values.yaml

##################################
## Astronomer global configuration
##################################
global:
  # Base domain for all subdomains exposed through ingress
  baseDomain: ~

  # Name of secret containing TLS certificate
  tlsSecret: astronomer-tls

  # List of secrets containing private CA certificates
  privateCaCerts: []
  # Most users with private CA will already have their node
  # images created including the cert to trust in the appropriate
  # location. If not, it is necessary to configure Docker (or containerd)
  # on all nodes to trust the private root CA. This will allow
  # kubelet to pull from the Astronomer registry that has been signed
  # by the same private CA.
  privateCaCertsAddToHost:
    enabled: false
    hostDirectory: /etc/docker/certs.d
    certCopier:
      repository: alpine
      tag: 3.14
      pullPolicy: IfNotPresent
  # Global flag to enable to user to enable/disable Astronomer platform
  # level Network Policy
  networkPolicy:
    enabled: true

  # Specific Astronomer features configuration
  features:
    # namespace pools: define k8s namespaces in which Astronomer will manage Airflow deployments
    namespacePools:
      enabled: false
      namespaces:
        # if create is enabled, this helm chart will create the provided k8s namespaces
        create: false
        names: []
  namespaceFreeFormEntry: false
  # Use kube-lego
  acme: false

  # If RBAC on cluster is enabled
  rbacEnabled: true

  # whether to create pod disrption budgets by default for platform components
  podDisruptionBudgetsEnabled: true

  # URL to the Astronomer helm repo
  helmRepo: "https://helm.astronomer.io"

  # Host and port of where tiller is running in Kubernetes
  helmHost: "tiller-deploy.kube-system.svc.cluster.local:44134"

  # Single namespace mode
  singleNamespace: false

  # Use cluster roles
  clusterRoles: true

  # Enables necessary components for compatibility with Istio Service Mesh
  istio:
    enabled: false
    rootNamespace: "istio-config"

  # Enables necessary components for Velero (Velero, Grafana Dashboard, Prometheus Alerts)
  veleroEnabled: false

  # Enable default postgresql database.
  # This is not recommended for production.
  postgresqlEnabled: false

  # Enables a node exporter DaemonSet for node-level metrics
  nodeExporterEnabled: true

  prometheusPostgresExporterEnabled: false

  # Enables blackbox exporter
  blackboxExporterEnabled: false

  # make fluentd to gather logs from all available namespaces
  manualNamespaceNamesEnabled: false

  # Used to enable nats-server
  nats:
    enabled: true
    replicas: 3

  # Used to enable nats-streaming
  stan:
    enabled: true
    replicas: 3

  # If PodSecurityPolicies (PSP) should be enabled
  pspEnabled: false

  # Do you want to apply the global, default deny ingress network policy?
  defaultDenyNetworkPolicy: true

  # Enable security context constraints required for OpenShift
  sccEnabled: false

  # Enables namespace labels for network policies
  networkNSLabels: false

  taskUsageMetricsEnabled: false

  # Sidecar Logging
  loggingSidecar:
    enabled: false
    name: sidecar-log-consumer
    image: quay.io/astronomer/ap-vector:0.24.2
    terminationEndpoint: http://localhost:8000/quitquitquit
    customConfig: false
    extraEnv: []
    resources: {}
    #  requests:
    #    cpu: "100m"
    #    memory: "386Mi"
    #  limits:
    #    cpu: "100m"
    #    memory: "386Mi"

  # Deploy auth sidecar to use openshift native features
  authSidecar:
    enabled: false
    repository: quay.io/astronomer/ap-auth-sidecar
    tag: 1.23.2
    pullPolicy: IfNotPresent
    port: 8084
    default_nginx_settings: |
      internal;
      proxy_pass_request_body     off;
      proxy_set_header            Content-Length          "";
      proxy_set_header            X-Forwarded-Proto       "";
      proxy_set_header            X-Original-URL          https://$http_host$request_uri;
      proxy_set_header            X-Original-Method       $request_method;
      proxy_set_header            X-Real-IP               $remote_addr;
      proxy_set_header            X-Forwarded-For         $remote_addr;
      proxy_set_header            X-Auth-Request-Redirect $request_uri;
      proxy_buffering             off;
      proxy_buffer_size           4k;
      proxy_buffers               4 4k;
      proxy_request_buffering     on;
      proxy_http_version          1.1;
      proxy_ssl_server_name       on;
      proxy_pass_request_headers  on;
      client_max_body_size        1024m;
    default_nginx_settings_location: |
      auth_request     /auth;
      auth_request_set $auth_status $upstream_status;
      auth_request_set $auth_cookie $upstream_http_set_cookie;
      add_header       Set-Cookie $auth_cookie;
      auth_request_set $authHeader0 $upstream_http_authorization;
      proxy_set_header 'authorization' $authHeader0;
      auth_request_set $authHeader1 $upstream_http_username;
      proxy_set_header 'username' $authHeader1;
      auth_request_set $authHeader2 $upstream_http_email;
      proxy_set_header 'email' $authHeader2;
      error_page 401 = @401_auth_error;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'connection_upgrade';
      proxy_set_header X-Real-IP              $remote_addr;
      proxy_set_header X-Forwarded-For        $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_cache_bypass $http_upgrade;
      proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
      proxy_connect_timeout                   15s;
      proxy_send_timeout                      600s;
      proxy_read_timeout                      600s;
      proxy_buffering                         off;
      proxy_buffer_size                       4k;
      proxy_buffers                           4 4k;
      proxy_max_temp_file_size                1024m;
      proxy_request_buffering                 on;
      proxy_http_version                      1.1;
      proxy_cookie_domain                     off;
      proxy_cookie_path                       off;
      proxy_redirect                          off;
    resources:
      requests:
        cpu: "500m"
        memory: "512Mi"
      limits:
        cpu: "1000m"
        memory: "1024Mi"

  # External ES logging
  customLogging:
    enabled: false
    scheme: https
    host: ""
    port: ""
    secret: ""
    #secretName: ~
    #awsSecretName: ~
    #awsIAMRole: ~
    #awsServiceAccountAnnotation: ~

  ## Add annotations to all the auth sidecar deployed ingress resources
  ##
  extraAnnotations: {}
    #kubernetes.io/ingress.class: "default"
    #route.openshift.io/termination: "passthrough"

  # Enable values required for use with Microsoft Azure
  azure:
    enabled: false

  # Set nodeSelector, affinity, and tolerations values for platform and deployment related pods.
  # This allows for separation of platform and airflow pods between kubernetes node pools.
  # Pods in the platformNodePool include alertmanager, cli-install, commander, houston, kube-replicator, astro-ui,
  # registry, es-client, es-data, es-exporter, es-master, nginx-es, grafana, kibana, kube-state, nginx, nginx-default, prometheus.
  # nodeSelector, affinity, and tolerations values for airflow deployment pods are assigned via houston config.
  # See more information on pod / node assignment here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
  platformNodePool:
    nodeSelector: &platformNodeSelector
      {}
    affinity: &platformAffinity
      {}
    tolerations: &platformTolerations
      []

  privateRegistry:
    enabled: false
    repository: ~
    secretName: ~

  # SSL support for using SSL connections to encrypt client/server communication between database and Astronomer platform
  ssl:
    enabled: false
    mode: "prefer"
    # we need separate mode for grafana:
    # grafana starting from (7.5.0) only supports sslmodes: disable/require/verify-ca/verify-full
    # https://github.com/grafana/grafana/blob/master/CHANGELOG.md#750-beta1-2021-03-04 (Postgres: SSL certification)
    grafana:
      sslmode: "require"

  # Storage class for persistent volumes. If you have multiple storage classes available this will force all charts with persistent
  # volumes to use the one specified here.
  # storageClass: ~

  # Enable argo CD annotations currently available only for:
  # ServiceAccounts, ClusterRoles, RoleBindings, ClusterRoleBindings
  # https://github.com/argoproj/argo-cd/blob/master/docs/user-guide/sync-waves.md
  enableArgoCDAnnotation: false

  # For now we support only pgbouncer with gss api support
  pgbouncer:
    enabled: false
    gssSupport: true
    krb5ConfSecretName: krb5.conf
    # we use it only for in cluster postgresql
    # so we can override astronomer-bootstrap secret
    username: postgres
    password: postgres
    servicePort: "5432"
    extraEnv: []
      # some: thing
      # another: thing
    extraLabels: []
      # do-funky-injection: maybe

#################################
## Default tagged groups enabled
#################################
tags:
  # Enable platform components by default (nginx, astronomer)
  platform: true

  # Enable monitoring stack (prometheus, kube-state, grafana)
  monitoring: true

  # Enable logging stack (elasticsearch, fluentd, kibana)
  logging: true

  # NATS Streaming
  stan: true

#################################
## Astronomer configuration
#################################
astronomer:
  astroUI:
    resources:
      requests:
        cpu: "100m"
        memory: "256Mi"
      limits:
        cpu: "500m"
        memory: "1024Mi"

  houston:
    resources:
      requests:
        cpu: "500m"
        memory: "1024Mi"
      limits:
        cpu: "1000m"
        memory: "2048Mi"

  commander:
    resources:
      requests:
        cpu: "250m"
        memory: "1Gi"
      limits:
        cpu: "500m"
        memory: "2Gi"

  registry:
    resources:
      requests:
        cpu: "250m"
        memory: "512Mi"
      limits:
        cpu: "500m"
        memory: "1024Mi"

    persistence:
      enabled: true
      size: "100Gi"

  install:
    resources:
      requests:
        cpu: "100m"
        memory: "256Mi"
      limits:
        cpu: "500m"
        memory: "1024Mi"

  extraObjects: []

  # podLabels: {}

#################################
## Nginx configuration
#################################
nginx:
  # Configure resources
  resources:
    requests:
      cpu: "500m"
      memory: "1024Mi"
    limits:
      cpu: "1"
      memory: "2048Mi"

  # String IP address the nginx ingress should bind to
  loadBalancerIP: ~

  # List used to restrict IPs that can reach the nginx ingress
  loadBalancerSourceRanges: []

  # Dict of arbitrary annotations to add to the nginx ingress
  ingressAnnotations: {}

  defaultBackend:
    resources:
      requests:
        cpu: "100m"
        memory: "50Mi"
      limits:
        cpu: "120m"
        memory: "100Mi"

#################################
## Grafana configuration
#################################
grafana:
  # Configure resources
  resources:
    requests:
      cpu: "250m"
      memory: "512Mi"
    limits:
      cpu: "500m"
      memory: "1024Mi"

  dashboards:
    {}
    # default:
    #   velero:
    #     file: dashboards/velero.json

  # provide extra configurations to grafana via environment variables
  extraEnvVars:
    []
    # - name: GF_SMTP_ENABLED
    #   value: "true"
    # - name: GF_SMTP_HOST
    #   value: smtp.astronomer.io
    # - name: GF_SMTP_USER
    #   value: grafana
    # - name: GF_SMTP_PASSWORD
    #   valueFrom:
    #     secretKeyRef:
    #       name: grafana-smtp-secret
    #       key: smtp_password


#################################
## Prometheus configuration
#################################
prometheus:
  podLabels: {}
  # Data retention
  retention: 15d

  # Persistence configuration
  persistence:
    enabled: true
    size: "150Gi"

  # Configure resources
  resources:
    requests:
      cpu: "1000m"
      memory: "4Gi"
    limits:
      cpu: "2000m"
      memory: "8Gi"

  configMapReloader:
    resources:
      limits:
        cpu: 100m
        memory: 25Mi
      requests:
        cpu: 100m
        memory: 25Mi

nats:
  nodeSelector:
    <<: *platformNodeSelector
  affinity:
    <<: *platformAffinity
  tolerations: *platformTolerations

  nats:
    resources:
      requests:
        cpu: "75m"
        memory: "30Mi"
      limits:
        cpu: "250m"
        memory: "100Mi"

stan:
  nodeSelector:
    <<: *platformNodeSelector
  affinity:
    <<: *platformAffinity
  tolerations: *platformTolerations

  init:
    resources:
      requests:
        cpu: "75m"
        memory: "30Mi"
      limits:
        cpu: "250m"
        memory: "100Mi"

  stan:
    resources:
      requests:
        cpu: "75m"
        memory: "30Mi"
      limits:
        cpu: "250m"
        memory: "100Mi"

#################################
## Blackbox Exporter configuration
#################################
prometheus-blackbox-exporter:
  # Configure resources
  resources:
    requests:
      cpu: "50m"
      memory: "70Mi"
    limits:
      cpu: "100m"
      memory: "200Mi"

  # define what astronomer platform services will be checked
  # for up/down status. Enable this will also include
  # the required network policies
  astroServices:
    commander:
      enabled: true
    houston:
      enabled: true
    registry:
      enabled: true
    grafana:
      enabled: true
    elasticsearch:
      enabled: true
    kibana:
      enabled: true
    cliInstall:
      enabled: true

#################################
## Elasticsearch configuration
#################################
elasticsearch:
  # Common configuration
  common:
    persistence:
      enabled: true

  # Configure client nodes
  client:

    initResources:
      limits:
        cpu: "120m"
        memory: "100Mi"
      requests:
        cpu: "100m"
        memory: "80Mi"

    # Match resources.requests.memory
    heapMemory: "2g"

    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"

  # Configure data nodes
  data:

    initResources:
      limits:
        cpu: "120m"
        memory: "100Mi"
      requests:
        cpu: "100m"
        memory: "80Mi"

    # Match resources.requests.memory
    heapMemory: "2g"

    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"

    persistence:
      size: "100Gi"

  # Configure master nodes
  master:

    initResources:
      limits:
        cpu: "120m"
        memory: "100Mi"
      requests:
        cpu: "100m"
        memory: "80Mi"

    # Match resources.requests.memory
    heapMemory: "2g"

    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"

    persistence:
      size: "20Gi"

  exporter:
    resources:
      requests:
        cpu: "100m"
        memory: "100Mi"
      limits:
        cpu: "200m"
        memory: "128Mi"

  nginx:
    resources:
      requests:
        cpu: "80m"
        memory: "7Mi"
      limits:
        cpu: "100m"
        memory: "10Mi"

#################################
## Kibana configuration
#################################
kibana:
  # Configure resources
  resources:
    requests:
      cpu: "250m"
      memory: "512Mi"
    limits:
      cpu: "500m"
      memory: "1024Mi"

#################################
## Fluentd configuration
#################################
fluentd:
  # Configure resources
  resources:
    requests:
      cpu: "250m"
      memory: "512Mi"
    limits:
      cpu: "1000m"
      memory: "1024Mi"

#################################
## Kube State configuration
#################################
kube-state:
  # Configure resources
  resources:
    requests:
      cpu: "250m"
      memory: "512Mi"
    limits:
      cpu: "500m"
      memory: "1024Mi"