Teams and storage
Chart values: tenancy, teams, storage, customDomains, gc.
Generated from
charts/harthelm/values.yaml at v1.5.0tenancy
| Value | Type | Default | Description |
|---|---|---|---|
tenancy.defaultOrg | string | "Default" | The organization and team every install starts with. |
tenancy.defaultTeam | string | "Default" |
teams
Namespace rg-<team> defaults (the quota and the LimitRange); a team's own quota overrides entries.
| Value | Type | Default | Description |
|---|---|---|---|
teams.quota | object | Kubernetes quantities (a plain number is bytes there); memory and storage also take the MiB and GiB spellings (4096MiB, 50GiB). | |
teams.quota.requestsCpu | string or number | "2" | |
teams.quota.requestsMemory | string or number | "4Gi" | |
teams.quota.limitsMemory | string or number | "8Gi" | |
teams.quota.requestsStorage | string or number | "50Gi" | |
teams.limitRange.defaultRequestCpu | string | "100m" | |
teams.limitRange.defaultRequestMemory | string | "128Mi" | |
teams.limitRange.defaultLimitCpu | string | "" | |
teams.limitRange.defaultLimitMemory | string | "512Mi" | |
teams.network.dns | object | The cluster DNS pods the team namespaces may ask. | |
teams.network.dns.namespaceSelector.kubernetes.io/metadata.name | string | "kube-system" | |
teams.network.dns.podSelector.k8s-app | string | "kube-dns" | |
teams.network.mirrors | object | Package and tool mirrors on private addresses (air-gapped installs, values-airgap.yaml): workspaces reach the internet but no private range, so name the mirrors (NetworkPolicyPeer objects; empty: any destination) and their TCP ports. With Cilium the backstop leaves the ipBlocks out of its private-range deny. No ports: no rule. | |
teams.network.mirrors.to | list of object | [] | |
teams.network.mirrors.ports | list of integer | [] |
storage
| Value | Type | Default | Description |
|---|---|---|---|
storage.class | string | "" | Workspace volumes. class empty: the cluster's default StorageClass. |
storage.mode | auto, rwx, rwo-colocated | "auto" | rwx: one ReadWriteMany volume. rwo-colocated: a ReadWriteOnce volume, every pod of a workspace on one node. auto: core probes the class at start and decides. |
storage.defaultSizeGiB | integer or string | 10 | Volume size of a plan that sets no storageGiB: a number of GiB or a size string (20Gi, 20480MiB), whole GiB. |
customDomains
Custom domains of the teams: a team admin adds a host, it serves once DNS verifies it (the TXT record _harthelm.<host> only), through one edge object per domain in this namespace (Ingress or HTTPRoute after routing.*) to the router, with a certificate from the issuer below, an uploaded one, or a wildcard.
| Value | Type | Default | Description |
|---|---|---|---|
customDomains.enabled | boolean | true | |
customDomains.cnameTarget | string | "" | the host a domain's CNAME points to (routing only, never proof); empty: A/AAAA of publicIPs |
customDomains.publicIPs | list of string | [] | the edge's addresses, shown as A/AAAA records for apex domains |
customDomains.resolvers | list of string | ["1.1.1.1:53","8.8.8.8:53","9.9.9.9:53"] | The resolvers verification asks (IP:port), never the cluster's DNS, so an internal override cannot verify a domain. Air-gapped installs name their own. |
customDomains.maxPerTeam | integer | 20 | |
customDomains.claimDays | integer | 7 | Only the TXT record _harthelm.<host> verifies a domain; a CNAME or A record only routes. An unverified domain holds its name for claimDays, then it is removed and the name is free again. |
customDomains.lapseDays | integer | 7 | Verified domains are re-checked daily; one whose TXT record stays missing for lapseDays lapses: it stops serving and gets no API keys or session tokens until a check finds the record again. |
customDomains.createPerTeamPerHour | integer | 10 | Domains a team may add per hour, deleted ones included (each verified domain costs an ACME order on the installation's shared account); over it the API answers 429. |
customDomains.limits.defaultMaxBodyBytes | integer | 104857600 | the router's per-domain defaults and the ceilings a team admin may set |
customDomains.limits.maxBodyBytes | integer | 1073741824 | |
customDomains.limits.defaultTimeoutSeconds | integer | 60 | |
customDomains.limits.maxTimeoutSeconds | integer | 3600 | |
customDomains.issuer | object | The cert-manager issuer of automated certificates (needs rbac.certManager). No name: none are issued, and domains need an uploaded certificate or a wildcard below. HTTP-01 or DNS-01 is the issuer's business. | |
customDomains.issuer.name | string | "" | |
customDomains.issuer.kind | ClusterIssuer, Issuer | "ClusterIssuer" | |
customDomains.issuer.group | string | "cert-manager.io" | |
customDomains.wildcards | list of object | [] | Existing wildcard certificates (Secrets in this namespace) that cover domains one label below them, e.g. [{domain: "*.example.com", secretName: example-wildcard-tls}]; a covered domain gets no Certificate of its own. |
gc
| Value | Type | Default | Description |
|---|---|---|---|
gc.mode | log, delete | "log" | log: orphaned objects are logged and kept (so a restored older dump never deletes a workspace). delete: removed. |