github.com/Azure/aad-pod-identity@v1.8.17/charts/aad-pod-identity/values.yaml (about)

     1  # Default values for aad-pod-identity-helm.
     2  # This is a YAML-formatted file.
     3  # Declare variables to be passed into your templates.
     4  
     5  nameOverride: ""
     6  fullnameOverride: ""
     7  
     8  image:
     9    repository: mcr.microsoft.com/oss/azure/aad-pod-identity
    10    imagePullPolicy: IfNotPresent
    11  
    12  # One or more secrets to be used when pulling images
    13  # imagePullSecrets:
    14  #   - name: myRegistryKeySecretName
    15  
    16  # https://github.com/Azure/aad-pod-identity#4-optional-match-pods-in-the-namespace
    17  # By default, AAD Pod Identity matches pods to identities across namespaces.
    18  # To match only pods in the namespace containing AzureIdentity set this to true.
    19  forceNamespaced: "false"
    20  
    21  # When NMI runs on a node where MIC is running, then MIC token request call is also
    22  # intercepted by NMI. MIC can't get a valid token as to initialize and then
    23  # assign the identity. Installing an exception for MIC would ensure all token requests
    24  # for MIC pods directly go to IMDS and not go through the pod-identity validation
    25  # https://github.com/Azure/aad-pod-identity/blob/master/docs/readmes/README.app-exception.md
    26  installMICException: "true"
    27  
    28  ## If using a separate service principal for aad-pod-identity instead of cluster service principal specify the following
    29  ## (The chart will perform the base64 encoding for you for values that are stored in secrets.)
    30  adminsecret: {}
    31  #   cloud: <cloud environment name>
    32  #   subscriptionID: <subscription id>
    33  #   resourceGroup: <node resource group>
    34  #   vmType: <`standard` for normal virtual machine nodes, and `vmss` for cluster deployed with a virtual machine scale set>
    35  #   tenantID: <service principal tenant id>
    36  #   clientID: <service principal client id. Set to `msi` when using a User Managed Identity>
    37  #   clientSecret: <service principal client secret. Set to `msi` when using a User Managed Identity>
    38  #   useMSI: <set to true when using a User Managed Identity>
    39  #   userAssignedMSIClientID: <client id for the User Managed Identity>
    40  # Operation mode for pod-identity. Default is standard mode that has MIC doing identity assignment
    41  # Allowed values: "standard", "managed"
    42  operationMode: "standard"
    43  
    44  mic:
    45    image: mic
    46    tag: v1.8.17
    47  
    48    # ref: https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical
    49    priorityClassName: ""
    50  
    51    # log level. Uses V logs (klog)
    52    logVerbosity: 0
    53    loggingFormat: ""
    54  
    55    replicas: 2
    56  
    57    resources:
    58      limits:
    59        cpu: 200m
    60        memory: 1024Mi
    61      requests:
    62        cpu: 100m
    63        memory: 256Mi
    64  
    65    podAnnotations: {}
    66  
    67    podLabels: {}
    68  
    69    ## Node labels for pod assignment
    70    ## aad-pod-identity is currently only supported on linux
    71    nodeSelector:
    72      kubernetes.io/os: linux
    73  
    74    tolerations: []
    75      # - key: "CriticalAddonsOnly"
    76      #   operator: "Exists"
    77  
    78    # Affinity rules to apply to the mic deployment.
    79    # Uses an anti-affinity rule to prefer not to co-locate pods on the same node as default.
    80    # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
    81    affinity:
    82      podAntiAffinity:
    83        preferredDuringSchedulingIgnoredDuringExecution:
    84        - weight: 1
    85          podAffinityTerm:
    86            topologyKey: kubernetes.io/hostname
    87            labelSelector:
    88              matchLabels:
    89                app.kubernetes.io/component: mic
    90  
    91    # Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.
    92    # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
    93    topologySpreadConstraints: []
    94      # - maxSkew: 1
    95      #   topologyKey: failure-domain.beta.kubernetes.io/zone
    96      #   whenUnsatisfiable: DoNotSchedule
    97      #   labelSelector:
    98      #     matchLabels:
    99      #       app.kubernetes.io/component: mic
   100  
   101    # Limit the number of concurrent disruptions that your application experiences,
   102    # allowing for higher availability while permitting the cluster administrator to manage the clusters nodes.
   103    # ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
   104    podDisruptionBudget: {}
   105      # minAvailable: 1
   106  
   107    leaderElection:
   108      # Override leader election instance name (default is 'hostname')
   109      instance: ""
   110      # Override the namespace to create leader election objects (default is default namespace)
   111      namespace: ""
   112      # Override leader election name (default is aad-pod-identity-mic)
   113      name: ""
   114      # Override leader election duration (default is 15s)
   115      duration: ""
   116  
   117    # Override http liveliness probe port (default is 8080)
   118    probePort: ""
   119  
   120    # Override interval in seconds at which sync loop should periodically check for errors and reconcile (default is 3600s)
   121    syncRetryDuration: ""
   122  
   123    # Override the defult value of immutable identities.
   124    immutableUserMSIs: []
   125      # Example of MSIs (should be replaced with the real client ids)
   126      #- "00000000-0000-0000-0000-000000000000"
   127      #- "11111111-1111-1111-1111-111111111111"
   128  
   129    # https://github.com/Azure/aad-pod-identity/blob/master/docs/readmes/README.featureflags.md#batch-create-delete-flag
   130    # default value is 20
   131    createDeleteBatch: ""
   132  
   133    # https://github.com/Azure/aad-pod-identity/blob/master/docs/readmes/README.featureflags.md#client-qps-flag
   134    # default value is 5
   135    clientQps: ""
   136  
   137    # default value is 8888
   138    # prometheus port for metrics
   139    prometheusPort: ""
   140  
   141    # cloud configuration used to authenticate with Azure
   142    cloudConfig: "/etc/kubernetes/azure.json"
   143  
   144    # Configures for a custom cloud per the example here:
   145    # https://azure.github.io/aad-pod-identity/docs/configure/custom_cloud/
   146    customCloud:
   147      enabled: false
   148      configPath: "/etc/kubernetes/akscustom.json"
   149  
   150    # The maximum retry of UpdateUserMSI call. MIC updates all the identities in a batch. If a single identity contains an error
   151    # or is invalid, then the entire operation fails. Configuring this flag will make MIC retry by removing the erroneous identities
   152    # returned in the error
   153    # Default value is 2.
   154    updateUserMSIMaxRetry: ""
   155  
   156    # The duration to wait before retrying UpdateUserMSI (batch assigning/un-assigning identity from VM/VMSS) in case of errors
   157    # Default value is 1s
   158    updateUserMSIRetryInterval: ""
   159  
   160    # The interval between reconciling identity assignment on Azure based on an existing list of AzureAssignedIdentities
   161    # Default value is 3m
   162    identityAssignmentReconcileInterval: ""
   163  
   164  nmi:
   165    image: nmi
   166    tag: v1.8.17
   167  
   168    # ref: https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical
   169    priorityClassName: ""
   170  
   171    # log level. Uses V logs (klog)
   172    logVerbosity: 0
   173    loggingFormat: ""
   174  
   175    resources:
   176      limits:
   177        cpu: 200m
   178        memory: 512Mi
   179      requests:
   180        cpu: 100m
   181        memory: 256Mi
   182  
   183    updateStrategy:
   184      type: RollingUpdate
   185      rollingUpdate:
   186        maxUnavailable: 1
   187  
   188    podAnnotations: {}
   189  
   190    podLabels: {}
   191  
   192    ## Node labels for pod assignment
   193    ## aad-pod-identity is currently only supported on linux
   194    nodeSelector:
   195      kubernetes.io/os: linux
   196  
   197    ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
   198    ## An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
   199    tolerations:
   200      - operator: "Exists"
   201  
   202    # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
   203    affinity: {}
   204      # nodeAffinity:
   205      #   preferredDuringSchedulingIgnoredDuringExecution:
   206      #     - weight: 1
   207      #       preference:
   208      #         matchExpressions:
   209      #           - key: kubernetes.azure.com/mode
   210      #             operator: In
   211      #             values:
   212      #               - system
   213  
   214    # Override iptables update interval in seconds (default is 60)
   215    ipTableUpdateTimeIntervalInSeconds: ""
   216  
   217    # Override mic namespace to short circuit MIC token requests (default is default namespace)
   218    micNamespace: ""
   219  
   220    # Override http liveliness probe port (default is 8080)
   221    probePort: "8085"
   222  
   223    # Override number of retries in NMI to find assigned identity in CREATED state (default is 16)
   224    retryAttemptsForCreated: ""
   225  
   226    # Override number of retries in NMI to find assigned identity in ASSIGNED state (default is 4)
   227    retryAttemptsForAssigned: ""
   228  
   229    # Override retry interval to find assigned identities in seconds (default is 5)
   230    findIdentityRetryIntervalInSeconds: ""
   231  
   232    # Enable scale features - https://github.com/Azure/aad-pod-identity/blob/master/docs/readmes/README.featureflags.md#enable-scale-features-flag
   233    # Accepted values are true/false. Default is true for v1.8.1+.
   234    enableScaleFeatures: true
   235  
   236    # default value is 9090
   237    # prometheus port for metrics
   238    prometheusPort: ""
   239  
   240    # https://github.com/Azure/aad-pod-identity/blob/master/docs/readmes/README.featureflags.md#block-instance-metadata-flag
   241    # default is false
   242    blockInstanceMetadata: ""
   243  
   244    # https://github.com/Azure/aad-pod-identity/blob/master/docs/readmes/README.featureflags.md#metadata-header-required-flag
   245    # default is true
   246    metadataHeaderRequired: true
   247  
   248    # enable running aad-pod-identity on clusters with kubenet
   249    # default is false
   250    allowNetworkPluginKubenet: false
   251  
   252    # Path to kubelet default config.
   253    # default is /etc/default/kubelet
   254    kubeletConfig: "/etc/default/kubelet"
   255  
   256    # Set retry-after header in the NMI responses when the identity is still being assigned.
   257    setRetryAfterHeader: false
   258  
   259    # Enable/Disable deletion of conntrack entries for pre-existing connections to metadata endpoint
   260    enableConntrackDeletion: false
   261  
   262  rbac:
   263    enabled: true
   264    # NMI requires permissions to get secrets when service principal (type: 1) is used in AzureIdentity.
   265    # If using only MSI (type: 0) in AzureIdentity, secret get permission can be disabled by setting this to false.
   266    allowAccessToSecrets: true
   267    pspEnabled: false
   268    # If set to true, then view and edit cluster roles will be created with annotations
   269    # that agrigate to the admin, edit and view built-in cluster roles. These roles will
   270    # be able to create the necessary resources to allow pod identity binding on pods.
   271    createUserFacingClusterRoles: false
   272  
   273  # Create azure identities and bindings
   274  # This is a map with the AzureIdentityName being the key and the rest of the blob as value in accordance
   275  # to helm best practices: https://helm.sh/docs/chart_best_practices/values/#consider-how-users-will-use-your-values
   276  azureIdentities:
   277    # "azure-identity":
   278    #   # if not defined, then the azure identity will be deployed in the same namespace as the chart
   279    #   namespace: ""
   280    #   # if not defined, then the name of azure identity will be the same as the key
   281    #   name: ""
   282    #   # type 0: User-assigned identity, type 1: Service Principal, type 2: Service principal with certificate
   283    #   type: 0
   284    #   # /subscriptions/subscription-id/resourcegroups/resource-group/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity-name
   285    #   # Required for type 0
   286    #   resourceID: ""
   287    #   # Required for type 0, 1 and 2
   288    #   clientID: ""
   289    #   # Required for type 1 and 2
   290    #   tenantID: ""
   291    #   # Required for type 1 and 2
   292    #   clientPassword: "{\"name\":\"<secret name>\",\"namespace\":\"<secret namespace>\"}"
   293    #   # Optional for type 1 and 2 (multi-tenant)
   294    #   auxiliaryTenantIDs: []
   295    #   binding:
   296    #     name: "azure-identity-binding"
   297    #     # The selector will also need to be included in labels for app deployment
   298    #     selector: "demo"
   299  
   300  # If provided, the userAgent string will be appended to the pod identity user agents for all
   301  # ADAL, ARM and Kube API server requests.
   302  customUserAgent: ""