mirror of
https://github.com/bitnami/charts.git
synced 2026-08-10 14:15:55 +08:00
[bitnami/cilium] Add init-container on Relay to wait for Hubble Peers (#29191)
This commit is contained in:
Juan Ariza Toledano
@@ -1,8 +1,12 @@
|
||||
# Changelog
|
||||
|
||||
## 1.0.20 (2024-08-29)
|
||||
## 1.1.0 (2024-09-04)
|
||||
|
||||
* [bitnami/cilium] test: :white_check_mark: Add a wait before goss test ([#29108](https://github.com/bitnami/charts/pull/29108))
|
||||
* [bitnami/cilium] Add init-container on Relay to wait for Hubble Peers ([#29191](https://github.com/bitnami/charts/pull/29191))
|
||||
|
||||
## <small>1.0.20 (2024-08-29)</small>
|
||||
|
||||
* [bitnami/cilium] test: :white_check_mark: Add a wait before goss test (#29108) ([55ce9dd](https://github.com/bitnami/charts/commit/55ce9dd19e222248ff8d5439e501399620b180a9)), closes [#29108](https://github.com/bitnami/charts/issues/29108)
|
||||
|
||||
## <small>1.0.19 (2024-08-29)</small>
|
||||
|
||||
|
||||
@@ -52,4 +52,4 @@ sources:
|
||||
- https://github.com/bitnami/containers/tree/main/bitnami/hubble-relay
|
||||
- https://github.com/bitnami/containers/tree/main/bitnami/hubble-ui
|
||||
- https://github.com/bitnami/containers/tree/main/bitnami/hubble-ui-backend
|
||||
version: 1.0.20
|
||||
version: 1.1.0
|
||||
|
||||
+116
-104
@@ -765,110 +765,122 @@ As an alternative, use one of the preset configurations for pod affinity, pod an
|
||||
|
||||
### Hubble Relay Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
|
||||
| `hubble.relay.enabled` | Enable Hubble Relay | `false` |
|
||||
| `hubble.relay.image.registry` | Hubble Relay image registry | `REGISTRY_NAME` |
|
||||
| `hubble.relay.image.repository` | Hubble Relay image repository | `REPOSITORY_NAME/hubble-relay` |
|
||||
| `hubble.relay.image.digest` | Hubble Relay image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
|
||||
| `hubble.relay.image.pullPolicy` | Hubble Relay image pull policy | `IfNotPresent` |
|
||||
| `hubble.relay.image.pullSecrets` | Hubble Relay image pull secrets | `[]` |
|
||||
| `hubble.relay.image.debug` | Enable Hubble Relay image debug mode | `false` |
|
||||
| `hubble.relay.replicaCount` | Number of Hubble Relay replicas to deploy | `1` |
|
||||
| `hubble.relay.containerPorts.grpc` | Hubble Relay gRPC container port | `4245` |
|
||||
| `hubble.relay.containerPorts.pprof` | Hubble Relay pprof container port | `6062` |
|
||||
| `hubble.relay.containerPorts.gops` | Hubble Relay gops container port | `9893` |
|
||||
| `hubble.relay.containerPorts.metrics` | Hubble Relay metrics container port | `9966` |
|
||||
| `hubble.relay.extraContainerPorts` | Optionally specify extra list of additional ports for Hubble Relay containers | `[]` |
|
||||
| `hubble.relay.livenessProbe.enabled` | Enable livenessProbe on Hubble Relay containers | `true` |
|
||||
| `hubble.relay.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||
| `hubble.relay.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `hubble.relay.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `3` |
|
||||
| `hubble.relay.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
||||
| `hubble.relay.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `hubble.relay.readinessProbe.enabled` | Enable readinessProbe on Hubble Relay containers | `true` |
|
||||
| `hubble.relay.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `hubble.relay.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `hubble.relay.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `3` |
|
||||
| `hubble.relay.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `hubble.relay.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `hubble.relay.startupProbe.enabled` | Enable startupProbe on Hubble Relay containers | `false` |
|
||||
| `hubble.relay.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
|
||||
| `hubble.relay.startupProbe.periodSeconds` | Period seconds for startupProbe | `3` |
|
||||
| `hubble.relay.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `hubble.relay.startupProbe.failureThreshold` | Failure threshold for startupProbe | `20` |
|
||||
| `hubble.relay.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `hubble.relay.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `hubble.relay.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `hubble.relay.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
|
||||
| `hubble.relay.resourcesPreset` | Set Hubble Relay container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if hubble.relay.resources is set (hubble.relay.resources is recommended for production). | `nano` |
|
||||
| `hubble.relay.resources` | Set Hubble Relay container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `hubble.relay.podSecurityContext.enabled` | Enable Hubble Relay pods' Security Context | `true` |
|
||||
| `hubble.relay.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for Hubble Relay pods | `Always` |
|
||||
| `hubble.relay.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.podSecurityContext.supplementalGroups` | Set filesystem extra groups for Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.podSecurityContext.fsGroup` | Set fsGroup in Hubble Relay pods' Security Context | `1001` |
|
||||
| `hubble.relay.containerSecurityContext.enabled` | Enabled Hubble Relay container' Security Context | `true` |
|
||||
| `hubble.relay.containerSecurityContext.seLinuxOptions` | Set SELinux options in Hubble Relay container | `{}` |
|
||||
| `hubble.relay.containerSecurityContext.runAsUser` | Set runAsUser in Hubble Relay container' Security Context | `1001` |
|
||||
| `hubble.relay.containerSecurityContext.runAsGroup` | Set runAsGroup in Hubble Relay container' Security Context | `1001` |
|
||||
| `hubble.relay.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in Hubble Relay container' Security Context | `true` |
|
||||
| `hubble.relay.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in Hubble Relay container' Security Context | `true` |
|
||||
| `hubble.relay.containerSecurityContext.privileged` | Set privileged in Hubble Relay container' Security Context | `false` |
|
||||
| `hubble.relay.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in Hubble Relay container' Security Context | `false` |
|
||||
| `hubble.relay.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in Hubble Relay container | `["ALL"]` |
|
||||
| `hubble.relay.containerSecurityContext.seccompProfile.type` | Set seccomp profile in Hubble Relay container | `RuntimeDefault` |
|
||||
| `hubble.relay.configuration` | Specify content for Hubble Relay configuration (basic one auto-generated based on other values otherwise) | `{}` |
|
||||
| `hubble.relay.overrideConfiguration` | Hubble Relay configuration override. Values defined here takes precedence over the ones defined at `hubble.relay.configuration` | `{}` |
|
||||
| `hubble.relay.existingConfigmap` | The name of an existing ConfigMap with your custom configuration for Hubble Relay | `""` |
|
||||
| `hubble.relay.enableGops` | Enable gops for Hubble Relay | `false` |
|
||||
| `hubble.relay.enablePprof` | Enable pprof for Hubble Relay | `false` |
|
||||
| `hubble.relay.command` | Override default Hubble Relay container command (useful when using custom images) | `[]` |
|
||||
| `hubble.relay.args` | Override default Hubble Relay container args (useful when using custom images) | `[]` |
|
||||
| `hubble.relay.automountServiceAccountToken` | Mount Service Account token in Hubble Relay pods | `false` |
|
||||
| `hubble.relay.hostAliases` | Hubble Relay pods host aliases | `[]` |
|
||||
| `hubble.relay.deploymentAnnotations` | Annotations for Hubble Relay deployment | `{}` |
|
||||
| `hubble.relay.podLabels` | Extra labels for Hubble Relay pods | `{}` |
|
||||
| `hubble.relay.podAnnotations` | Annotations for Hubble Relay pods | `{}` |
|
||||
| `hubble.relay.podAffinityPreset` | Pod affinity preset. Ignored if `hubble.relay.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `hubble.relay.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `hubble.relay.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `hubble.relay.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `hubble.relay.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `hubble.relay.nodeAffinityPreset.key` | Node label key to match. Ignored if `hubble.relay.affinity` is set | `""` |
|
||||
| `hubble.relay.nodeAffinityPreset.values` | Node label values to match. Ignored if `hubble.relay.affinity` is set | `[]` |
|
||||
| `hubble.relay.affinity` | Affinity for Hubble Relay pods assignment | `{}` |
|
||||
| `hubble.relay.nodeSelector` | Node labels for Hubble Relay pods assignment | `{}` |
|
||||
| `hubble.relay.tolerations` | Tolerations for Hubble Relay pods assignment | `[]` |
|
||||
| `hubble.relay.updateStrategy.type` | Hubble Relay deployment strategy type | `RollingUpdate` |
|
||||
| `hubble.relay.priorityClassName` | Hubble Relay pods' priorityClassName | `""` |
|
||||
| `hubble.relay.topologySpreadConstraints` | Topology Spread Constraints for Hubble Relay pod assignment spread across your cluster among failure-domains | `[]` |
|
||||
| `hubble.relay.schedulerName` | Name of the k8s scheduler (other than default) for Hubble Relay pods | `""` |
|
||||
| `hubble.relay.terminationGracePeriodSeconds` | Seconds Hubble Relay pods need to terminate gracefully | `""` |
|
||||
| `hubble.relay.lifecycleHooks` | for Hubble Relay containers to automate configuration before or after startup | `{}` |
|
||||
| `hubble.relay.extraEnvVars` | Array with extra environment variables to add to Hubble Relay containers | `[]` |
|
||||
| `hubble.relay.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Hubble Relay containers | `""` |
|
||||
| `hubble.relay.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Hubble Relay containers | `""` |
|
||||
| `hubble.relay.extraVolumes` | Optionally specify extra list of additional volumes for the Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Hubble Relay containers | `[]` |
|
||||
| `hubble.relay.sidecars` | Add additional sidecar containers to the Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.initContainers` | Add additional init containers to the Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
|
||||
| `hubble.relay.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
|
||||
| `hubble.relay.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `hubble.relay.pdb.minAvailable` and `hubble.relay.pdb.maxUnavailable` are empty. | `""` |
|
||||
| `hubble.relay.autoscaling.vpa.enabled` | Enable VPA for Hubble Relay pods | `false` |
|
||||
| `hubble.relay.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
|
||||
| `hubble.relay.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
|
||||
| `hubble.relay.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
|
||||
| `hubble.relay.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
|
||||
| `hubble.relay.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
|
||||
| `hubble.relay.autoscaling.hpa.enabled` | Enable HPA for Hubble Relay pods | `false` |
|
||||
| `hubble.relay.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
|
||||
| `hubble.relay.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
|
||||
| `hubble.relay.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `hubble.relay.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
| `hubble.relay.serviceAccount.create` | Specifies whether a ServiceAccount should be created for Hubble Relay | `true` |
|
||||
| `hubble.relay.serviceAccount.name` | The name of the ServiceAccount to use for Hubble Relay | `""` |
|
||||
| `hubble.relay.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
|
||||
| `hubble.relay.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `false` |
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
|
||||
| `hubble.relay.enabled` | Enable Hubble Relay | `false` |
|
||||
| `hubble.relay.image.registry` | Hubble Relay image registry | `REGISTRY_NAME` |
|
||||
| `hubble.relay.image.repository` | Hubble Relay image repository | `REPOSITORY_NAME/hubble-relay` |
|
||||
| `hubble.relay.image.digest` | Hubble Relay image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
|
||||
| `hubble.relay.image.pullPolicy` | Hubble Relay image pull policy | `IfNotPresent` |
|
||||
| `hubble.relay.image.pullSecrets` | Hubble Relay image pull secrets | `[]` |
|
||||
| `hubble.relay.image.debug` | Enable Hubble Relay image debug mode | `false` |
|
||||
| `hubble.relay.replicaCount` | Number of Hubble Relay replicas to deploy | `1` |
|
||||
| `hubble.relay.containerPorts.grpc` | Hubble Relay gRPC container port | `4245` |
|
||||
| `hubble.relay.containerPorts.pprof` | Hubble Relay pprof container port | `6062` |
|
||||
| `hubble.relay.containerPorts.gops` | Hubble Relay gops container port | `9893` |
|
||||
| `hubble.relay.containerPorts.metrics` | Hubble Relay metrics container port | `9966` |
|
||||
| `hubble.relay.extraContainerPorts` | Optionally specify extra list of additional ports for Hubble Relay containers | `[]` |
|
||||
| `hubble.relay.livenessProbe.enabled` | Enable livenessProbe on Hubble Relay containers | `true` |
|
||||
| `hubble.relay.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||
| `hubble.relay.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `hubble.relay.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `3` |
|
||||
| `hubble.relay.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
||||
| `hubble.relay.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `hubble.relay.readinessProbe.enabled` | Enable readinessProbe on Hubble Relay containers | `true` |
|
||||
| `hubble.relay.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `hubble.relay.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `hubble.relay.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `3` |
|
||||
| `hubble.relay.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `hubble.relay.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `hubble.relay.startupProbe.enabled` | Enable startupProbe on Hubble Relay containers | `false` |
|
||||
| `hubble.relay.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
|
||||
| `hubble.relay.startupProbe.periodSeconds` | Period seconds for startupProbe | `3` |
|
||||
| `hubble.relay.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `hubble.relay.startupProbe.failureThreshold` | Failure threshold for startupProbe | `20` |
|
||||
| `hubble.relay.startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `hubble.relay.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` |
|
||||
| `hubble.relay.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` |
|
||||
| `hubble.relay.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` |
|
||||
| `hubble.relay.resourcesPreset` | Set Hubble Relay container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if hubble.relay.resources is set (hubble.relay.resources is recommended for production). | `nano` |
|
||||
| `hubble.relay.resources` | Set Hubble Relay container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `hubble.relay.podSecurityContext.enabled` | Enable Hubble Relay pods' Security Context | `true` |
|
||||
| `hubble.relay.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for Hubble Relay pods | `Always` |
|
||||
| `hubble.relay.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.podSecurityContext.supplementalGroups` | Set filesystem extra groups for Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.podSecurityContext.fsGroup` | Set fsGroup in Hubble Relay pods' Security Context | `1001` |
|
||||
| `hubble.relay.containerSecurityContext.enabled` | Enabled Hubble Relay container' Security Context | `true` |
|
||||
| `hubble.relay.containerSecurityContext.seLinuxOptions` | Set SELinux options in Hubble Relay container | `{}` |
|
||||
| `hubble.relay.containerSecurityContext.runAsUser` | Set runAsUser in Hubble Relay container' Security Context | `1001` |
|
||||
| `hubble.relay.containerSecurityContext.runAsGroup` | Set runAsGroup in Hubble Relay container' Security Context | `1001` |
|
||||
| `hubble.relay.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in Hubble Relay container' Security Context | `true` |
|
||||
| `hubble.relay.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in Hubble Relay container' Security Context | `true` |
|
||||
| `hubble.relay.containerSecurityContext.privileged` | Set privileged in Hubble Relay container' Security Context | `false` |
|
||||
| `hubble.relay.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in Hubble Relay container' Security Context | `false` |
|
||||
| `hubble.relay.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in Hubble Relay container | `["ALL"]` |
|
||||
| `hubble.relay.containerSecurityContext.seccompProfile.type` | Set seccomp profile in Hubble Relay container | `RuntimeDefault` |
|
||||
| `hubble.relay.configuration` | Specify content for Hubble Relay configuration (basic one auto-generated based on other values otherwise) | `{}` |
|
||||
| `hubble.relay.overrideConfiguration` | Hubble Relay configuration override. Values defined here takes precedence over the ones defined at `hubble.relay.configuration` | `{}` |
|
||||
| `hubble.relay.existingConfigmap` | The name of an existing ConfigMap with your custom configuration for Hubble Relay | `""` |
|
||||
| `hubble.relay.enableGops` | Enable gops for Hubble Relay | `false` |
|
||||
| `hubble.relay.enablePprof` | Enable pprof for Hubble Relay | `false` |
|
||||
| `hubble.relay.command` | Override default Hubble Relay container command (useful when using custom images) | `[]` |
|
||||
| `hubble.relay.args` | Override default Hubble Relay container args (useful when using custom images) | `[]` |
|
||||
| `hubble.relay.automountServiceAccountToken` | Mount Service Account token in Hubble Relay pods | `false` |
|
||||
| `hubble.relay.hostAliases` | Hubble Relay pods host aliases | `[]` |
|
||||
| `hubble.relay.deploymentAnnotations` | Annotations for Hubble Relay deployment | `{}` |
|
||||
| `hubble.relay.podLabels` | Extra labels for Hubble Relay pods | `{}` |
|
||||
| `hubble.relay.podAnnotations` | Annotations for Hubble Relay pods | `{}` |
|
||||
| `hubble.relay.podAffinityPreset` | Pod affinity preset. Ignored if `hubble.relay.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `hubble.relay.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `hubble.relay.affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `hubble.relay.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `hubble.relay.affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `hubble.relay.nodeAffinityPreset.key` | Node label key to match. Ignored if `hubble.relay.affinity` is set | `""` |
|
||||
| `hubble.relay.nodeAffinityPreset.values` | Node label values to match. Ignored if `hubble.relay.affinity` is set | `[]` |
|
||||
| `hubble.relay.affinity` | Affinity for Hubble Relay pods assignment | `{}` |
|
||||
| `hubble.relay.nodeSelector` | Node labels for Hubble Relay pods assignment | `{}` |
|
||||
| `hubble.relay.tolerations` | Tolerations for Hubble Relay pods assignment | `[]` |
|
||||
| `hubble.relay.updateStrategy.type` | Hubble Relay deployment strategy type | `RollingUpdate` |
|
||||
| `hubble.relay.priorityClassName` | Hubble Relay pods' priorityClassName | `""` |
|
||||
| `hubble.relay.topologySpreadConstraints` | Topology Spread Constraints for Hubble Relay pod assignment spread across your cluster among failure-domains | `[]` |
|
||||
| `hubble.relay.schedulerName` | Name of the k8s scheduler (other than default) for Hubble Relay pods | `""` |
|
||||
| `hubble.relay.terminationGracePeriodSeconds` | Seconds Hubble Relay pods need to terminate gracefully | `""` |
|
||||
| `hubble.relay.lifecycleHooks` | for Hubble Relay containers to automate configuration before or after startup | `{}` |
|
||||
| `hubble.relay.extraEnvVars` | Array with extra environment variables to add to Hubble Relay containers | `[]` |
|
||||
| `hubble.relay.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Hubble Relay containers | `""` |
|
||||
| `hubble.relay.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Hubble Relay containers | `""` |
|
||||
| `hubble.relay.extraVolumes` | Optionally specify extra list of additional volumes for the Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Hubble Relay containers | `[]` |
|
||||
| `hubble.relay.sidecars` | Add additional sidecar containers to the Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.initContainers` | Add additional init containers to the Hubble Relay pods | `[]` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.enabled` | Enabled Hubble Relay init-containers' Security Context | `true` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.seLinuxOptions` | Set SELinux options in Hubble Relay init-containers | `{}` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.runAsUser` | Set runAsUser in Hubble Relay init-containers' Security Context | `1001` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.runAsGroup` | Set runAsUser in Hubble Relay init-containers' Security Context | `1001` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in Hubble Relay init-containers' Security Context | `true` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in Hubble Relay init-containers' Security Context | `true` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.privileged` | Set privileged in Hubble Relay init-containers' Security Context | `false` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in Hubble Relay init-containers' Security Context | `false` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in Hubble Relay init-containers | `["ALL"]` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.seccompProfile.type` | Set seccomp profile in Hubble Relay init-containers | `RuntimeDefault` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.resourcesPreset` | Set Hubble Relay "wait-for-hubble-peers" init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if hubble.relay.resources is set (hubble.relay.defaultInitContainers.waitForHubble.resources is recommended for production). | `nano` |
|
||||
| `hubble.relay.defaultInitContainers.waitForHubble.resources` | Set Hubble Relay "wait-for-hubble-peers" init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `hubble.relay.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
|
||||
| `hubble.relay.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
|
||||
| `hubble.relay.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `hubble.relay.pdb.minAvailable` and `hubble.relay.pdb.maxUnavailable` are empty. | `""` |
|
||||
| `hubble.relay.autoscaling.vpa.enabled` | Enable VPA for Hubble Relay pods | `false` |
|
||||
| `hubble.relay.autoscaling.vpa.annotations` | Annotations for VPA resource | `{}` |
|
||||
| `hubble.relay.autoscaling.vpa.controlledResources` | VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | `[]` |
|
||||
| `hubble.relay.autoscaling.vpa.maxAllowed` | VPA Max allowed resources for the pod | `{}` |
|
||||
| `hubble.relay.autoscaling.vpa.minAllowed` | VPA Min allowed resources for the pod | `{}` |
|
||||
| `hubble.relay.autoscaling.vpa.updatePolicy.updateMode` | Autoscaling update policy | `Auto` |
|
||||
| `hubble.relay.autoscaling.hpa.enabled` | Enable HPA for Hubble Relay pods | `false` |
|
||||
| `hubble.relay.autoscaling.hpa.minReplicas` | Minimum number of replicas | `""` |
|
||||
| `hubble.relay.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
|
||||
| `hubble.relay.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `hubble.relay.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
| `hubble.relay.serviceAccount.create` | Specifies whether a ServiceAccount should be created for Hubble Relay | `true` |
|
||||
| `hubble.relay.serviceAccount.name` | The name of the ServiceAccount to use for Hubble Relay | `""` |
|
||||
| `hubble.relay.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
|
||||
| `hubble.relay.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `false` |
|
||||
|
||||
### Hubble Relay Traffic Exposure Parameters
|
||||
|
||||
|
||||
@@ -0,0 +1,67 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Returns an init-container that waits for Hubble to be ready
|
||||
*/}}
|
||||
{{- define "cilium.hubble.relay.waitForHubble" -}}
|
||||
- name: wait-for-hubble-peers
|
||||
image: {{ include "cilium.hubble.relay.image" . }}
|
||||
imagePullPolicy: {{ .Values.hubble.relay.image.pullPolicy }}
|
||||
{{- if .Values.hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hubble.relay.defaultInitContainers.waitForHubble.resources }}
|
||||
resources: {{- toYaml .Values.hubble.relay.defaultInitContainers.waitForHubble.resources | nindent 4 }}
|
||||
{{- else if ne .Values.hubble.relay.defaultInitContainers.waitForHubble.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.hubble.relay.defaultInitContainers.waitForHubble.resourcesPreset) | nindent 4 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
retry_while() {
|
||||
local cmd="${1:?cmd is missing}"
|
||||
local retries="${2:-12}"
|
||||
local sleep_time="${3:-5}"
|
||||
local return_value=1
|
||||
|
||||
read -r -a command <<<"$cmd"
|
||||
for ((i = 1; i <= retries; i += 1)); do
|
||||
"${command[@]}" && return_value=0 && break
|
||||
sleep "$sleep_time"
|
||||
done
|
||||
return $return_value
|
||||
}
|
||||
|
||||
exit_code=0
|
||||
if ! retry_while "grpc-health-probe -addr=${HUBBLE_PEERS_ENDPOINT} ${GRPC_FLAGS}"; then
|
||||
echo "hubble is not ready"
|
||||
exit_code=1
|
||||
else
|
||||
echo "hubble ready"
|
||||
fi
|
||||
|
||||
exit "$exit_code"
|
||||
env:
|
||||
- name: HUBBLE_PEERS_ENDPOINT
|
||||
value: {{ printf "%s.%s.svc.%s:%d" (printf "%s-hubble-peers" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") (include "common.names.namespace" .) .Values.clusterDomain (int .Values.hubble.peers.service.port) | quote }}
|
||||
{{- if not .Values.hubble.tls.enabled }}
|
||||
- name: GRPC_FLAGS
|
||||
value: "-rpc-timeout=2s"
|
||||
{{- else }}
|
||||
- name: GRPC_FLAGS
|
||||
value: "-rpc-timeout=2s -tls -tls-ca-cert=/certs/client/ca.crt -tls-client-cert=/certs/client/tls.crt -tls-client-key=/certs/client/tls.key"
|
||||
volumeMounts:
|
||||
- name: client-cert
|
||||
readOnly: true
|
||||
mountPath: /certs/client
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -82,9 +82,11 @@ spec:
|
||||
{{- if .Values.hubble.relay.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.hubble.relay.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.hubble.relay.initContainers }}
|
||||
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.hubble.relay.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- include "cilium.hubble.relay.waitForHubble" . | nindent 8}}
|
||||
{{- if .Values.hubble.relay.initContainers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.hubble.relay.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: relay
|
||||
image: {{ template "cilium.hubble.relay.image" . }}
|
||||
|
||||
@@ -2394,6 +2394,56 @@ hubble:
|
||||
## command: ['sh', '-c', 'echo "hello world"']
|
||||
##
|
||||
initContainers: []
|
||||
## Default init Containers
|
||||
##
|
||||
defaultInitContainers:
|
||||
## Hubble Relay "wait-for-hubble-peers" init container
|
||||
## Used to waits for kube-proxy to be ready
|
||||
##
|
||||
waitForHubble:
|
||||
## Configure "wait-for-hubble-peers" init-container Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.enabled Enabled Hubble Relay init-containers' Security Context
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in Hubble Relay init-containers
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.runAsUser Set runAsUser in Hubble Relay init-containers' Security Context
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.runAsGroup Set runAsUser in Hubble Relay init-containers' Security Context
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.runAsNonRoot Set runAsNonRoot in Hubble Relay init-containers' Security Context
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in Hubble Relay init-containers' Security Context
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.privileged Set privileged in Hubble Relay init-containers' Security Context
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in Hubble Relay init-containers' Security Context
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.capabilities.drop List of capabilities to be dropped in Hubble Relay init-containers
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.containerSecurityContext.seccompProfile.type Set seccomp profile in Hubble Relay init-containers
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
## Hubble Relay "wait-for-hubble-peers" init container resource requests and limits
|
||||
## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.resourcesPreset Set Hubble Relay "wait-for-hubble-peers" init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if hubble.relay.resources is set (hubble.relay.defaultInitContainers.waitForHubble.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "nano"
|
||||
## @param hubble.relay.defaultInitContainers.waitForHubble.resources Set Hubble Relay "wait-for-hubble-peers" init container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources: {}
|
||||
## Pod Disruption Budget configuration
|
||||
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb
|
||||
## @param hubble.relay.pdb.create Enable/disable a Pod Disruption Budget creation
|
||||
|
||||
Reference in New Issue
Block a user