Complete Configurations

Below you'll find all the available configurations for data, with the relative default values.

# Default values for ahd-base.
# This is a YAML-formatted file.

nameOverride: ""
fullnameOverride: ""

certRotator:
  image:
    # -- Rotator image repository
    repository: <REDACTED>.dkr.ecr.eu-south-1.amazonaws.com/ahd-cert-rotator
    # -- Rotator image tag
    tag: "v0.1.0-alpha.0"
    # -- Rotator image pull policy
    pullPolicy: IfNotPresent

  certManager:
    # -- Base HTTPS URL for ICS Cert Manager API
    baseUrl: ""

  # -- Optional imagePullSecrets list for rotator pods
  imagePullSecrets: []

  job:
    # -- If true, CronJob executes in suspended state
    suspend: false
    # -- Number of successful jobs to keep
    successfulJobsHistoryLimit: 2
    # -- Number of failed jobs to keep
    failedJobsHistoryLimit: 2
    # -- Backoff retry limit per run
    backoffLimit: 1
    # -- Maximum execution time per run in seconds
    activeDeadlineSeconds: 120
    # -- Optional deadline in seconds for starting a delayed job
    startingDeadlineSeconds: 60
    # -- Concurrency policy for CronJobs
    concurrencyPolicy: Forbid
    # -- Optional TTL in seconds for finished Jobs
    ttlSecondsAfterFinished: 300

  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 65532
    runAsGroup: 65532
    fsGroup: 65532
    seccompProfile:
      type: RuntimeDefault

  containerSecurityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop:
        - ALL

  # -- Pod resource requests/limits for the rotator container.
  # -- requests reserve CPU/memory for scheduling; limits cap max usage.
  # -- Example:
  # -- resources:
  # --   requests:
  # --     cpu: 50m
  # --     memory: 64Mi
  # --   limits:
  # --     cpu: 250m
  # --     memory: 256Mi
  resources: {}

  # -- Certificate used as Traefik's cluster-wide default (TLSStore `default`). Same fields as a `domains` entry; unset `name` disables it. `targetNamespace` must match Traefik's namespace. Do not repeat the name in `domains`.
  defaultDomain:
    name: ""
    enabled: true
    schedule: ""
    # -- Run a one-shot Argo CD Sync hook in addition to the scheduled CronJob.
    runOnSync: true
    targetNamespace: default
    icsToken: ""
    privateKey: ""
    requestTimeoutSeconds: 30

  # -- Domain-specific rotation configurations. One CronJob/ServiceAccount/RBAC set per item.
  domains: []
    # - name: test11.smeupics.cloud
    #   enabled: true
    #   schedule: "0 */6 * * *"
    #   # Run a one-shot rotation on each Argo CD sync, in addition to the CronJob.
    #   runOnSync: true
    #   # Defaults to the Helm release namespace when omitted.
    #   targetNamespace: application-namespace
    #   # Stored in a chart-managed Secret in the Helm release namespace.
    #   icsToken: ""
    #   # Stored as tls.key in a chart-managed Secret in targetNamespace.
    #   privateKey: ""
    #   requestTimeoutSeconds: 30