149 lines
4.3 KiB
YAML
149 lines
4.3 KiB
YAML
# Global settings
|
|
global:
|
|
# If set, these take highest precedence and change both envoyGateway and ratelimit's container registry and pull secrets.
|
|
# -- Global override for image registry
|
|
imageRegistry: ""
|
|
# -- Global override for image pull secrets
|
|
imagePullSecrets: []
|
|
|
|
# If set, these override image-specific values: useful when installing the chart in a private registry environment.
|
|
# Override image-specific values directly if a global override is not desired.
|
|
images:
|
|
envoyGateway:
|
|
# This is the full image name including the hub, repo, and tag.
|
|
image: docker.io/envoyproxy/gateway:v1.7.1
|
|
# Specify image pull policy if default behavior isn't desired.
|
|
# Default behavior: latest images will be Always else IfNotPresent.
|
|
pullPolicy: IfNotPresent
|
|
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
|
|
pullSecrets: []
|
|
ratelimit:
|
|
# This is the full image name including the hub, repo, and tag.
|
|
image: "docker.io/envoyproxy/ratelimit:c8765e89"
|
|
# Specify image pull policy if default behavior isn't desired.
|
|
# Default behavior: latest images will be Always else IfNotPresent.
|
|
pullPolicy: IfNotPresent
|
|
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
|
|
pullSecrets: []
|
|
|
|
podDisruptionBudget:
|
|
minAvailable: 0
|
|
# maxUnavailable: 1
|
|
|
|
deployment:
|
|
annotations: {}
|
|
envoyGateway:
|
|
image:
|
|
# if both this and global.imageRegistry are specified, this has to include both registry and repository explicitly, eg docker.io/envoyproxy/gateway
|
|
repository: ""
|
|
tag: ""
|
|
imagePullPolicy: ""
|
|
imagePullSecrets: []
|
|
resources:
|
|
limits:
|
|
memory: 1024Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
privileged: false
|
|
runAsNonRoot: true
|
|
runAsGroup: 65532
|
|
runAsUser: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
ports:
|
|
- name: grpc
|
|
port: 18000
|
|
targetPort: 18000
|
|
- name: ratelimit
|
|
port: 18001
|
|
targetPort: 18001
|
|
- name: wasm
|
|
port: 18002
|
|
targetPort: 18002
|
|
- name: metrics
|
|
port: 19001
|
|
targetPort: 19001
|
|
priorityClassName: null
|
|
replicas: 1
|
|
pod:
|
|
affinity: {}
|
|
annotations:
|
|
prometheus.io/scrape: 'true'
|
|
prometheus.io/port: '19001'
|
|
labels: {}
|
|
topologySpreadConstraints: []
|
|
tolerations: []
|
|
nodeSelector: {}
|
|
|
|
service:
|
|
# If set to PreferClose, the Envoy fleet will prioritize connecting to the Envoy Gateway pods that are topologically closest to them.
|
|
trafficDistribution: ""
|
|
annotations: {}
|
|
# -- Service type. Can be set to LoadBalancer with specific IP, e.g.:
|
|
# type: LoadBalancer
|
|
loadBalancerIP: 192.168.1.30
|
|
type: "ClusterIP"
|
|
|
|
hpa:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
metrics: []
|
|
behavior: {}
|
|
|
|
config:
|
|
# -- EnvoyGateway configuration. Visit https://gateway.envoyproxy.io/docs/api/extension_types/#envoygateway to view all options.
|
|
envoyGateway:
|
|
gateway:
|
|
controllerName: gateway.envoyproxy.io/gatewayclass-controller
|
|
provider:
|
|
type: Kubernetes
|
|
logging:
|
|
level:
|
|
default: info
|
|
extensionApis: {}
|
|
|
|
createNamespace: false
|
|
|
|
kubernetesClusterDomain: cluster.local
|
|
|
|
# -- Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected.
|
|
certgen:
|
|
job:
|
|
annotations: {}
|
|
args: []
|
|
pod:
|
|
annotations: {}
|
|
labels: {}
|
|
resources: {}
|
|
affinity: {}
|
|
tolerations: []
|
|
nodeSelector: {}
|
|
ttlSecondsAfterFinished: 30
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
privileged: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsGroup: 65532
|
|
runAsUser: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
rbac:
|
|
annotations: {}
|
|
labels: {}
|
|
|
|
topologyInjector:
|
|
enabled: true
|
|
annotations: {}
|
|
|