values.yaml

## Default values for piggy-webhooks.
## This is a YAML-formatted file.
## Declare variables to be passed into your templates.

replicaCount: 1

image:
  repository: ghcr.io/kongz/piggy-webhooks
  pullPolicy: IfNotPresent
  ## Overrides the image tag whose default is the chart appVersion.
  tag: "0.6.0"

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

## Pod port
port: 8443

serviceAccount:
  ## Specifies whether a service account should be created
  create: true
  ## Annotations to add to the service account
  annotations: {}
  ## The name of the service account to use.
  ## If not set and create is true, a name is generated using the fullname template
  name: ""

podAnnotations: {}

podSecurityContext:
  runAsUser: 10001
  fsGroup: 65534

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

service:
  type: ClusterIP
  port: 443

ingress:
  enabled: false
  className: ""
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  host: piggy-webhooks.local
  path: /
  pathType: ImplementationSpecific

resources: {}
  ## We usually recommend not to specify default resources and to leave this as a conscious
  ## choice for the user. This also increases chances charts run on environments with little
  ## resources, such as Minikube. If you do want to specify resources, uncomment the following
  ## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 100
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

## Set number of pods from that can be unavailable after the eviction. 
## It can be either an absolute number or a percentage.
maxUnavailable: 1

## Specify the PriorityClass name for piggy.
## Default value is set to system-cluster-critical to ensure that piggy is always schedule first.
##
priorityClassName: system-cluster-critical

nodeSelector: {}

tolerations: []

affinity: {}

volumeMounts: []

volumes: []

rbac:
  psp:
    enabled: false

aws:
  # Specify the Role ARN for IRSA
  roleArn:

# Additional environment variable for piggy-webhooks
env: {}
  ## Set default AWS region for all secret manager
  # AWS_REGION: "ap-southeast-1"
  ## Force to check `PIGGY_ALLOWED_SA` env value in AWS secret manager
  # PIGGY_ENFORCE_SERVICE_ACCOUNT: "true"
  ## Set default secret name prefix. If set the default secret name will be `${prefix}${namespace}/${sa}`
  # PIGGY_DEFAULT_SECRET_NAME_PREFIX: ""
  ## Set default secret name suffix. If set the default secret name will be `${namespace}/${sa}${suffix}`
  # PIGGY_DEFAULT_SECRET_NAME_SUFFIX: ""
  ## Set delay piggy to run in seconds. This is useful when using Istio Envoy. The Envoy took 2 seconds to operate before allowing any
  ## traffic outgoing from Pod
  # PIGGY_DELAY_SECOND: "2"
  ## Set number of retry for retrieving secret. This is useful when using Istio Envoy. Each retryment will sleep for 500ms. 
  ## Set to 4-6 is a good number if you are using Envoy on sidecar.
  # PIGGY_NUMBER_OF_RETRY: "6"
  ## Set a variable to `true` for not exiting if no environment variable found on AWS secret manager.
  # PIGGY_IGNORE_NO_ENV: "false"

mutate:
  certificate:
    certManager: 
      enabled: false
      privateKey:
        algorithm: ECDSA
        size: 256
    generate: true
    # if certManager.use = true OR generate=true, set the certificate validity (days)
    certValidity: 3650
    tls:
      crt:
      key:
    ca:
      crt:
  timeoutSeconds: false
  podsFailurePolicy: Ignore
  image:
    repository: ghcr.io/kongz/piggy-env
    pullPolicy: IfNotPresent
    tag: "0.6.0"

debug: false