helm-charts/patchmon/values.yaml

# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

patchmon:
  server:
    # Replica count for this workload; 0 is allowed and scales it down.
    # The chart-global scaleDown flag takes precedence.
    # Note: the server registers itself in the agent presence registry under a
    # stable identity (the pod hostname, pinned by the chart). Running more
    # than one replica requires a distinct identity per replica and is not
    # supported by this chart.
    replicas: 1
    # The 2.x server image is a hardened Alpine image running as uid 65532
    # (nonroot). It is stateless: frontend, agent binaries and SCAP content
    # are baked into the image, so the root filesystem stays read-only; /tmp
    # is provided as an emptyDir.
    securityContext:
      pod:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        # RuntimeDefault applies the container runtime's default seccomp
        # filter, which blocks the syscalls a normal workload never makes. It
        # sits in the pod context on purpose: from here it covers every
        # container in the pod - the server and the optional guacd sidecar
        # alike - including init containers, while a container-level
        # seccompProfile would have to be repeated for each one (and silently
        # missed on the next one added). A container that genuinely needs a
        # different filter can still override it under
        # securityContext.container, which wins over this value.
        seccompProfile:
          type: RuntimeDefault
      container:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        capabilities:
          drop:
            - ALL
    resources:
      # Limits are optional: memory and ephemeral-storage limits default to
      # limitFactor x the request, an explicitly set limit always wins, and a
      # CPU limit is only set when configured explicitly under "limits".
      limitFactor: 3
      requests:
        cpu: 0.1
        memory: 256Mi
        ephemeral-storage: 10Mi
    # Probes hit GET /health ({"status": "ok"}). The 2.x server rejects
    # requests whose Host header is neither loopback nor a CORS_ORIGIN host
    # with 403 — kubelet probes target the pod IP, so they must send the
    # public hostname as Host header. Probe values are rendered through tpl,
    # so the default Host header follows ingress.domain.
    livenessProbe:
      httpGet:
        path: /health
        port: 3000
        httpHeaders:
          - name: Host
            value: "{{ .Values.ingress.domain }}"
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    readinessProbe:
      httpGet:
        path: /health
        port: 3000
        httpHeaders:
          - name: Host
            value: "{{ .Values.ingress.domain }}"
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    # The startup probe gates liveness/readiness. The server waits for the
    # database and runs migrations on startup; upstream warns that the first
    # 2.x boot rebuilds database indexes, which can take minutes on slow
    # storage: budget 10s * 60 = 600s.
    startupProbe:
      httpGet:
        path: /health
        port: 3000
        httpHeaders:
          - name: Host
            value: "{{ .Values.ingress.domain }}"
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 60
    # Extra environment variables, appended to the ones the chart always sets.
    # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
    # forms are supported.
    env: []
  guacd:
    # In-browser RDP for Windows hosts (beta) via the Apache Guacamole daemon,
    # run as a sidecar container in the server pod. Disabled by default; when
    # enabled, the server is pointed at it via GUACD_ADDRESS=127.0.0.1:4822.
    enabled: false
    # guacd is an independent upstream application, so its image is not tied
    # to the chart's appVersion. Pinned to the version upstream ships with.
    image: docker.io/guacamole/guacd:1.6.0
    # The image runs as its own unprivileged user (uid 1000); it only needs a
    # writable /tmp, which the chart provides as an emptyDir.
    securityContext:
      container:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        capabilities:
          drop:
            - ALL
    resources:
      # Limits are optional: memory and ephemeral-storage limits default to
      # limitFactor x the request, an explicitly set limit always wins, and a
      # CPU limit is only set when configured explicitly under "limits".
      limitFactor: 3
      requests:
        cpu: 0.05
        memory: 64Mi
        ephemeral-storage: 10Mi
    # Probe values are rendered through tpl.
    livenessProbe:
      tcpSocket:
        port: 4822
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    readinessProbe:
      tcpSocket:
        port: 4822
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
    startupProbe:
      tcpSocket:
        port: 4822
      periodSeconds: 5
      timeoutSeconds: 5
      failureThreshold: 30
    # Extra environment variables for the guacd sidecar (e.g. GUACD_LOG_LEVEL).
    # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
    # forms are supported.
    env: []

ingress:
  # Set to false to omit the Ingress entirely (the required domain and
  # clusterIssuer values are then not needed either, because they are only
  # read inside the Ingress template).
  enabled: true
  clusterIssuer: null
  domain: null
  className: nginx
  # Extra annotations for the Ingress; merged with the cert-manager
  # cluster-issuer annotation the chart always sets.
  annotations: {}

secrets:
  redisSecretRef: null
  postgresSecretRef: null
  oidcSecretRef: null
  patchmonSecretRef: null