home/charts
2
0
Fork 0
mirror of https://github.com/wahyd4/charts.git synced 2026-08-19 10:06:18 +10:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/argo-workflows] Set rootOnlyrootFileSystem by default (#9357)

Browse Source 
* [bitnami/argo-workflows] Set rootOnlyrootFileSystem by default

Signed-off-by: Miguel A. Cabrera Minagorri <mcabrera@vmware.com>

* [bitnami/argo-workflows] Update README

Signed-off-by: Miguel A. Cabrera Minagorri <mcabrera@vmware.com>
This commit is contained in:
Miguel Ángel Cabrera Miñagorri
2022-03-18 15:02:19 +01:00
committed by GitHub
parent 229668a81a
commit 290069c529
4 changed files with 233 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/argo-workflows/Chart.lock
+4 -4
View File
@@ -1,12 +1,12 @@
dependencies:
- name: postgresql
repository: https://charts.bitnami.com/bitnami
version: 11.1.3
version: 11.1.4
- name: mysql
repository: https://charts.bitnami.com/bitnami
version: 8.8.26
- name: common
repository: https://charts.bitnami.com/bitnami
version: 1.11.2
digest: sha256:eb41d103c6a76df4b274660d1df74871406cd21e95b091bd1a69fe833b907c56
generated: "2022-03-02T12:14:51.2404+01:00"
version: 1.11.3
digest: sha256:25e38e1aa779f73b9295c8c07e3bd3eee9302fc48086b2e108e14243d792035d
generated: "2022-03-09T16:21:54.362678571Z"
bitnami/argo-workflows/Chart.yaml
+1 -1
View File
@@ -35,4 +35,4 @@ sources:
- https://github.com/bitnami/bitnami-docker-argo-workflow-controller
- https://github.com/bitnami/bitnami-docker-argo-workflow-exec
- https://argoproj.github.io/workflows/
version: 1.0.2
version: 1.1.0
bitnami/argo-workflows/README.md
+222 -209
View File
@@ -60,6 +60,7 @@ The command removes all the Kubernetes components associated with the chart and
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` |
### Common parameters
| Name | Description | Value |
@@ -74,223 +75,230 @@ The command removes all the Kubernetes components associated with the chart and
| `rbac.singleNamespace` | Restrict Argo to only deploy into a single namespace by apply Roles and RoleBindings instead of the Cluster equivalents, and start argo-cli with the --namespaced flag. Use it in clusters with strict access policy. | `false` |
| `createAggregateRoles` | Create Aggregated cluster roles | `true` |
### Argo Workflows Server configuration parameters
| Name | Description | Value |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------- |
| `server.image.registry` | server image registry | `docker.io` |
| `server.image.repository` | server image repository | `bitnami/argo-workflow-cli` |
| `server.image.tag` | server image tag (immutable tags are recommended) | `3.2.8-scratch-r0` |
| `server.image.pullPolicy` | server image pull policy | `Always` |
| `server.image.pullSecrets` | server image pull secrets | `[]` |
| `server.enabled` | Enable server deployment | `true` |
| `server.replicaCount` | Number of server replicas to deploy | `1` |
| `server.livenessProbe.enabled` | Enable livenessProbe on server nodes | `true` |
| `server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` |
| `server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` |
| `server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
| `server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
| `server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `server.readinessProbe.enabled` | Enable readinessProbe on server nodes | `true` |
| `server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` |
| `server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `20` |
| `server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `server.startupProbe.enabled` | Enable startupProbe | `false` |
| `server.startupProbe.path` | Path to check for startupProbe | `/` |
| `server.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` |
| `server.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
| `server.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
| `server.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` |
| `server.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `server.customLivenessProbe` | Server custom livenessProbe that overrides the default one | `{}` |
| `server.customReadinessProbe` | Server custom readinessProbe that overrides the default one | `{}` |
| `server.customStartupProbe` | Server custom startupProbe that overrides the default one | `{}` |
| `server.resources.limits` | The resources limits for the server containers | `{}` |
| `server.resources.requests` | The requested resources for the server containers | `{}` |
| `server.podSecurityContext.enabled` | Enabled server pods' Security Context | `true` |
| `server.podSecurityContext.fsGroup` | Set server pod's Security Context fsGroup | `1001` |
| `server.containerSecurityContext.enabled` | Enabled server containers' Security Context | `true` |
| `server.containerSecurityContext.runAsUser` | Set server containers' Security Context runAsUser | `1001` |
| `server.containerSecurityContext.runAsNonRoot` | Set server containers' Security Context runAsNonRoot | `true` |
| `server.rbac.create` | Create RBAC resources for the Argo workflows server | `true` |
| `server.extraArgs` | Extra arguments for the server command line | `""` |
| `server.auth.enabled` | Enable authentication | `true` |
| `server.auth.mode` | Set authentication mode. Either `server`, `client` or `sso`. | `client` |
| `server.auth.sso.enabled` | Enable SSO configuration for the server auth mode | `false` |
| `server.auth.sso.issuer` | Root URL for the OIDC identity provider | `""` |
| `server.auth.sso.clientId.name` | Name of the secret containing the OIDC client ID | `""` |
| `server.auth.sso.clientId.key` | Key in the secret to obtain the OIDC client ID | `""` |
| `server.auth.sso.clientSecret.name` | Name of the secret containing the OIDC client secret | `""` |
| `server.auth.sso.clientSecret.key` | Key in the secret to obtain the OIDC client secret | `""` |
| `server.auth.sso.redirectUrl` | The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback. | `""` |
| `server.auth.sso.rbac.enabled` | Create RBAC resources for SSO | `true` |
| `server.auth.sso.rbac.secretWhitelist` | Restricts the secrets that the server can read | `[]` |
| `server.auth.sso.scopes` | Scopes requested from the SSO ID provider | `[]` |
| `server.clusterWorkflowTemplates.enabled` | Create ClusterRole and CRB for the controoler to access ClusterWorkflowTemplates | `true` |
| `server.clusterWorkflowTemplates.enableEditing` | Give the server permissions to edit ClusterWorkflowTemplates | `true` |
| `server.pdb.enabled` | Create Pod Disruption Budget for the server component | `false` |
| `server.pdb.minAvailable` | Sets the min number of pods availables for the Pod Disruption Budget | `1` |
| `server.pdb.maxUnavailable` | Sets the max number of pods unavailable for the Pod Disruption Budget | `1` |
| `server.secure` | Run Argo server in secure mode | `false` |
| `server.baseHref` | Base href of the Argo Workflows deployment | `/` |
| `server.containerPorts.web` | argo Server container port | `2746` |
| `server.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `server.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `server.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
| `server.command` | Override default container command (useful when using custom images) | `[]` |
| `server.args` | Override default container args (useful when using custom images) | `[]` |
| `server.hostAliases` | server pods host aliases | `[]` |
| `server.podLabels` | Extra labels for server pods | `{}` |
| `server.podAnnotations` | Annotations for server pods | `{}` |
| `server.podAffinityPreset` | Pod affinity preset. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `server.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
| `server.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `server.nodeAffinityPreset.key` | Node label key to match. Ignored if `server.affinity` is set | `""` |
| `server.nodeAffinityPreset.values` | Node label values to match. Ignored if `server.affinity` is set | `[]` |
| `server.affinity` | Affinity for server pods assignment | `{}` |
| `server.nodeSelector` | Node labels for server pods assignment | `{}` |
| `server.tolerations` | Tolerations for server pods assignment | `[]` |
| `server.updateStrategy.type` | server statefulset strategy type | `RollingUpdate` |
| `server.topologySpreadConstraints` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in | `[]` |
| `server.schedulerName` | Alternate scheduler for the server deployment | `""` |
| `server.priorityClassName` | server pods' priorityClassName | `""` |
| `server.lifecycleHooks` | for the server container(s) to automate configuration before or after startup | `{}` |
| `server.extraEnvVars` | Array with extra environment variables to add to server nodes | `[]` |
| `server.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for server nodes | `""` |
| `server.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for server nodes | `""` |
| `server.extraVolumes` | Optionally specify extra list of additional volumes for the server pod(s) | `[]` |
| `server.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the server container(s) | `[]` |
| `server.sidecars` | Add additional sidecar containers to the server pod(s) | `{}` |
| `server.initContainers` | Add additional init containers to the server pod(s) | `{}` |
| `server.service.type` | server service type | `ClusterIP` |
| `server.service.ports.http` | server service HTTP port | `80` |
| `server.service.nodePorts.http` | Node port for HTTP | `""` |
| `server.service.clusterIP` | server service Cluster IP | `""` |
| `server.service.loadBalancerIP` | server service Load Balancer IP | `""` |
| `server.service.loadBalancerSourceRanges` | server service Load Balancer sources | `[]` |
| `server.service.externalTrafficPolicy` | server service external traffic policy | `Cluster` |
| `server.service.annotations` | Additional custom annotations for server service | `{}` |
| `server.service.extraPorts` | Extra port to expose on the server service | `[]` |
| Name | Description | Value |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------- |
| `server.image.registry` | server image registry | `docker.io` |
| `server.image.repository` | server image repository | `bitnami/argo-workflow-cli` |
| `server.image.tag` | server image tag (immutable tags are recommended) | `3.2.9-scratch-r0` |
| `server.image.pullPolicy` | server image pull policy | `Always` |
| `server.image.pullSecrets` | server image pull secrets | `[]` |
| `server.enabled` | Enable server deployment | `true` |
| `server.replicaCount` | Number of server replicas to deploy | `1` |
| `server.livenessProbe.enabled` | Enable livenessProbe on server nodes | `true` |
| `server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` |
| `server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` |
| `server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` |
| `server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
| `server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `server.readinessProbe.enabled` | Enable readinessProbe on server nodes | `true` |
| `server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` |
| `server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `20` |
| `server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `server.startupProbe.enabled` | Enable startupProbe | `false` |
| `server.startupProbe.path` | Path to check for startupProbe | `/` |
| `server.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` |
| `server.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
| `server.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
| `server.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` |
| `server.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `server.customLivenessProbe` | Server custom livenessProbe that overrides the default one | `{}` |
| `server.customReadinessProbe` | Server custom readinessProbe that overrides the default one | `{}` |
| `server.customStartupProbe` | Server custom startupProbe that overrides the default one | `{}` |
| `server.resources.limits` | The resources limits for the server containers | `{}` |
| `server.resources.requests` | The requested resources for the server containers | `{}` |
| `server.podSecurityContext.enabled` | Enabled server pods' Security Context | `true` |
| `server.podSecurityContext.fsGroup` | Set server pod's Security Context fsGroup | `1001` |
| `server.containerSecurityContext.enabled` | Enabled server containers' Security Context | `true` |
| `server.containerSecurityContext.runAsUser` | Set server containers' Security Context runAsUser | `1001` |
| `server.containerSecurityContext.runAsNonRoot` | Set server containers' Security Context runAsNonRoot | `true` |
| `server.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `true` |
| `server.rbac.create` | Create RBAC resources for the Argo workflows server | `true` |
| `server.extraArgs` | Extra arguments for the server command line | `""` |
| `server.auth.enabled` | Enable authentication | `true` |
| `server.auth.mode` | Set authentication mode. Either `server`, `client` or `sso`. | `client` |
| `server.auth.sso.enabled` | Enable SSO configuration for the server auth mode | `false` |
| `server.auth.sso.issuer` | Root URL for the OIDC identity provider | `""` |
| `server.auth.sso.clientId.name` | Name of the secret containing the OIDC client ID | `""` |
| `server.auth.sso.clientId.key` | Key in the secret to obtain the OIDC client ID | `""` |
| `server.auth.sso.clientSecret.name` | Name of the secret containing the OIDC client secret | `""` |
| `server.auth.sso.clientSecret.key` | Key in the secret to obtain the OIDC client secret | `""` |
| `server.auth.sso.redirectUrl` | The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback. | `""` |
| `server.auth.sso.rbac.enabled` | Create RBAC resources for SSO | `true` |
| `server.auth.sso.rbac.secretWhitelist` | Restricts the secrets that the server can read | `[]` |
| `server.auth.sso.scopes` | Scopes requested from the SSO ID provider | `[]` |
| `server.clusterWorkflowTemplates.enabled` | Create ClusterRole and CRB for the controoler to access ClusterWorkflowTemplates | `true` |
| `server.clusterWorkflowTemplates.enableEditing` | Give the server permissions to edit ClusterWorkflowTemplates | `true` |
| `server.pdb.enabled` | Create Pod Disruption Budget for the server component | `false` |
| `server.pdb.minAvailable` | Sets the min number of pods availables for the Pod Disruption Budget | `1` |
| `server.pdb.maxUnavailable` | Sets the max number of pods unavailable for the Pod Disruption Budget | `1` |
| `server.secure` | Run Argo server in secure mode | `false` |
| `server.baseHref` | Base href of the Argo Workflows deployment | `/` |
| `server.containerPorts.web` | argo Server container port | `2746` |
| `server.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `server.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `server.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
| `server.command` | Override default container command (useful when using custom images) | `[]` |
| `server.args` | Override default container args (useful when using custom images) | `[]` |
| `server.hostAliases` | server pods host aliases | `[]` |
| `server.podLabels` | Extra labels for server pods | `{}` |
| `server.podAnnotations` | Annotations for server pods | `{}` |
| `server.podAffinityPreset` | Pod affinity preset. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `server.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
| `server.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `server.nodeAffinityPreset.key` | Node label key to match. Ignored if `server.affinity` is set | `""` |
| `server.nodeAffinityPreset.values` | Node label values to match. Ignored if `server.affinity` is set | `[]` |
| `server.affinity` | Affinity for server pods assignment | `{}` |
| `server.nodeSelector` | Node labels for server pods assignment | `{}` |
| `server.tolerations` | Tolerations for server pods assignment | `[]` |
| `server.updateStrategy.type` | server statefulset strategy type | `RollingUpdate` |
| `server.topologySpreadConstraints` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in | `[]` |
| `server.schedulerName` | Alternate scheduler for the server deployment | `""` |
| `server.priorityClassName` | server pods' priorityClassName | `""` |
| `server.lifecycleHooks` | for the server container(s) to automate configuration before or after startup | `{}` |
| `server.extraEnvVars` | Array with extra environment variables to add to server nodes | `[]` |
| `server.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for server nodes | `""` |
| `server.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for server nodes | `""` |
| `server.extraVolumes` | Optionally specify extra list of additional volumes for the server pod(s) | `[]` |
| `server.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the server container(s) | `[]` |
| `server.sidecars` | Add additional sidecar containers to the server pod(s) | `{}` |
| `server.initContainers` | Add additional init containers to the server pod(s) | `{}` |
| `server.service.type` | server service type | `ClusterIP` |
| `server.service.ports.http` | server service HTTP port | `80` |
| `server.service.nodePorts.http` | Node port for HTTP | `""` |
| `server.service.clusterIP` | server service Cluster IP | `""` |
| `server.service.loadBalancerIP` | server service Load Balancer IP | `""` |
| `server.service.loadBalancerSourceRanges` | server service Load Balancer sources | `[]` |
| `server.service.externalTrafficPolicy` | server service external traffic policy | `Cluster` |
| `server.service.annotations` | Additional custom annotations for server service | `{}` |
| `server.service.extraPorts` | Extra port to expose on the server service | `[]` |
### Argo Workflows Controller configuration parameters
| Name | Description | Value |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
| `controller.image.registry` | controller image registry | `docker.io` |
| `controller.image.repository` | controller image repository | `bitnami/argo-workflow-controller` |
| `controller.image.tag` | controller image tag (immutable tags are recommended) | `3.2.8-scratch-r0` |
| `controller.image.pullPolicy` | controller image pull policy | `IfNotPresent` |
| `controller.image.pullSecrets` | controller image pull secrets | `[]` |
| `controller.replicaCount` | Number of controller replicas to deploy | `1` |
| `controller.livenessProbe.enabled` | Enable livenessProbe on controller nodes | `true` |
| `controller.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `90` |
| `controller.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
| `controller.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `30` |
| `controller.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
| `controller.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `controller.readinessProbe.enabled` | Enable readinessProbe on controller nodes | `true` |
| `controller.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `30` |
| `controller.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `60` |
| `controller.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `30` |
| `controller.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `controller.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `controller.startupProbe.enabled` | Enable startupProbe | `false` |
| `controller.startupProbe.path` | Path to check for startupProbe | `/` |
| `controller.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` |
| `controller.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
| `controller.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
| `controller.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` |
| `controller.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `controller.customLivenessProbe` | Controller custom livenessProbe that overrides the default one | `{}` |
| `controller.customReadinessProbe` | Controller custom readinessProbe that overrides the default one | `{}` |
| `controller.customStartupProbe` | Controller custom startupProbe that overrides the default one | `{}` |
| `controller.resources.limits` | The resources limits for the controller containers | `{}` |
| `controller.resources.requests` | The requested resources for the controller containers | `{}` |
| `controller.podSecurityContext.enabled` | Enabled controller pods' Security Context | `true` |
| `controller.podSecurityContext.fsGroup` | Set controller pod's Security Context fsGroup | `1001` |
| `controller.containerSecurityContext.enabled` | Enabled controller containers' Security Context | `true` |
| `controller.containerSecurityContext.runAsUser` | Set controller containers' Security Context runAsUser | `1001` |
| `controller.containerSecurityContext.runAsNonRoot` | Set controller containers' Security Context runAsNonRoot | `true` |
| `controller.containerPorts.metrics` | Port to expose controller metrics | `9090` |
| `controller.containerPorts.telemetry` | Port to expose controller telemetry | `8081` |
| `controller.rbac.create` | Create RBAC resources for the Argo workflows controller | `true` |
| `controller.existingConfigMap` | | `""` |
| `controller.extraArgs` | Extra arguments for the controller command line | `""` |
| `controller.config` | Controller configmap configuration content | `{}` |
| `controller.instanceID.enabled` | Enable submission filtering based on instanceID attribute. Requires to set instanceID.useReleaseName or instanceID.explicitID | `false` |
| `controller.instanceID.useReleaseName` | Use the release name to filter submissions | `false` |
| `controller.instanceID.explicitID` | Filter submissions based on an explicit instance ID | `""` |
| `controller.containerRuntimeExecutor` | Specifies the container runtime for the executor | `k8sapi` |
| `controller.clusterWorkflowTemplates.enabled` | Whether to create a ClusterRole and Cluster Role Binding to access ClusterWokflowTemplates resources | `true` |
| `controller.metrics.enabled` | Enable controller metrics exporter | `false` |
| `controller.metrics.path` | Path to expose controller metrics | `/metrics` |
| `controller.metrics.serviceMonitor.enabled` | Enable prometheus service monitor configuration | `false` |
| `controller.telemetry.enabled` | Enable telemetry for the controller | `false` |
| `controller.telemetry.path` | Path to expose telemetry information | `/telemetry` |
| `controller.workflowWorkers` | Number of workflow workers to deploy | `32` |
| `controller.podWorkers` | Number of pod workers to deploy | `32` |
| `controller.workflowNamespaces` | Namespaces allowed to run workflows | `["default"]` |
| `controller.logging.level` | Level for the controller logging | `info` |
| `controller.logging.globalLevel` | Global logging level for the controller | `0` |
| `controller.pdb.enabled` | Create Pod Disruption Budget for the controller component | `false` |
| `controller.pdb.minAvailable` | Sets the min number of pods availables for the Pod Disruption Budget | `1` |
| `controller.pdb.maxUnavailable` | Sets the max number of pods unavailable for the Pod Disruption Budget | `1` |
| `controller.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `controller.serviceAccount.name` | Name for the service account | `""` |
| `controller.serviceAccount.automountServiceAccountToken` | Automount service account token for the controller service account | `true` |
| `controller.command` | Override default container command (useful when using custom images) | `[]` |
| `controller.args` | Override default container args (useful when using custom images) | `[]` |
| `controller.hostAliases` | controller pods host aliases | `[]` |
| `controller.podLabels` | Extra labels for controller pods | `{}` |
| `controller.podAnnotations` | Annotations for controller pods | `{}` |
| `controller.podAffinityPreset` | Pod affinity preset. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `controller.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
| `controller.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `controller.nodeAffinityPreset.key` | Node label key to match. Ignored if `controller.affinity` is set | `""` |
| `controller.nodeAffinityPreset.values` | Node label values to match. Ignored if `controller.affinity` is set | `[]` |
| `controller.affinity` | Affinity for controller pods assignment | `{}` |
| `controller.nodeSelector` | Node labels for controller pods assignment | `{}` |
| `controller.tolerations` | Tolerations for controller pods assignment | `[]` |
| `controller.updateStrategy.type` | controller statefulset strategy type | `RollingUpdate` |
| `controller.topologySpreadConstraints` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in | `[]` |
| `controller.schedulerName` | Alternate scheduler for the server controller | `""` |
| `controller.priorityClassName` | controller pods' priorityClassName | `""` |
| `controller.lifecycleHooks` | for the controller container(s) to automate configuration before or after startup | `{}` |
| `controller.extraEnvVars` | Array with extra environment variables to add to controller nodes | `[]` |
| `controller.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for controller nodes | `""` |
| `controller.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for controller nodes | `""` |
| `controller.extraVolumes` | Optionally specify extra list of additional volumes for the controller pod(s) | `[]` |
| `controller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the controller container(s) | `[]` |
| `controller.sidecars` | Add additional sidecar containers to the controller pod(s) | `{}` |
| `controller.initContainers` | Add additional init containers to the controller pod(s) | `{}` |
| `controller.service.type` | controller service type | `ClusterIP` |
| `controller.service.ports.metrics` | Metrics port for the controller | `8080` |
| `controller.service.ports.telemetry` | Telemetry port for the controller | `8081` |
| `controller.service.nodePorts.metrics` | Node port for HTTP | `""` |
| `controller.service.nodePorts.telemetry` | Node port for HTTPS | `""` |
| `controller.service.clusterIP` | controller service Cluster IP | `""` |
| `controller.service.loadBalancerIP` | controller service Load Balancer IP | `""` |
| `controller.service.loadBalancerSourceRanges` | controller service Load Balancer sources | `[]` |
| `controller.service.externalTrafficPolicy` | controller service external traffic policy | `Cluster` |
| `controller.service.annotations` | Additional custom annotations for controller service | `{}` |
| `controller.service.extraPorts` | Extra port to expose on the controller service | `[]` |
| Name | Description | Value |
| ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
| `controller.image.registry` | controller image registry | `docker.io` |
| `controller.image.repository` | controller image repository | `bitnami/argo-workflow-controller` |
| `controller.image.tag` | controller image tag (immutable tags are recommended) | `3.2.9-scratch-r0` |
| `controller.image.pullPolicy` | controller image pull policy | `IfNotPresent` |
| `controller.image.pullSecrets` | controller image pull secrets | `[]` |
| `controller.replicaCount` | Number of controller replicas to deploy | `1` |
| `controller.livenessProbe.enabled` | Enable livenessProbe on controller nodes | `true` |
| `controller.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `90` |
| `controller.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
| `controller.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `30` |
| `controller.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
| `controller.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `controller.readinessProbe.enabled` | Enable readinessProbe on controller nodes | `true` |
| `controller.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `30` |
| `controller.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `60` |
| `controller.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `30` |
| `controller.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `controller.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `controller.startupProbe.enabled` | Enable startupProbe | `false` |
| `controller.startupProbe.path` | Path to check for startupProbe | `/` |
| `controller.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` |
| `controller.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
| `controller.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
| `controller.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` |
| `controller.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `controller.customLivenessProbe` | Controller custom livenessProbe that overrides the default one | `{}` |
| `controller.customReadinessProbe` | Controller custom readinessProbe that overrides the default one | `{}` |
| `controller.customStartupProbe` | Controller custom startupProbe that overrides the default one | `{}` |
| `controller.resources.limits` | The resources limits for the controller containers | `{}` |
| `controller.resources.requests` | The requested resources for the controller containers | `{}` |
| `controller.podSecurityContext.enabled` | Enabled controller pods' Security Context | `true` |
| `controller.podSecurityContext.fsGroup` | Set controller pod's Security Context fsGroup | `1001` |
| `controller.containerSecurityContext.enabled` | Enabled controller containers' Security Context | `true` |
| `controller.containerSecurityContext.runAsUser` | Set controller containers' Security Context runAsUser | `1001` |
| `controller.containerSecurityContext.runAsNonRoot` | Set controller containers' Security Context runAsNonRoot | `true` |
| `controller.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `true` |
| `controller.containerPorts.metrics` | Port to expose controller metrics | `9090` |
| `controller.containerPorts.telemetry` | Port to expose controller telemetry | `8081` |
| `controller.rbac.create` | Create RBAC resources for the Argo workflows controller | `true` |
| `controller.existingConfigMap` | | `""` |
| `controller.extraArgs` | Extra arguments for the controller command line | `""` |
| `controller.config` | Controller configmap configuration content | `{}` |
| `controller.instanceID.enabled` | Enable submission filtering based on instanceID attribute. Requires to set instanceID.useReleaseName or instanceID.explicitID | `false` |
| `controller.instanceID.useReleaseName` | Use the release name to filter submissions | `false` |
| `controller.instanceID.explicitID` | Filter submissions based on an explicit instance ID | `""` |
| `controller.containerRuntimeExecutor` | Specifies the container runtime for the executor | `k8sapi` |
| `controller.clusterWorkflowTemplates.enabled` | Whether to create a ClusterRole and Cluster Role Binding to access ClusterWokflowTemplates resources | `true` |
| `controller.metrics.enabled` | Enable controller metrics exporter | `false` |
| `controller.metrics.path` | Path to expose controller metrics | `/metrics` |
| `controller.metrics.serviceMonitor.enabled` | Enable prometheus service monitor configuration | `false` |
| `controller.telemetry.enabled` | Enable telemetry for the controller | `false` |
| `controller.telemetry.path` | Path to expose telemetry information | `/telemetry` |
| `controller.workflowWorkers` | Number of workflow workers to deploy | `32` |
| `controller.podWorkers` | Number of pod workers to deploy | `32` |
| `controller.workflowNamespaces` | Namespaces allowed to run workflows | `["default"]` |
| `controller.logging.level` | Level for the controller logging | `info` |
| `controller.logging.globalLevel` | Global logging level for the controller | `0` |
| `controller.pdb.enabled` | Create Pod Disruption Budget for the controller component | `false` |
| `controller.pdb.minAvailable` | Sets the min number of pods availables for the Pod Disruption Budget | `1` |
| `controller.pdb.maxUnavailable` | Sets the max number of pods unavailable for the Pod Disruption Budget | `1` |
| `controller.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `controller.serviceAccount.name` | Name for the service account | `""` |
| `controller.serviceAccount.automountServiceAccountToken` | Automount service account token for the controller service account | `true` |
| `controller.command` | Override default container command (useful when using custom images) | `[]` |
| `controller.args` | Override default container args (useful when using custom images) | `[]` |
| `controller.hostAliases` | controller pods host aliases | `[]` |
| `controller.podLabels` | Extra labels for controller pods | `{}` |
| `controller.podAnnotations` | Annotations for controller pods | `{}` |
| `controller.podAffinityPreset` | Pod affinity preset. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `controller.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
| `controller.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `controller.nodeAffinityPreset.key` | Node label key to match. Ignored if `controller.affinity` is set | `""` |
| `controller.nodeAffinityPreset.values` | Node label values to match. Ignored if `controller.affinity` is set | `[]` |
| `controller.affinity` | Affinity for controller pods assignment | `{}` |
| `controller.nodeSelector` | Node labels for controller pods assignment | `{}` |
| `controller.tolerations` | Tolerations for controller pods assignment | `[]` |
| `controller.updateStrategy.type` | controller statefulset strategy type | `RollingUpdate` |
| `controller.topologySpreadConstraints` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in | `[]` |
| `controller.schedulerName` | Alternate scheduler for the server controller | `""` |
| `controller.priorityClassName` | controller pods' priorityClassName | `""` |
| `controller.lifecycleHooks` | for the controller container(s) to automate configuration before or after startup | `{}` |
| `controller.extraEnvVars` | Array with extra environment variables to add to controller nodes | `[]` |
| `controller.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for controller nodes | `""` |
| `controller.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for controller nodes | `""` |
| `controller.extraVolumes` | Optionally specify extra list of additional volumes for the controller pod(s) | `[]` |
| `controller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the controller container(s) | `[]` |
| `controller.sidecars` | Add additional sidecar containers to the controller pod(s) | `{}` |
| `controller.initContainers` | Add additional init containers to the controller pod(s) | `{}` |
| `controller.service.type` | controller service type | `ClusterIP` |
| `controller.service.ports.metrics` | Metrics port for the controller | `8080` |
| `controller.service.ports.telemetry` | Telemetry port for the controller | `8081` |
| `controller.service.nodePorts.metrics` | Node port for HTTP | `""` |
| `controller.service.nodePorts.telemetry` | Node port for HTTPS | `""` |
| `controller.service.clusterIP` | controller service Cluster IP | `""` |
| `controller.service.loadBalancerIP` | controller service Load Balancer IP | `""` |
| `controller.service.loadBalancerSourceRanges` | controller service Load Balancer sources | `[]` |
| `controller.service.externalTrafficPolicy` | controller service external traffic policy | `Cluster` |
| `controller.service.annotations` | Additional custom annotations for controller service | `{}` |
| `controller.service.extraPorts` | Extra port to expose on the controller service | `[]` |
### Executor configuration section
| Name | Description | Value |
| ------------------------------------------- | ------------------------------------------------------------- | ---------------------------- |
| `executor.image.registry` | executor image registry | `docker.io` |
| `executor.image.repository` | executor image repository | `bitnami/argo-workflow-exec` |
| `executor.image.tag` | executor image tag (immutable tags are recommended) | `3.2.7-debian-10-r7` |
| `executor.image.pullPolicy` | executor image pull policy | `Always` |
| `executor.image.pullSecrets` | executor image pull secrets | `[]` |
| `executor.resources.limits` | The resources limits for the init container | `{}` |
| `executor.resources.requests` | The requested resources for the init container | `{}` |
| `executor.extraEnvVars` | Array with extra environment variables to add to server nodes | `[]` |
| `executor.containerSecurityContext.enabled` | Enabled executor pods' Security Context | `true` |
| `executor.containerSecurityContext.fsGroup` | Set executor pod's Security Context fsGroup | `1001` |
| Name | Description | Value |
| ---------------------------------------------------------- | ------------------------------------------------------------- | ---------------------------- |
| `executor.image.registry` | executor image registry | `docker.io` |
| `executor.image.repository` | executor image repository | `bitnami/argo-workflow-exec` |
| `executor.image.tag` | executor image tag (immutable tags are recommended) | `3.2.8-debian-10-r24` |
| `executor.image.pullPolicy` | executor image pull policy | `Always` |
| `executor.image.pullSecrets` | executor image pull secrets | `[]` |
| `executor.resources.limits` | The resources limits for the init container | `{}` |
| `executor.resources.requests` | The requested resources for the init container | `{}` |
| `executor.extraEnvVars` | Array with extra environment variables to add to server nodes | `[]` |
| `executor.containerSecurityContext.enabled` | Enabled executor pods' Security Context | `true` |
| `executor.containerSecurityContext.fsGroup` | Set executor pod's Security Context fsGroup | `1001` |
| `executor.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Context | `true` |
### Traffic Exposure Parameters
@@ -310,6 +318,7 @@ The command removes all the Kubernetes components associated with the chart and
| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
| `ingress.secrets` | Custom TLS certificates as secrets | `[]` |
### Workflows configuration
| Name | Description | Value |
@@ -319,6 +328,7 @@ The command removes all the Kubernetes components associated with the chart and
| `workflows.serviceAccount.automountServiceAccountToken` | Automount service account token for the workflows service account | `true` |
| `workflows.rbac.create` | Whether to create RBAC resource to run workflows | `true` |
### PostgreSQL subchart
| Name | Description | Value |
@@ -329,6 +339,7 @@ The command removes all the Kubernetes components associated with the chart and
| `postgresql.auth.database` | PortgreSQL database name | `bn_argo_workflows` |
| `postgresql.auth.password` | PortgreSQL database password | `""` |
### MySQL subchart
| Name | Description | Value |
@@ -339,6 +350,7 @@ The command removes all the Kubernetes components associated with the chart and
| `mysql.auth.database` | MySQL database name | `bn_argo_workflows` |
| `mysql.auth.password` | MySQL database password | `""` |
### External Database configuration
| Name | Description | Value |
@@ -352,6 +364,7 @@ The command removes all the Kubernetes components associated with the chart and
| `externalDatabase.existingSecret` | The name of an existing secret with database credentials | `""` |
| `externalDatabase.type` | Either postgresql or mysql | `""` |
See https://github.com/bitnami-labs/readme-generator-for-helm to create the table
The above parameters map to the env variables defined in [bitnami/argo-workflow-cli](https://github.com/bitnami/bitnami-docker-argo-workflow-cli). For more information please refer to the [bitnami/argo-workflow-cli](https://github.com/bitnami/bitnami-docker-argo-workflow-cli) image documentation.
bitnami/argo-workflows/values.yaml
+6
View File
@@ -161,11 +161,13 @@ server:
## @param server.containerSecurityContext.enabled Enabled server containers' Security Context
## @param server.containerSecurityContext.runAsUser Set server containers' Security Context runAsUser
## @param server.containerSecurityContext.runAsNonRoot Set server containers' Security Context runAsNonRoot
## @param server.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte
##
containerSecurityContext:
enabled: true
runAsUser: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
## Create RBAC resources for the Argo workflows server
## @param server.rbac.create Create RBAC resources for the Argo workflows server
@@ -563,11 +565,13 @@ controller:
## @param controller.containerSecurityContext.enabled Enabled controller containers' Security Context
## @param controller.containerSecurityContext.runAsUser Set controller containers' Security Context runAsUser
## @param controller.containerSecurityContext.runAsNonRoot Set controller containers' Security Context runAsNonRoot
## @param controller.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte
##
containerSecurityContext:
enabled: true
runAsUser: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
## Server container port
## @param controller.containerPorts.metrics Port to expose controller metrics
@@ -989,10 +993,12 @@ executor:
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param executor.containerSecurityContext.enabled Enabled executor pods' Security Context
## @param executor.containerSecurityContext.fsGroup Set executor pod's Security Context fsGroup
## @param executor.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Context
##
containerSecurityContext:
enabled: true
fsGroup: 1001
readOnlyRootFilesystem: true
## @section Traffic Exposure Parameters
##