Core, router and scheduling
Chart values: core, router, scheduling.
Generated from
charts/harthelm/values.yaml at v1.5.0core
| Value | Type | Default | Description |
|---|---|---|---|
core.replicas | number | 1 | |
core.pdb | object | A PodDisruptionBudget, rendered whatever the replicas; with one replica it only says a drain may evict it. | |
core.pdb.enabled | boolean | true | |
core.pdb.maxUnavailable | number | 1 | |
core.updateStrategy | string | "RollingUpdate" | RollingUpdate keeps the API up during an upgrade; only the newest core reconciles meanwhile (a version fence), so two versions never fight over workspace objects. Recreate stops the old core first (a short API outage). |
core.resources.requests.cpu | string | "100m" | |
core.resources.requests.memory | string | "192Mi" | |
core.resources.limits.memory | string | "512Mi" | |
core.serviceAccount.annotations | object | {} | |
core.podAnnotations | object | {} | |
core.podLabels | object | {} | |
core.extraEnv | list | [] | More env vars for core. HART_DOCS_URL (an http(s) address) puts a "Docs" link to your documentation in the console's header; without it there is no link. Example: [{name: HART_DOCS_URL, value: "https://docs.example.org/"}] |
core.extraEnvFrom | list | [] |
router
| Value | Type | Default | Description |
|---|---|---|---|
router.enabled | boolean | true | Serves every workspace host. Without it the workspace wildcard has no backend; set false for a console-only smoke install. |
router.replicas | number | 2 | |
router.pdb.enabled | boolean | true | |
router.pdb.maxUnavailable | number | 1 | |
router.resources.requests.cpu | string | "25m" | |
router.resources.requests.memory | string | "48Mi" | |
router.resources.limits.memory | string | "192Mi" | |
router.serviceAccount.annotations | object | {} | |
router.podAnnotations | object | {} | |
router.podLabels | object | {} | |
router.extraEnv | list | [] | |
router.extraEnvFrom | list | [] | |
router.forward | object | Where forward services (type: forward in harthelm.yml) may lead: the SSRF guard core checks at Plan and the router enforces on every address it dials. Whatever this says, the router never dials loopback, link-local (cloud metadata), multicast or unspecified addresses, and only Services of the workspace's own team namespace by name. The router's NetworkPolicy gets matching egress rules (networkPolicy.enabled). | |
router.forward.allowPublic | boolean | true | Public unicast addresses (not private, shared, loopback, link-local, unique-local or documentation ranges). |
router.forward.allowCIDRs | list | [] | Further address ranges, e.g. an internal network: [10.0.0.0/16]. Never the cluster's pod or Service ranges: through them a target reaches other teams and the platform. |
router.forward.allowHosts | list | [] | Host names that may resolve to any address, exact or "*.<suffix>", lower case. The NetworkPolicy cannot match names: add their ranges to allowCIDRs or a rule to networkPolicy.egress.router. |
router.forward.clusterDomain | string | "cluster.local" | The cluster's DNS domain, for the team Service names. |
scheduling
| Value | Type | Default | Description |
|---|---|---|---|
scheduling.platform | object | Applies to core, router, the backup jobs and the bundled platform database. | |
scheduling.platform.nodeSelector | object | {} | |
scheduling.platform.tolerations | list of object | [] | |
scheduling.platform.affinity | object | {} | |
scheduling.workspaces | object | Where workspace pods may run (core renders them, so these travel in core's config file). A node selector is a hard requirement; use affinity for a preference. In rwo-colocated mode core adds the node pin on top. | |
scheduling.workspaces.nodeSelector | object | {} | |
scheduling.workspaces.tolerations | list of object | [] | |
scheduling.workspaces.affinity | object | {} | |
scheduling.ephemeralNodeSelector | object | {} | The night drain: nodes that are drained on a schedule, e.g. powered off at night. Empty: no node is ephemeral and none of the following applies. All labels must match. - Cordoning such a node puts the on-demand workspaces on it to sleep (and the always-running ones whose volume ties them to it) after cordonGraceSeconds, so the agents stop their steps first; so does an eviction (DisruptionTarget). Uncordoning wakes nothing: the next request does. - Workspace pods prefer ephemeral nodes. Always-running services of rwx workspaces are kept off them, so give scheduling.platform the same rule (core, router, database: affinity NotIn the selector's label). |
scheduling.cordonGraceSeconds | integer | 30 | |
scheduling.powerWindows | list of object | [] | When the ephemeral nodes are on, so a wake while they are off answers "sleeps until 06:00" instead of "no capacity". Each entry: {nodeSelector, timeZone (IANA, default UTC), stateAnnotation, periods: [{days, from, to}]}; days are mon..sun (default every day), from/to are HH:MM, to before from spans midnight, from equal to to is the whole day. stateAnnotation (optional) names a node annotation in which your power script writes when an off node comes back ("... back after <RFC 3339 time>"); the answer then uses that time instead of the window's next start. Informational: nothing here turns a node on or off. |