tofu-controller

# -- If `true`, enable cross-namespace references for controller and branch-planner

allowCrossNamespaceRefs: false

# -- If `true`, controller will watch all namespaces for Terraform resources

watchAllNamespaces: true

# ServiceAccount

serviceAccount:

# -- If `true`, create a new service account

create: true

# -- Additional Service Account annotations

annotations: {}

# -- Service account to be used

# @default -- tofu-controller

name: ""

# Controller

# -- Provide a name

nameOverride: ""

# -- Provide a fullname

fullnameOverride: ""

# -- Additional deployment labels for the controller

deploymentLabels: {}

# -- Additional pod annotations

podAnnotations: {}

# -- Additional pod labels

podLabels: {}

# -- Number of tofu-controller pods to deploy

replicaCount: 1

image:

# -- Controller image repository

repository: chainreg.biz/chainguard-private/tofu-controller-fips

# -- Controller image pull policy

pullPolicy: IfNotPresent

# -- Overrides the image tag whose default is the chart appVersion.

# @default -- `.Chart.AppVersion`

tag: 0.16.5-r6@sha256:b2fa70ee7a342e6d672dd4a196a3471e34051187523e22c99185f2504f1e3071

# -- Controller image pull secret

imagePullSecrets: []

# -- Resource limits and requests

resources:

limits:

cpu: 1000m

memory: 1Gi

requests:

cpu: 200m

memory: 64Mi

# -- Additional container environment variables.

extraEnv: {}

# -- Pod-level security context

podSecurityContext:

fsGroup: 1337

# -- Container-level security context

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsUser: 65532

seccompProfile:

type: RuntimeDefault

rbac:

# -- If `true`, create and use RBAC resources

create: true

# -- Node Selector properties for the tofu-controller deployment

nodeSelector: {}

# -- Tolerations properties for the tofu-controller deployment

tolerations: []

# -- Affinity properties for the tofu-controller deployment

affinity: {}

# -- Volumes properties for the tofu-controller deployment

volumes: []

# - name: policy-agent

# secret:

# secretName: policy-agent-tls

# optional: false

# -- Volume mounts properties for the tofu-controller deployment

volumeMounts: []

# - name: policy-agent

# mountPath: "/etc/certs/policy-agent.policy-system.svc/"

# readOnly: true

# -- PriorityClassName property for the tofu-controller deployment

priorityClassName: ""

# -- Argument for `--log-encoding`. Can be 'json' or 'console'. (Controller)

logEncoding: json

# -- Level of logging of the controller (Controller)

logLevel: info

# -- Concurrency of the controller (Controller)

concurrency: 24

# -- Argument for `--cert-rotation-check-frequency` (Controller)

certRotationCheckFrequency: 30m0s

# -- Argument for `--ca-cert-validity-duration` (Controller)

caCertValidityDuration: 168h0m

# -- Argument for `--events-addr` (Controller). The event address, default to the address of the Notification Controller

eventsAddress: http://notification-controller.flux-system.svc.cluster.local./

# -- Argument for `--kube-api-qps` (Controller).

# Kube API QPS indicates the maximum queries-per-second of requests sent to the Kubernetes API, defaults to 50.

kubeAPIQPS: 50

# -- Argument for `--kube-api-burst` (Controller).

# Burst indicates the maximum burst queries-per-second of requests sent to the Kubernetes API, defaults to 100.

kubeAPIBurst: 100

# -- Argument for `--allow-break-the-glass` (Controller).

# AllowBreakTheGlass allows the controller to break the glass and modify Terraform states when the sync loop is broken.

allowBreakTheGlass: false

# -- Argument for `--cluster-domain` (Controller).

# ClusterDomain indicates the cluster domain, defaults to cluster.local.

clusterDomain: cluster.local

# -- Argument for `--use-pod-subdomain-resolution` (Controller).

# UsePodSubdomainResolution allow pod hostname/subdomain DNS resolution for the pod runner instead of IP based DNS resolution.

usePodSubdomainResolution: false

# -- Argument for `--use-priority-queue` (Controller).

# Enable the priority queue feature to prioritize new/changed resources over resources loaded after a restart or resync.

usePriorityQueue: true

# -- Argument for `--quota-retry-enabled` (Controller).

# Enable quota-aware retry when runner pod creation is rejected due to resource quota exhaustion.

quotaRetryEnabled: false

# -- Argument for `--quota-retry-delay` (Controller).

# Base delay for retrying when runner quota is exhausted.

quotaRetryDelay: 5s

# -- Argument for `--quota-retry-jitter-factor` (Controller).

# Jitter factor applied to quota retry delay (e.g. 0.4 means up to 40% added to the base delay).

quotaRetryJitterFactor: "0.4"

# -- Grace period for controller pod termination.

# Argument for `--graceful-shutdown-timeout` (Controller) is (terminationGracePeriodSeconds - 10) or 0, whichever is higher.

# Graceful shutdown will wait for active runners to finish without starting new ones.

terminationGracePeriodSeconds: 250

awsPackage:

install: true

tag: v4.38.0-v1alpha11

repository: ghcr.io/flux-iac/aws-primitive-modules

# -- Runner-specific configurations

runner:

image:

# -- Runner image repository

repository: chainreg.biz/chainguard-private/tofu-controller-runner-fips

# -- Runner image tag

# @default -- `.Chart.AppVersion`

tag: 0.16.5-r6@sha256:8e62a7fb13d8ca8e1c48acdd892139212df326056ecab9fa3e35e7f2e72fd844

grpc:

# -- Maximum GRPC message size (Controller)

maxMessageSize: 4

# -- Timeout for runner-creation (Controller)

creationTimeout: 5m0s

serviceAccount:

# -- If `true`, create a new runner service account

create: true

# -- Additional runner service Account annotations

annotations: {}

# -- Runner service account to be used

name: ""

# -- List of namespaces that the runner may run within (in addition to namespace of the controller itself)

allowedNamespaces:

- flux-system

# EKS-specific configurations

# -- Create an AWS EKS Security Group Policy with the supplied Security Group IDs [See](https://docs.aws.amazon.com/eks/latest/userguide/security-groups-for-pods.html#deploy-securitygrouppolicy)

eksSecurityGroupPolicy:

# -- Create the EKS SecurityGroupPolicy

create: false

# -- List of AWS Security Group IDs

ids: []

# For example:

# - sg-1234567890

# - sg-1234567891

# - sg-1234567892

# Metrics

metrics:

# -- Enable Metrics Service

enabled: false

# ServiceMonitor

serviceMonitor:

# -- Enable ServiceMonitor

enabled: false

# -- Install the ServiceMonitor into a different Namespace, as the monitoring stack one

# @default -- `.Release.Namespace`

namespace: ""

# -- Assign additional labels according to Prometheus' serviceMonitorSelector matching labels

labels: {}

# -- Assign additional Annotations

annotations: {}

# -- Change matching labels

matchLabels: {}

# -- Set targetLabels for the serviceMonitor

targetLabels: []

endpoint:

# -- Set the scrape interval for the endpoint of the serviceMonitor

interval: "15s"

# -- Set the scrape timeout for the endpoint of the serviceMonitor

scrapeTimeout: ""

# -- Set metricRelabelings for the endpoint of the serviceMonitor

metricRelabelings: []

# -- Set relabelings for the endpoint of the serviceMonitor

relabelings: []

# -- Branch Planner-specific configurations

branchPlanner:

enabled: false

image:

repository: ghcr.io/flux-iac/branch-planner

pullPolicy: IfNotPresent

tag: ""

# Additional deployment labels for the branch-planner

deploymentLabels: {}

configMap: branch-planner

pollingInterval: 30s

# Interval value to use for Source objects for branch planner Terraform objects.

sourceInterval: 30s

# Pod-level security context

podSecurityContext:

fsGroup: 1337

# Container-level security context

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsUser: 65532

seccompProfile:

type: RuntimeDefault

# Resource limits and requests

resources:

limits:

cpu: 1000m

memory: 1Gi

requests:

cpu: 200m

memory: 64Mi