Global and images
Chart values: global, nameOverride, fullnameOverride, image, agent, tools, internal.
charts/harthelm/values.yaml at v1.5.0global
| Value | Type | Default | Description |
|---|---|---|---|
global.imageRegistry | string | "" | Replaces the registry of every image the chart renders, the CNPG PostgreSQL image included (air-gapped installs). |
global.imagePullSecrets | list of object | [] | kubernetes.io/dockerconfigjson Secrets in the release namespace, for a registry that wants a login: [{name: pull}]. The chart's pods list them; core copies them into every team namespace (same name, read again every 30 seconds) and lists the copies on the workspace and service pods, the archive and restore Jobs and the managed databases. The preflight checks that each exists with that type. Names starting with ws- are refused. |
global.proxy | object | Proxy for the platform pods. Core and router never download anything else at runtime. With a proxy, NO_PROXY always ends with the cluster's service domain .svc. | |
global.proxy.http | string | "" | |
global.proxy.https | string | "" | |
global.proxy.noProxy | string | "" |
nameOverride
| Value | Type | Default | Description |
|---|---|---|---|
nameOverride | string | "" |
fullnameOverride
| Value | Type | Default | Description |
|---|---|---|---|
fullnameOverride | string | "" |
image
One image for core and router (HART_ROLE selects the role).
| Value | Type | Default | Description |
|---|---|---|---|
image.registry | string | "" | |
image.repository | string | "harthelm/harthelm" | |
image.tag | string | "" | defaults to the chart's appVersion |
image.digest | string | "" | wins over tag when set |
image.pullPolicy | string | "IfNotPresent" |
agent
The workspace agent. Core hands the reference to every workspace pod: as an image volume or copied by an init container. A digest keeps all pods of a workspace on one agent version.
| Value | Type | Default | Description |
|---|---|---|---|
agent.image.registry | string | "" | |
agent.image.repository | string | "harthelm/harthelm-agent" | |
agent.image.tag | string | "" | defaults to the chart's appVersion |
agent.image.digest | string | "" | |
agent.delivery | auto, imageVolume, initContainer | "auto" | auto: an image volume when core's probe pod proves it works on the cluster, else the init container copy. imageVolume | initContainer force one of them. |
tools
pg_dump 18 plus the harthelm binary: the backup CronJob, the pre-upgrade dump and the UID migration Job run it.
| Value | Type | Default | Description |
|---|---|---|---|
tools.image.registry | string | "" | |
tools.image.repository | string | "harthelm/harthelm-tools" | |
tools.image.tag | string | "" | defaults to the chart's appVersion |
tools.image.digest | string | "" |
internal
TLS inside the cluster: core's internal port (route stream, wake, activity, the JWKS and the agents' callbacks, :8081) and its in-cluster API port for workspace pods (:8443) serve a certificate of the issuer below, and the router, the agents and hart in workspaces verify it. The edge keeps reaching the API on :8080. With rbac.certManager (the default) the managed Valkey, MariaDB and RabbitMQ instances get a certificate of the same issuer too (Certificates mstls-* in the release namespace): TLS listeners next to their plain ports (MariaDB: on 3306, offered), which the backups always use, verified with the internal CA (1.3).
| Value | Type | Default | Description |
|---|---|---|---|
internal.tls | object | In-cluster TLS of core's internal and in-cluster API ports. | |
internal.tls.mode | auto, on, off | "auto" | auto: on when the cluster serves cert-manager.io/v1 (Helm's and Argo CD's API versions), else off. on: always (cert-manager must be installed). off: plain HTTP inside the cluster (the kind dev cluster). |
internal.tls.issuerRef | object | The issuer of the certificate. Without a name the chart makes its own CA with cert-manager: a self-signed Issuer, a CA Certificate <fullname>-internal-ca and an Issuer on it, all in the release namespace. A named issuer must put ca.crt into its Secrets (a CA or Vault issuer, not ACME): the router, the receiver and workspace pods verify with it. | |
internal.tls.issuerRef.name | string | "" | |
internal.tls.issuerRef.kind | Issuer, ClusterIssuer | "Issuer" | |
internal.tls.issuerRef.group | string | "cert-manager.io" | |
internal.tls.duration | string | "2160h" | 90 days |
internal.tls.renewBefore | string | "360h" | 15 days |