

# - secretName: pgwatch-tls

# hosts:

# - pgwatch.example.com

tls: []

# -- Sub-path for reverse-proxy setups (e.g. "/pgwatch").

# Injected as PW_WEBBASEPATH -> passed to pgwatch as --web-base-path.

webBasePath: ""

# -- Component-specific overrides for the pgwatch Deployment.

securityContext:

pod: {}

container: {}

# -- Additional environment variables for the pgwatch container.

# Merged with chart defaults; user-supplied values take precedence.

# Example:

# env:

# PW_LOGLEVEL: "debug"

# PW_WEBBASEPATH: "/pgwatch"

# METRIC_DATABASE_PORT: "5433"

env: {}

# -- Inject env vars from existing ConfigMaps or Secrets.

# Example:

# envFrom:

# - configMapRef:

# name: my-pgwatch-config

# - secretRef:

# name: my-pgwatch-secret

envFrom: []

# == Metrics sink: PostgreSQL ==

postgres:

enablePgSink: true

settings:

retentionDays: 31

# -- Set to true to deploy a new PostgreSQL StatefulSet (default).

createMetricDatabase: true

# -- New PostgreSQL instance — active when createMetricDatabase: true.

newPgDatabase:

image: chainreg.biz/scratch-images/test-tmp/postgres:18.6-r2@sha256:d29ce53b6f9796ef6fdf48e251ca9dececbd4570c0f71798082e09cd023dd17c

# -- Resource requests and limits for the Metrics Database StatefulSet.

resources: {}

volume:

size: '10Gi'

storageClass: 'standard'

# -- Resource requests and limits for the Metrics Database init job.

dbInitJob:

resources: {}

# requests:

# cpu: "25m"

# memory: "64Mi"

# limits:

# cpu: "200m"

# memory: "128Mi"

# -- Resource requests and limits for the Metrics Database initContainers.

initContainers:

resources: {}

# requests:

# cpu: "10m"

# memory: "16Mi"

# limits:

# cpu: "100m"

# memory: "64Mi"

# -- External database connection (active when createMetricDatabase: false).

# Set credentials via credentials.* below; username/password here are deprecated.

# useExistingDatabase:

# endpoint: postgresql.local

# port: '5432'

# database: PGWATCH_DATABASE

# grafanaDatabase: pgwatch_grafana # optional, default: pgwatch_grafana

# sslmode: require

# # username: # DEPRECATED, use credentials.username

# # password: # DEPRECATED, use credentials.password

# -- Credentials for pgwatch and Grafana to connect to the metrics database.

#

# Precedence:

# 1. credentials.existingSecret — chart creates no Secret; keys read via usernameKey/passwordKey

# 2. credentials.username / password — chart creates pgwatch-postgresql-secret-pgwatch

# 3. DEPRECATED: useExistingDatabase.username / password — still works, emits warning

credentials:

# -- Name of an existing Secret that contains the pgwatch username/password.

# When set, the chart will not create pgwatch-postgresql-secret-pgwatch.

existingSecret: ""

username: "pgwatch"

password: ""

# -- Secret key containing the username when existingSecret is used.

usernameKey: "username"

# -- Secret key containing the password when existingSecret is used.

passwordKey: "password"

# -- Admin password for the built-in PostgreSQL StatefulSet.

# Only applies when createMetricDatabase: true and timescaledb.enabled: false.

# Has no effect for external databases or TimescaleDB subchart.

adminCredentials:

# -- Password for the postgres superuser stored in the admin Secret.

password: ""

# -- Name of an existing Secret that contains the postgres admin password.

# When set, the chart will not create pgwatch-postgresql-secret-postgres.

existingSecret: ""

# -- Secret key containing the postgres admin password.

passwordKey: "password"

# -- Component-specific overrides for the PostgreSQL StatefulSet.

securityContext:

pod: {}

container: {}

# -- Additional environment variables for the postgres container.

# Merged with chart defaults; user-supplied values take precedence.

# Example:

# env:

# POSTGRES_MAX_CONNECTIONS: "200"

env: {}

# -- Inject env vars from existing ConfigMaps or Secrets.

# Example:

# envFrom:

# - secretRef:

# name: my-postgres-secret

envFrom: []

# == Metrics sink: Prometheus ==

prometheus:

enablePromSink: true

# -- New Prometheus instance — active when createPrometheus: true.

newPrometheus:

createPrometheus: true

image: chainreg.biz/scratch-images/test-tmp/prometheus:3.14.0-r3@sha256:28cf39fd5fe744abf9c7ab0d683fbefa10e73bc203c36aef446607ce59a112ef

# -- Resource requests and limits for the Prometheus deployment.

resources: {}

settings:

retentionDays: 31

volume:

size: '10Gi'

storageClass: 'standard'

# -- Resource requests and limits for the Prometheus initContainers.

initContainers:

resources: {}

# -- Existing Prometheus instance — active when createPrometheus: false.

#

# TODO: Implement use_existing_prometheus

#

# use_existing_prometheus:

# endpoint: prometheus.local

# port: '9090'

# -- Component-specific overrides for the Prometheus Deployment.

# The official Prometheus image runs as UID/GID 65534 (nobody).

securityContext:

pod:

runAsUser: 65534

runAsGroup: 65534

fsGroup: 65534

container: {}

# -- Additional environment variables for the prometheus container.

# Example:

# env:

# GOMAXPROCS: "2"

env: {}

# -- Inject env vars from existing ConfigMaps or Secrets.

# Example:

# envFrom:

# - configMapRef:

# name: my-prometheus-config

envFrom: []

# == Visualization: Grafana ==

grafana:

# -- Set to true to use the official Grafana Helm subchart instead of the

# custom Grafana Deployment bundled in this chart.

# When true: grafana-deployment.yaml, grafana-dashboard-config.yaml and

# grafana-svc are skipped; the grafana: top-level section controls the subchart.

# When false (default): the custom Deployment runs exactly as before.

useSubchart: false

image: chainreg.biz/scratch-images/test-tmp/grafana:v13.2.1-r5@sha256:1d29c4cff64c29a364b83468b241cec291592cddb93f5ed50d7d16087edf7d1a

# -- Resource requests and limits for the Grafana deployment.

resources: {}

enableGrafana: true

# -- Controls which Grafana datasources are provisioned.

# Independent of the sink settings (enablePgSink / enablePromSink), which control

# what pgwatch writes to. These control what Grafana is configured to query.

enableDatasources:

postgres: true

prometheus: true

# -- Component-specific overrides for the Grafana Deployment.

# The official Grafana image runs as UID/GID 472.

securityContext:

pod:

runAsUser: 472

runAsGroup: 472

fsGroup: 472

container: {}

# -- Additional environment variables for the grafana container.

# Merged with chart defaults; user-supplied values take precedence.

# Example:

# env:

# GF_SERVER_ROOT_URL: "https://grafana.example.com"

# GF_LOG_LEVEL: "warn"

env: {}

# -- Inject env vars from existing ConfigMaps or Secrets.

# Example:

# envFrom:

# - secretRef:

# name: my-grafana-secret

envFrom: []

# ==============================================================================

# Subchart pass-throughs (opt-in)

# ==============================================================================

# TimescaleDB subchart — opt-in (Needs timescaledb.enabled: true).

# Replaces the built-in PostgreSQL StatefulSet; a post-install Job bootstraps the pgwatch user/databases.

# All keys under timescaledb: are passed through directly to the subchart.

# Ref: https://artifacthub.io/packages/helm/cloudpirates-timescaledb/timescaledb

timescaledb:

enabled: false

image:

# -- TimescaleDB image tag. Override to select a different PG/TS version.

# Available tags: https://hub.docker.com/r/timescale/timescaledb/tags

tag: "2.26.2-pg18"

auth:

# -- Password for the postgres admin user.

# If empty a random password is generated and stored in the release secret.

postgresPassword: ""

# -- Name of an existing Secret that already contains the postgres password.

# When set, postgresPassword is ignored.

existingSecret: ""

persistence:

enabled: true

# -- Storage size for the TimescaleDB data volume.

size: 10Gi

# -- StorageClass for the PVC. Uses the cluster default when empty.

storageClass: ""

# Grafana subchart — opt-in (pgwatch.grafana.useSubchart: true).

# Replaces the custom Grafana Deployment; datasources are auto-provisioned via the k8s-sidecar.

# All keys under grafana: are passed through directly to the subchart.

# Ref: https://github.com/grafana-community/helm-charts/tree/main/charts/grafana

grafana:

# -- Sidecar configuration for automatic dashboard and datasource discovery.

# The sidecar watches ConfigMaps labelled grafana_dashboard=1 / grafana_datasource=1

# in the same namespace and injects them at runtime — no pod restart needed.

sidecar:

dashboards:

enabled: true

# -- Label key used to identify dashboard ConfigMaps.

label: grafana_dashboard

# -- Annotation key on dashboard ConfigMaps that determines the target

# subdirectory on disk (e.g. "postgresql" -> /tmp/dashboards/postgresql/).

# Must match the grafana_dashboard_folder annotation used in the dashboard

# ConfigMap templates (grafana-postgresql-dashboards.yaml, grafana-prometheus-dashboards.yaml).

folderAnnotation: grafana_dashboard_folder

datasources:

enabled: true

# -- Label key used to identify datasource ConfigMaps.

label: grafana_datasource

grafana.ini:

auth.anonymous:

enabled: true

org_role: Admin

dashboards:

default_home_dashboard_path: /tmp/dashboards/postgresql/1-global-db-overview.json

# -- Optional env vars injected into the Grafana subchart main container.

# When pgwatch.grafana.useSubchart=true and datasource credentials come from an

# existing Secret with custom keys, mirror those keys here via envValueFrom so

# Grafana can resolve ${PGWATCH_METRICS_DS_USER} / ${PGWATCH_METRICS_DS_PASSWORD}

# placeholders from the datasource ConfigMap.

envValueFrom: {}