values.yaml

# -- Global setting, passed down to all pods
global:
  ## -- Mode for oathkeeper controller possible modes are: controller or sidecar
  ory:
    oathkeeper:
      maester:
        mode: controller
  # -- Specify pod metadata, this metadata is added directly to the pod, and not higher objects
  podMetadata:
    # -- Extra pod level labels
    labels: {}
    # -- Extra pod level annotations
    annotations: {}

# -- Number of controller replicas in deployment mode
replicaCount: 1
# -- Number of revisions kept in history
revisionHistoryLimit: 5
# -- Single namespace mode. If enabled the controller will watch for resources only from namespace it is deployed in, ignoring others
singleNamespaceMode: false

# oathkeeperFullnameOverride: oathkeeper
# -- Defines the Namespace in which the ConfigMap is stored. Defaults to the same Namespace as the ORY Maester Helm release.
rulesConfigmapNamespace: ""
# rulesConfigmapNamespace: some-namespace
# -- Defines the name of the single root-level ConfigMap key used to store the entire array of Access Rules.
# When the ConfigMap is mounted in the Oathkeeper Pod, this becomes also the filename of the "rules file" to the Oathkeeper process. Defaults to `access-rules.json`.
rulesFileName: ""
# rulesFileName: access-rules.json

## -- Image configuration
image:
  # -- ORY Oathkeeper Rule Controller image
  repository: oryd/oathkeeper-maester
  # -- ORY Oathkeeper Rule Controller version
  tag: "v0.1.12"
  # -- Image pull policy
  pullPolicy: IfNotPresent

# -- Image pull secrets
imagePullSecrets: []

## -- Container level security context
securityContext:
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 65534
  runAsGroup: 65534
  allowPrivilegeEscalation: false
  privileged: false
  seccompProfile:
    type: RuntimeDefault
  seLinuxOptions:
    level: "s0:c123,c456"

## -- Pod level security context
podSecurityContext:
  fsGroupChangePolicy: "OnRootMismatch"
  runAsNonRoot: true
  runAsUser: 65534
  fsGroup: 65534
  runAsGroup: 65534
  seccompProfile:
    type: RuntimeDefault

## -- Deployment specific configuration
deployment:
  resources: {}
    #  We usually recommend not to specify default resources and to leave this as a conscious
    #  choice for the user. This also increases chances charts run on environments with little
    #  resources, such as Minikube. If you do want to specify resources, uncomment the following
    #  lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   cpu: 100m
    #   memory: 30Mi
    # requests:
    #   cpu: 100m
    #   memory: 20Mi

  # -- Pod priority
  # https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
  priorityClassName: ""

  # -- Node labels for pod assignment.
  nodeSelector: {}
  # If you do want to specify node labels, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'annotations:'.
  #   foo: bar

  # -- Configure node tolerations.
  tolerations: []
  # -- Deployment level extra labels
  extraLabels: {}

  # -- Configure pod topologySpreadConstraints.
  topologySpreadConstraints: []
  # - maxSkew: 1
  #   topologyKey: topology.kubernetes.io/zone
  #   whenUnsatisfiable: DoNotSchedule
  #   labelSelector:
  #     matchLabels:
  #       app.kubernetes.io/name: oathkeeper-maester
  #       app.kubernetes.io/instance: oathkeeper-maester

  # -- Configure pod dnsConfig.
  dnsConfig: {}
  #   options:
  #     - name: "ndots"
  #       value: "1"

  # -- Configure annotations.
  annotations: {}

  # -- Configure environment variables.
  envs: {}
  # https://github.com/kubernetes/kubernetes/issues/57601
  # This applications connects to the k8s API and requires the permissions
  automountServiceAccountToken: true
  terminationGracePeriodSeconds: 60
  # -- Specify pod metadata, this metadata is added directly to the pod, and not higher objects
  podMetadata:
    # -- Extra pod level labels
    labels: {}
    # -- Extra pod level annotations
    annotations: {}

  # -- Configure service account
  serviceAccount:
    # -- Annotations to add to the service account
    annotations: {}

## -- Configure node affinity
affinity: {}

## -- PodDistributionBudget configuration
pdb:
  enabled: false
  spec:
    minAvailable: ""
    maxUnavailable: ""