charts/koment/values.yaml
1
image:
2
# -- Container image repository.
3
repository: ghcr.io/koment-dev/koment
4
# -- Image tag. Defaults to the chart's appVersion.
5
tag: ""
6
# -- Image digest. Set it to pin the exact image a tag currently points at.
7
digest: ""
8
# -- Image pull policy.
9
pullPolicy: IfNotPresent
11
# -- Number of service replicas. Each holds its own rebuilt snapshot.
12
replicaCount: 1
14
# -- Repositories this service assigns identity to and serves. `id` is the
15
# stable identity in URLs and credentials; moving a repository never changes it.
16
repositories:
17
- id: koment
18
name: koment
19
provider: github
20
remote: koment-dev/koment
21
defaultBranch: main
22
default: true
24
# -- How often each repository's branch is resolved to a new immutable commit
25
# snapshot.
26
syncInterval: 1m
28
github:
29
# -- Name of an existing Secret holding the provider token. Required for
30
# private repositories and for reviewed writes; without it the synchronizer
31
# calls GitHub unauthenticated.
32
existingSecret: ""
33
# -- Key inside `github.existingSecret` that holds the token.
34
tokenKey: github-token
36
auth:
37
# -- CIDRs allowed to assert forwarded human identity. The default trusts only
38
# loopback, so direct cluster traffic fails closed.
39
trustedProxies:
40
- 127.0.0.1/32
41
# -- Allow identities asserted by a trusted proxy to create reviewed
42
# annotations.
43
humanWrites: false
44
# -- Name of an existing Secret holding hashed, scoped agent credentials.
45
existingSecret: ""
46
# -- Key inside `auth.existingSecret` that holds the credentials file.
47
credentialsKey: credentials.yaml
49
serviceAccount:
50
# -- Create a ServiceAccount for the service.
51
create: true
52
# -- Name of the ServiceAccount. Generated from the release when empty.
53
name: ""
54
# -- Annotations to add to the ServiceAccount.
55
annotations: {}
57
service:
58
# -- Service type for the authenticated application port.
59
type: ClusterIP
60
# -- Port serving the UI, MCP, and the health endpoints.
61
port: 8080
63
metrics:
64
# -- Expose Prometheus metrics on their own listener, so an ingress for the
65
# application port cannot expose them with it.
66
enabled: false
67
# -- Port for the metrics listener.
68
port: 9090
69
serviceMonitor:
70
# -- Create a Prometheus Operator ServiceMonitor.
71
enabled: false
72
# -- Scrape interval.
73
interval: 30s
74
# -- Scrape timeout.
75
scrapeTimeout: 10s
76
# -- Extra labels for the ServiceMonitor, used by Prometheus selectors.
77
labels: {}
78
dashboard:
79
# -- Ship the Grafana dashboard as a sidecar-discoverable ConfigMap.
80
enabled: false
81
# -- Label the Grafana sidecar watches for.
82
label: grafana_dashboard
83
# -- Value of the label the Grafana sidecar watches for.
84
labelValue: "1"
86
ingress:
87
# -- Create an Ingress for the application port. It carries authentication;
88
# only the health endpoints are public.
89
enabled: false
90
# -- IngressClass name.
91
className: ""
92
# -- Annotations to add to the Ingress.
93
annotations: {}
94
# -- Ingress hosts and paths.
95
hosts: []
96
# -- Ingress TLS configuration.
97
tls: []
99
networkPolicy:
100
# -- Restrict ingress to the pod to the rules below.
101
enabled: false
102
# -- Ingress rules applied when `networkPolicy.enabled` is set. Empty denies
103
# all inbound traffic.
104
ingress: []
106
podDisruptionBudget:
107
# -- Create a PodDisruptionBudget.
108
enabled: false
109
# -- Minimum available pods during voluntary disruption.
110
minAvailable: 1
112
# -- Resource requests and limits. Snapshots are held in memory, so the memory
113
# limit scales with repository size rather than with request volume.
114
resources:
115
requests:
116
cpu: 10m
117
memory: 32Mi
118
limits:
119
memory: 128Mi
121
# -- Pod-level security context. The image ships a static binary and runs as a
122
# fixed non-root user.
123
podSecurityContext:
124
runAsNonRoot: true
125
runAsUser: 65532
126
runAsGroup: 65532
127
fsGroup: 65532
128
seccompProfile:
129
type: RuntimeDefault
131
# -- Container-level security context.
132
securityContext:
133
allowPrivilegeEscalation: false
134
readOnlyRootFilesystem: true
135
capabilities:
136
drop: [ALL]
138
# -- Node selector for pod assignment.
139
nodeSelector: {}
140
# -- Tolerations for pod assignment.
141
tolerations: []
142
# -- Affinity rules for pod assignment.
143
affinity: {}
144
# -- Topology spread constraints for pod assignment.
145
topologySpreadConstraints: []
146
# -- Annotations to add to the pod.
147
podAnnotations: {}
149
tests:
150
image:
151
# -- Image `helm test` uses to probe the service.
152
repository: curlimages/curl
153
# -- Tag of the test image, recorded alongside the digest that pins it.
154
tag: "8.21.0"
155
# -- Digest that pins the test image, so a moving tag cannot change it.
156
digest: sha256:463eaf6072688fe96ac64fa623fe73e1dbe25d8ad6c34404a669ad3ce1f104b6
157
# -- Pull policy for the test image.
158
pullPolicy: IfNotPresent
159
# -- Numeric user id of the pinned test image. Kubernetes cannot verify
160
# `runAsNonRoot` against an image that names its user instead of numbering
161
# it, so the ids are pinned with the digest they belong to.
162
runAsUser: 101
163
# -- Numeric group id of the pinned test image.
164
runAsGroup: 102