added repo
This commit is contained in:
Your Name
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
*.gotmpl
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v2
|
||||
appVersion: 2.17.1
|
||||
description: Event-based autoscaler for workloads on Kubernetes
|
||||
home: https://github.com/kedacore/keda
|
||||
icon: https://raw.githubusercontent.com/kedacore/keda/main/images/keda-logo-500x500-white.png
|
||||
kubeVersion: '>=v1.23.0-0'
|
||||
maintainers:
|
||||
- email: jorge_turrado@hotmail.es
|
||||
name: Jorge Turrado
|
||||
- email: zbynek@kedify.io
|
||||
name: Zbynek Roubalik
|
||||
- email: jan@kedify.io
|
||||
name: Jan Wozniak
|
||||
name: keda
|
||||
sources:
|
||||
- https://github.com/kedacore/keda
|
||||
version: 2.17.1
|
||||
@@ -0,0 +1,397 @@
|
||||
<p align="center"><img src="https://raw.githubusercontent.com/kedacore/keda/main/images/keda-logo-transparent.png" width="300"/></p>
|
||||
<p style="font-size: 25px" align="center"><b>Kubernetes-based Event Driven Autoscaling</b></p>
|
||||
|
||||
KEDA allows for fine grained autoscaling (including to/from zero) for event driven Kubernetes workloads. KEDA serves as a Kubernetes Metrics Server and allows users to define autoscaling rules using a dedicated Kubernetes custom resource definition.
|
||||
|
||||
KEDA can run on both the cloud and the edge, integrates natively with Kubernetes components such as the Horizontal Pod Autoscaler, and has no external dependencies.
|
||||
|
||||
---
|
||||
<p align="center">
|
||||
We are a Cloud Native Computing Foundation (CNCF) graduated project.
|
||||
|
||||
<img src="https://raw.githubusercontent.com/kedacore/keda/main/images/logo-cncf.svg" height="75px">
|
||||
</p>
|
||||
|
||||
---
|
||||
|
||||
## TL;DR
|
||||
|
||||
```console
|
||||
helm repo add kedacore https://kedacore.github.io/charts
|
||||
helm repo update
|
||||
|
||||
kubectl create namespace keda
|
||||
helm install keda kedacore/keda --namespace keda --version 2.17.1
|
||||
```
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps KEDA infrastructure on a Kubernetes cluster using the Helm package manager.
|
||||
|
||||
As part of that, it will install all the required Custom Resource Definitions (CRD).
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `keda`:
|
||||
|
||||
```console
|
||||
$ kubectl create namespace keda
|
||||
$ helm install keda kedacore/keda --namespace keda --version 2.17.1
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `keda` Helm chart:
|
||||
|
||||
```console
|
||||
helm uninstall keda
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Configuration
|
||||
|
||||
The following table lists the configurable parameters of the KEDA chart and
|
||||
their default values.
|
||||
|
||||
### General parameters
|
||||
|
||||
| Parameter | Type | Default | Description |
|
||||
|-----------|------|---------|-------------|
|
||||
| `additionalAnnotations` | object | `{}` | Custom annotations to add into metadata |
|
||||
| `additionalLabels` | object | `{}` | Custom labels to add into metadata |
|
||||
| `affinity` | object | `{}` | [Affinity] for pod scheduling for KEDA operator, Metrics API Server and KEDA admission webhooks. |
|
||||
| `asciiArt` | bool | `true` | Capability to turn on/off ASCII art in Helm installation notes |
|
||||
| `certificates.autoGenerated` | bool | `true` | Enables the self generation for KEDA TLS certificates inside KEDA operator |
|
||||
| `certificates.certManager.caSecretName` | string | `"kedaorg-ca"` | Secret name where the CA is stored (generatedby cert-manager or user given) |
|
||||
| `certificates.certManager.duration` | string | `"8760h0m0s"` | Certificate duration |
|
||||
| `certificates.certManager.enabled` | bool | `false` | Enables Cert-manager for certificate management |
|
||||
| `certificates.certManager.generateCA` | bool | `true` | Generates a self-signed CA with Cert-manager. If generateCA is false, the secret with the CA has to be annotated with `cert-manager.io/allow-direct-injection: "true"` |
|
||||
| `certificates.certManager.issuer` | object | `{"generate":true,"group":"cert-manager.io","kind":"ClusterIssuer","name":"foo-org-ca"}` | Reference to custom Issuer. If issuer.generate is false, then issuer.group, issuer.kind and issuer.name are required |
|
||||
| `certificates.certManager.issuer.generate` | bool | `true` | Generates an Issuer resource with Cert-manager |
|
||||
| `certificates.certManager.issuer.group` | string | `"cert-manager.io"` | Custom Issuer group. Required when generate: false |
|
||||
| `certificates.certManager.issuer.kind` | string | `"ClusterIssuer"` | Custom Issuer kind. Required when generate: false |
|
||||
| `certificates.certManager.issuer.name` | string | `"foo-org-ca"` | Custom Issuer name. Required when generate: false |
|
||||
| `certificates.certManager.renewBefore` | string | `"5840h0m0s"` | Certificate renewal time before expiration |
|
||||
| `certificates.certManager.secretTemplate` | object | `{}` | Add labels/annotations to secrets created by Certificate resources [docs](https://cert-manager.io/docs/usage/certificate/#creating-certificate-resources) |
|
||||
| `certificates.mountPath` | string | `"/certs"` | Path where KEDA TLS certificates are mounted |
|
||||
| `certificates.secretName` | string | `"kedaorg-certs"` | Secret name to be mounted with KEDA TLS certificates |
|
||||
| `clusterDomain` | string | `"cluster.local"` | Kubernetes cluster domain |
|
||||
| `clusterName` | string | `"kubernetes-default"` | Kubernetes cluster name. Used in features such as emitting CloudEvents |
|
||||
| `crds.additionalAnnotations` | object | `{}` | Custom annotations specifically for CRDs |
|
||||
| `crds.install` | bool | `true` | Defines whether the KEDA CRDs have to be installed or not. |
|
||||
| `customManagedBy` | string | `""` | When specified, each rendered resource will have `app.kubernetes.io/managed-by: ${this}` label on it. Useful, when using only helm template with some other solution. |
|
||||
| `enableServiceLinks` | bool | `true` | Enable service links in pods. Although enabled, mirroring k8s default, it is highly recommended to disable, due to its legacy status [Legacy container links](https://docs.docker.com/engine/network/links/) |
|
||||
| `env` | list | `[]` | Additional environment variables that will be passed onto all KEDA components |
|
||||
| `extraObjects` | list | `[]` | Array of extra K8s manifests to deploy |
|
||||
| `global.image.registry` | string | `nil` | Global image registry of KEDA components |
|
||||
| `grpcTLSCertsSecret` | string | `""` | Set this if you are using an external scaler and want to communicate over TLS (recommended). This variable holds the name of the secret that will be mounted to the /grpccerts path on the Pod |
|
||||
| `hashiCorpVaultTLS` | string | `""` | Set this if you are using HashiCorp Vault and want to communicate over TLS (recommended). This variable holds the name of the secret that will be mounted to the /vault path on the Pod |
|
||||
| `http.keepAlive.enabled` | bool | `true` | Enable HTTP connection keep alive |
|
||||
| `http.minTlsVersion` | string | `"TLS12"` | The minimum TLS version to use for all scalers that use raw HTTP clients (some scalers use SDKs to access target services. These have built-in HTTP clients, and this value does not necessarily apply to them) |
|
||||
| `http.timeout` | int | `3000` | The default HTTP timeout to use for all scalers that use raw HTTP clients (some scalers use SDKs to access target services. These have built-in HTTP clients, and the timeout does not necessarily apply to them) |
|
||||
| `image.pullPolicy` | string | `"Always"` | Image pullPolicy for all KEDA components |
|
||||
| `imagePullSecrets` | list | `[]` | Name of secret to use to pull images to use to pull Docker images |
|
||||
| `networkPolicy.cilium` | object | `{"operator":{"extraEgressRules":[]}}` | Allow use of extra egress rules for cilium network policies |
|
||||
| `networkPolicy.enabled` | bool | `false` | Enable network policies |
|
||||
| `networkPolicy.flavor` | string | `"cilium"` | Flavor of the network policies (cilium) |
|
||||
| `nodeSelector` | object | `{}` | Node selector for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/)) |
|
||||
| `podIdentity.aws.irsa.audience` | string | `"sts.amazonaws.com"` | Sets the token audience for IRSA. This will be set as an annotation on the KEDA service account. |
|
||||
| `podIdentity.aws.irsa.enabled` | bool | `false` | Specifies whether [AWS IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) is to be enabled or not. |
|
||||
| `podIdentity.aws.irsa.roleArn` | string | `""` | Set to the value of the ARN of an IAM role with a web identity provider. This will be set as an annotation on the KEDA service account. |
|
||||
| `podIdentity.aws.irsa.stsRegionalEndpoints` | string | `"true"` | Sets the use of an STS regional endpoint instead of global. Recommended to use regional endpoint in almost all cases. This will be set as an annotation on the KEDA service account. |
|
||||
| `podIdentity.aws.irsa.tokenExpiration` | int | `86400` | Set to the value of the service account token expiration duration. This will be set as an annotation on the KEDA service account. |
|
||||
| `podIdentity.azureWorkload.clientId` | string | `""` | Id of Azure Active Directory Client to use for authentication with Azure Workload Identity. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity)) |
|
||||
| `podIdentity.azureWorkload.enabled` | bool | `false` | Set to true to enable Azure Workload Identity usage. See https://keda.sh/docs/concepts/authentication/#azure-workload-identity This will be set as a label on the KEDA service account. |
|
||||
| `podIdentity.azureWorkload.tenantId` | string | `""` | Id Azure Active Directory Tenant to use for authentication with for Azure Workload Identity. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity)) |
|
||||
| `podIdentity.azureWorkload.tokenExpiration` | int | `3600` | Duration in seconds to automatically expire tokens for the service account. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity)) |
|
||||
| `podIdentity.gcp.enabled` | bool | `false` | Set to true to enable GCP Workload Identity. See https://keda.sh/docs/2.10/authentication-providers/gcp-workload-identity/ This will be set as a annotation on the KEDA service account. |
|
||||
| `podIdentity.gcp.gcpIAMServiceAccount` | string | `""` | GCP IAM Service Account Email which you would like to use for workload identity. |
|
||||
| `podSecurityContext` | object | [See below](#KEDA-is-secure-by-default) | [Pod security context] for all pods |
|
||||
| `priorityClassName` | string | `""` | priorityClassName for all KEDA components |
|
||||
| `rbac.aggregateToDefaultRoles` | bool | `false` | Specifies whether RBAC for CRDs should be [aggregated](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles) to default roles (view, edit, admin) |
|
||||
| `rbac.controlPlaneServiceAccountsNamespace` | string | `"kube-system"` | Customize the namespace of k8s metrics-server deployment This could also be achieved by the Kubernetes control plane manager flag --use-service-account-credentials: [docs](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/) |
|
||||
| `rbac.create` | bool | `true` | Specifies whether RBAC should be used |
|
||||
| `rbac.enabledCustomScaledRefKinds` | bool | `true` | Whether RBAC for configured CRDs that can have a `scale` subresource should be created |
|
||||
| `rbac.scaledRefKinds` | list | `[{"apiGroup":"*","kind":"*"}]` | List of custom resources that support the `scale` subresource and can be referenced by `scaledobject.spec.scaleTargetRef`. The feature needs to be also enabled by `enabledCustomScaledRefKinds`. If left empty, RBAC for `apiGroups: *` and `resources: *, */scale` will be created note: Deployments and StatefulSets are supported out of the box |
|
||||
| `securityContext` | object | [See below](#KEDA-is-secure-by-default) | [Security context] for all containers |
|
||||
| `tolerations` | list | `[]` | Tolerations for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)) |
|
||||
| `watchNamespace` | string | `""` | Defines Kubernetes namespaces to watch to scale their workloads. Default watches all namespaces |
|
||||
|
||||
### Operator
|
||||
|
||||
| Parameter | Type | Default | Description |
|
||||
|-----------|------|---------|-------------|
|
||||
| `certificates.operator` | string | `nil` | |
|
||||
| `extraArgs.keda` | object | `{}` | Additional KEDA Operator container arguments |
|
||||
| `image.keda.registry` | string | `"ghcr.io"` | Image registry of KEDA operator |
|
||||
| `image.keda.repository` | string | `"kedacore/keda"` | Image name of KEDA operator |
|
||||
| `image.keda.tag` | string | `""` | Image tag of KEDA operator. Optional, given app version of Helm chart is used by default |
|
||||
| `logging.operator.format` | string | `"console"` | Logging format for KEDA Operator. allowed values: `json` or `console` |
|
||||
| `logging.operator.level` | string | `"info"` | Logging level for KEDA Operator. allowed values: `debug`, `info`, `error`, or an integer value greater than 0, specified as string |
|
||||
| `logging.operator.stackTracesEnabled` | bool | `false` | If enabled, the stack traces will be also printed |
|
||||
| `logging.operator.timeEncoding` | string | `"rfc3339"` | Logging time encoding for KEDA Operator. allowed values are `epoch`, `millis`, `nano`, `iso8601`, `rfc3339` or `rfc3339nano` |
|
||||
| `operator.affinity` | object | `{}` | [Affinity] for pod scheduling for KEDA operator. Takes precedence over the `affinity` field |
|
||||
| `operator.disableCompression` | bool | `true` | Disable response compression for k8s restAPI in client-go. Disabling compression simply means that turns off the process of making data smaller for K8s restAPI in client-go for faster transmission. |
|
||||
| `operator.extraContainers` | list | `[]` | Additional containers to run as part of the operator deployment |
|
||||
| `operator.extraInitContainers` | list | `[]` | Additional init containers to run as part of the operator deployment |
|
||||
| `operator.livenessProbe` | object | `{"failureThreshold":3,"initialDelaySeconds":25,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1}` | Liveness probes for operator ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)) |
|
||||
| `operator.name` | string | `"keda-operator"` | Name of the KEDA operator |
|
||||
| `operator.readinessProbe` | object | `{"failureThreshold":3,"initialDelaySeconds":20,"periodSeconds":3,"successThreshold":1,"timeoutSeconds":1}` | Readiness probes for operator ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes)) |
|
||||
| `operator.replicaCount` | int | `1` | Capability to configure the number of replicas for KEDA operator. While you can run more replicas of our operator, only one operator instance will be the leader and serving traffic. You can run multiple replicas, but they will not improve the performance of KEDA, it could only reduce downtime during a failover. Learn more in [our documentation](https://keda.sh/docs/latest/operate/cluster/#high-availability). |
|
||||
| `operator.revisionHistoryLimit` | int | `10` | ReplicaSets for this Deployment you want to retain (Default: 10) |
|
||||
| `permissions.operator.restrict.namesAllowList` | list | `[]` | Array of strings denoting what secrets the KEDA operator will be able to read, this takes into account also the configured `watchNamespace`. the default is an empty array -> no restriction on the secret name |
|
||||
| `permissions.operator.restrict.secret` | bool | `false` | Restrict Secret Access for KEDA operator if true, KEDA operator will be able to read only secrets in {{ .Release.Namespace }} namespace |
|
||||
| `permissions.operator.restrict.serviceAccountTokenCreationRoles` | list | `[]` | Creates roles and rolebindings from namespaced service accounts in the array which allow the KEDA operator to request service account tokens for use with the boundServiceAccountToken trigger source. If the namespace does not exist, this will cause the helm chart installation to fail. |
|
||||
| `podAnnotations.keda` | object | `{}` | Pod annotations for KEDA operator |
|
||||
| `podDisruptionBudget.operator` | object | `{}` | Capability to configure [Pod Disruption Budget] |
|
||||
| `podLabels.keda` | object | `{}` | Pod labels for KEDA operator |
|
||||
| `podSecurityContext.operator` | object | [See below](#KEDA-is-secure-by-default) | [Pod security context] of the KEDA operator pod |
|
||||
| `resources.operator` | object | `{"limits":{"cpu":1,"memory":"1000Mi"},"requests":{"cpu":"100m","memory":"100Mi"}}` | Manage [resource request & limits] of KEDA operator pod |
|
||||
| `securityContext.operator` | object | [See below](#KEDA-is-secure-by-default) | [Security context] of the operator container |
|
||||
| `serviceAccount.operator.annotations` | object | `{}` | Annotations to add to the service account |
|
||||
| `serviceAccount.operator.automountServiceAccountToken` | bool | `true` | Specifies whether a service account should automount API-Credentials |
|
||||
| `serviceAccount.operator.create` | bool | `true` | Specifies whether a service account should be created |
|
||||
| `serviceAccount.operator.name` | string | `"keda-operator"` | The name of the service account to use. |
|
||||
| `topologySpreadConstraints.operator` | list | `[]` | [Pod Topology Constraints] of KEDA operator pod |
|
||||
| `upgradeStrategy.operator` | object | `{}` | Capability to configure [Deployment upgrade strategy] for operator |
|
||||
| `volumes.keda.extraVolumeMounts` | list | `[]` | Extra volume mounts for KEDA deployment |
|
||||
| `volumes.keda.extraVolumes` | list | `[]` | Extra volumes for KEDA deployment |
|
||||
|
||||
### Metrics server
|
||||
|
||||
| Parameter | Type | Default | Description |
|
||||
|-----------|------|---------|-------------|
|
||||
| `extraArgs.metricsAdapter` | object | `{}` | Additional Metrics Adapter container arguments |
|
||||
| `image.metricsApiServer.registry` | string | `"ghcr.io"` | Image registry of KEDA Metrics API Server |
|
||||
| `image.metricsApiServer.repository` | string | `"kedacore/keda-metrics-apiserver"` | Image name of KEDA Metrics API Server |
|
||||
| `image.metricsApiServer.tag` | string | `""` | Image tag of KEDA Metrics API Server. Optional, given app version of Helm chart is used by default |
|
||||
| `logging.metricServer.level` | int | `0` | Logging level for Metrics Server. allowed values: `0` for info, `4` for debug, or an integer value greater than 0, specified as string |
|
||||
| `logging.metricServer.stderrthreshold` | string | `"ERROR"` | Logging stderrthreshold for Metrics Server allowed values: 'DEBUG','INFO','WARN','ERROR','ALERT','EMERG' |
|
||||
| `metricsServer.affinity` | object | `{}` | [Affinity] for pod scheduling for Metrics API Server. Takes precedence over the `affinity` field |
|
||||
| `metricsServer.disableCompression` | bool | `true` | Disable response compression for k8s restAPI in client-go. Disabling compression simply means that turns off the process of making data smaller for K8s restAPI in client-go for faster transmission. |
|
||||
| `metricsServer.dnsPolicy` | string | `"ClusterFirst"` | Defined the DNS policy for the metric server |
|
||||
| `metricsServer.livenessProbe` | object | `{"failureThreshold":3,"initialDelaySeconds":5,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1}` | Liveness probes for Metrics API Server ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)) |
|
||||
| `metricsServer.readinessProbe` | object | `{"failureThreshold":3,"initialDelaySeconds":5,"periodSeconds":3,"successThreshold":1,"timeoutSeconds":1}` | Readiness probes for Metrics API Server ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes)) |
|
||||
| `metricsServer.replicaCount` | int | `1` | Capability to configure the number of replicas for KEDA metric server. While you can run more replicas of our metric server, only one instance will used and serve traffic. You can run multiple replicas, but they will not improve the performance of KEDA, it could only reduce downtime during a failover. Learn more in [our documentation](https://keda.sh/docs/latest/operate/cluster/#high-availability). |
|
||||
| `metricsServer.revisionHistoryLimit` | int | `10` | ReplicaSets for this Deployment you want to retain (Default: 10) |
|
||||
| `metricsServer.useHostNetwork` | bool | `false` | Enable metric server to use host network |
|
||||
| `permissions.metricServer.restrict.secret` | bool | `false` | Restrict Secret Access for Metrics Server |
|
||||
| `podAnnotations.metricsAdapter` | object | `{}` | Pod annotations for KEDA Metrics Adapter |
|
||||
| `podDisruptionBudget.metricServer` | object | `{}` | Capability to configure [Pod Disruption Budget] |
|
||||
| `podLabels.metricsAdapter` | object | `{}` | Pod labels for KEDA Metrics Adapter |
|
||||
| `podSecurityContext.metricServer` | object | [See below](#KEDA-is-secure-by-default) | [Pod security context] of the KEDA metrics apiserver pod |
|
||||
| `resources.metricServer` | object | `{"limits":{"cpu":1,"memory":"1000Mi"},"requests":{"cpu":"100m","memory":"100Mi"}}` | Manage [resource request & limits] of KEDA metrics apiserver pod |
|
||||
| `securityContext.metricServer` | object | [See below](#KEDA-is-secure-by-default) | [Security context] of the metricServer container |
|
||||
| `service.annotations` | object | `{}` | Annotations to add the KEDA Metric Server service |
|
||||
| `service.portHttps` | int | `443` | HTTPS port for KEDA Metric Server service |
|
||||
| `service.portHttpsTarget` | int | `6443` | HTTPS port for KEDA Metric Server container |
|
||||
| `service.type` | string | `"ClusterIP"` | KEDA Metric Server service type |
|
||||
| `serviceAccount.metricServer.annotations` | object | `{}` | Annotations to add to the service account |
|
||||
| `serviceAccount.metricServer.automountServiceAccountToken` | bool | `true` | Specifies whether a service account should automount API-Credentials |
|
||||
| `serviceAccount.metricServer.create` | bool | `true` | Specifies whether a service account should be created |
|
||||
| `serviceAccount.metricServer.name` | string | `"keda-metrics-server"` | The name of the service account to use. |
|
||||
| `topologySpreadConstraints.metricsServer` | list | `[]` | [Pod Topology Constraints] of KEDA metrics apiserver pod |
|
||||
| `upgradeStrategy.metricsApiServer` | object | `{}` | Capability to configure [Deployment upgrade strategy] for Metrics Api Server |
|
||||
| `volumes.metricsApiServer.extraVolumeMounts` | list | `[]` | Extra volume mounts for metric server deployment |
|
||||
| `volumes.metricsApiServer.extraVolumes` | list | `[]` | Extra volumes for metric server deployment |
|
||||
|
||||
### Operations
|
||||
|
||||
| Parameter | Type | Default | Description |
|
||||
|-----------|------|---------|-------------|
|
||||
| `opentelemetry.collector.uri` | string | `""` | Uri of OpenTelemetry Collector to push telemetry to |
|
||||
| `opentelemetry.operator.enabled` | bool | `false` | Enable pushing metrics to an OpenTelemetry Collector for operator |
|
||||
| `prometheus.metricServer.enabled` | bool | `false` | Enable metric server Prometheus metrics expose |
|
||||
| `prometheus.metricServer.podMonitor.additionalLabels` | object | `{}` | Additional labels to add for metric server using podMonitor crd (prometheus operator) |
|
||||
| `prometheus.metricServer.podMonitor.enabled` | bool | `false` | Enables PodMonitor creation for the Prometheus Operator |
|
||||
| `prometheus.metricServer.podMonitor.interval` | string | `""` | Scraping interval for metric server using podMonitor crd (prometheus operator) |
|
||||
| `prometheus.metricServer.podMonitor.metricRelabelings` | list | `[]` | List of expressions that define custom metric relabeling rules for metric server PodMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.metricServer.podMonitor.namespace` | string | `""` | Scraping namespace for metric server using podMonitor crd (prometheus operator) |
|
||||
| `prometheus.metricServer.podMonitor.relabelings` | list | `[]` | List of expressions that define custom relabeling rules for metric server podMonitor crd (prometheus operator) |
|
||||
| `prometheus.metricServer.podMonitor.scrapeTimeout` | string | `""` | Scraping timeout for metric server using podMonitor crd (prometheus operator) |
|
||||
| `prometheus.metricServer.port` | int | `8080` | HTTP port used for exposing metrics server prometheus metrics |
|
||||
| `prometheus.metricServer.portName` | string | `"metrics"` | HTTP port name for exposing metrics server prometheus metrics |
|
||||
| `prometheus.metricServer.serviceMonitor` | object | `{"additionalLabels":{},"enabled":false,"interval":"","jobLabel":"","metricRelabelings":[],"podTargetLabels":[],"port":"metrics","relabelings":[],"relabellings":[],"scheme":"http","scrapeTimeout":"","targetLabels":[],"targetPort":"","tlsConfig":{}}` | App Protocol for service when scraping metrics endpoint appProtocol: http |
|
||||
| `prometheus.metricServer.serviceMonitor.additionalLabels` | object | `{}` | Additional labels to add for metric server using ServiceMonitor crd (prometheus operator) |
|
||||
| `prometheus.metricServer.serviceMonitor.enabled` | bool | `false` | Enables ServiceMonitor creation for the Prometheus Operator |
|
||||
| `prometheus.metricServer.serviceMonitor.interval` | string | `""` | Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used. |
|
||||
| `prometheus.metricServer.serviceMonitor.jobLabel` | string | `""` | JobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec] |
|
||||
| `prometheus.metricServer.serviceMonitor.metricRelabelings` | list | `[]` | List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.metricServer.serviceMonitor.podTargetLabels` | list | `[]` | PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics |
|
||||
| `prometheus.metricServer.serviceMonitor.port` | string | `"metrics"` | Name of the service port this endpoint refers to. Mutually exclusive with targetPort |
|
||||
| `prometheus.metricServer.serviceMonitor.relabelings` | list | `[]` | List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.metricServer.serviceMonitor.relabellings` | list | `[]` | DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.metricServer.serviceMonitor.scheme` | string | `"http"` | HTTP scheme used for scraping. Defaults to `http` |
|
||||
| `prometheus.metricServer.serviceMonitor.scrapeTimeout` | string | `""` | Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used |
|
||||
| `prometheus.metricServer.serviceMonitor.targetLabels` | list | `[]` | TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics |
|
||||
| `prometheus.metricServer.serviceMonitor.targetPort` | string | `""` | Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port |
|
||||
| `prometheus.metricServer.serviceMonitor.tlsConfig` | object | `{}` | TLS configuration for scraping metrics |
|
||||
| `prometheus.operator.enabled` | bool | `false` | Enable KEDA Operator prometheus metrics expose |
|
||||
| `prometheus.operator.podMonitor.additionalLabels` | object | `{}` | Additional labels to add for KEDA Operator using podMonitor crd (prometheus operator) |
|
||||
| `prometheus.operator.podMonitor.enabled` | bool | `false` | Enables PodMonitor creation for the Prometheus Operator |
|
||||
| `prometheus.operator.podMonitor.interval` | string | `""` | Scraping interval for KEDA Operator using podMonitor crd (prometheus operator) |
|
||||
| `prometheus.operator.podMonitor.metricRelabelings` | list | `[]` | List of expressions that define custom metric relabeling rules for metric server PodMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.operator.podMonitor.namespace` | string | `""` | Scraping namespace for KEDA Operator using podMonitor crd (prometheus operator) |
|
||||
| `prometheus.operator.podMonitor.relabelings` | list | `[]` | List of expressions that define custom relabeling rules for KEDA Operator podMonitor crd (prometheus operator) |
|
||||
| `prometheus.operator.podMonitor.scrapeTimeout` | string | `""` | Scraping timeout for KEDA Operator using podMonitor crd (prometheus operator) |
|
||||
| `prometheus.operator.port` | int | `8080` | Port used for exposing KEDA Operator prometheus metrics |
|
||||
| `prometheus.operator.prometheusRules.additionalLabels` | object | `{}` | Additional labels to add for KEDA Operator using prometheusRules crd (prometheus operator) |
|
||||
| `prometheus.operator.prometheusRules.alerts` | list | `[]` | Additional alerts to add for KEDA Operator using prometheusRules crd (prometheus operator) |
|
||||
| `prometheus.operator.prometheusRules.enabled` | bool | `false` | Enables PrometheusRules creation for the Prometheus Operator |
|
||||
| `prometheus.operator.prometheusRules.namespace` | string | `""` | Scraping namespace for KEDA Operator using prometheusRules crd (prometheus operator) |
|
||||
| `prometheus.operator.serviceMonitor` | object | `{"additionalLabels":{},"enabled":false,"interval":"","jobLabel":"","metricRelabelings":[],"podTargetLabels":[],"port":"metrics","relabelings":[],"relabellings":[],"scheme":"http","scrapeTimeout":"","targetLabels":[],"targetPort":"","tlsConfig":{}}` | App Protocol for service when scraping metrics endpoint appProtocol: http |
|
||||
| `prometheus.operator.serviceMonitor.additionalLabels` | object | `{}` | Additional labels to add for metric server using ServiceMonitor crd (prometheus operator) |
|
||||
| `prometheus.operator.serviceMonitor.enabled` | bool | `false` | Enables ServiceMonitor creation for the Prometheus Operator |
|
||||
| `prometheus.operator.serviceMonitor.interval` | string | `""` | Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used. |
|
||||
| `prometheus.operator.serviceMonitor.jobLabel` | string | `""` | JobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec] |
|
||||
| `prometheus.operator.serviceMonitor.metricRelabelings` | list | `[]` | List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.operator.serviceMonitor.podTargetLabels` | list | `[]` | PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics |
|
||||
| `prometheus.operator.serviceMonitor.port` | string | `"metrics"` | Name of the service port this endpoint refers to. Mutually exclusive with targetPort |
|
||||
| `prometheus.operator.serviceMonitor.relabelings` | list | `[]` | List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.operator.serviceMonitor.relabellings` | list | `[]` | DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.operator.serviceMonitor.scheme` | string | `"http"` | HTTP scheme used for scraping. Defaults to `http` |
|
||||
| `prometheus.operator.serviceMonitor.scrapeTimeout` | string | `""` | Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used |
|
||||
| `prometheus.operator.serviceMonitor.targetLabels` | list | `[]` | TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics |
|
||||
| `prometheus.operator.serviceMonitor.targetPort` | string | `""` | Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port |
|
||||
| `prometheus.operator.serviceMonitor.tlsConfig` | object | `{}` | TLS configuration for scraping metrics |
|
||||
| `prometheus.webhooks.enabled` | bool | `false` | Enable KEDA admission webhooks prometheus metrics expose |
|
||||
| `prometheus.webhooks.port` | int | `8080` | Port used for exposing KEDA admission webhooks prometheus metrics |
|
||||
| `prometheus.webhooks.prometheusRules.additionalLabels` | object | `{}` | Additional labels to add for KEDA admission webhooks using prometheusRules crd (prometheus operator) |
|
||||
| `prometheus.webhooks.prometheusRules.alerts` | list | `[]` | Additional alerts to add for KEDA admission webhooks using prometheusRules crd (prometheus operator) |
|
||||
| `prometheus.webhooks.prometheusRules.enabled` | bool | `false` | Enables PrometheusRules creation for the Prometheus Operator |
|
||||
| `prometheus.webhooks.prometheusRules.namespace` | string | `""` | Scraping namespace for KEDA admission webhooks using prometheusRules crd (prometheus operator) |
|
||||
| `prometheus.webhooks.serviceMonitor` | object | `{"additionalLabels":{},"enabled":false,"interval":"","jobLabel":"","metricRelabelings":[],"podTargetLabels":[],"port":"metrics","relabelings":[],"relabellings":[],"scheme":"http","scrapeTimeout":"","targetLabels":[],"targetPort":"","tlsConfig":{}}` | App Protocol for service when scraping metrics endpoint appProtocol: http |
|
||||
| `prometheus.webhooks.serviceMonitor.additionalLabels` | object | `{}` | Additional labels to add for metric server using ServiceMonitor crd (prometheus operator) |
|
||||
| `prometheus.webhooks.serviceMonitor.enabled` | bool | `false` | Enables ServiceMonitor creation for the Prometheus webhooks |
|
||||
| `prometheus.webhooks.serviceMonitor.interval` | string | `""` | Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used. |
|
||||
| `prometheus.webhooks.serviceMonitor.jobLabel` | string | `""` | jobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec] |
|
||||
| `prometheus.webhooks.serviceMonitor.metricRelabelings` | list | `[]` | List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.webhooks.serviceMonitor.podTargetLabels` | list | `[]` | PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics |
|
||||
| `prometheus.webhooks.serviceMonitor.port` | string | `"metrics"` | Name of the service port this endpoint refers to. Mutually exclusive with targetPort |
|
||||
| `prometheus.webhooks.serviceMonitor.relabelings` | list | `[]` | List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.webhooks.serviceMonitor.relabellings` | list | `[]` | DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec] |
|
||||
| `prometheus.webhooks.serviceMonitor.scheme` | string | `"http"` | HTTP scheme used for scraping. Defaults to `http` |
|
||||
| `prometheus.webhooks.serviceMonitor.scrapeTimeout` | string | `""` | Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used |
|
||||
| `prometheus.webhooks.serviceMonitor.targetLabels` | list | `[]` | TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics |
|
||||
| `prometheus.webhooks.serviceMonitor.targetPort` | string | `""` | Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port |
|
||||
| `prometheus.webhooks.serviceMonitor.tlsConfig` | object | `{}` | TLS configuration for scraping metrics |
|
||||
|
||||
### Troubleshooting
|
||||
|
||||
| Parameter | Type | Default | Description |
|
||||
|-----------|------|---------|-------------|
|
||||
| `profiling.metricsServer.enabled` | bool | `false` | Enable profiling for KEDA metrics server |
|
||||
| `profiling.metricsServer.port` | int | `8083` | Expose profiling on a specific port |
|
||||
| `profiling.operator.enabled` | bool | `false` | Enable profiling for KEDA operator |
|
||||
| `profiling.operator.port` | int | `8082` | Expose profiling on a specific port |
|
||||
| `profiling.webhooks.enabled` | bool | `false` | Enable profiling for KEDA admission webhook |
|
||||
| `profiling.webhooks.port` | int | `8084` | Expose profiling on a specific port |
|
||||
|
||||
### Admission Webhooks
|
||||
|
||||
| Parameter | Type | Default | Description |
|
||||
|-----------|------|---------|-------------|
|
||||
| `image.webhooks.registry` | string | `"ghcr.io"` | Image registry of KEDA admission-webhooks |
|
||||
| `image.webhooks.repository` | string | `"kedacore/keda-admission-webhooks"` | Image name of KEDA admission-webhooks |
|
||||
| `image.webhooks.tag` | string | `""` | Image tag of KEDA admission-webhooks . Optional, given app version of Helm chart is used by default |
|
||||
| `logging.webhooks.format` | string | `"console"` | Logging format for KEDA Admission webhooks. allowed values: `json` or `console` |
|
||||
| `logging.webhooks.level` | string | `"info"` | Logging level for KEDA Operator. allowed values: `debug`, `info`, `error`, or an integer value greater than 0, specified as string |
|
||||
| `logging.webhooks.timeEncoding` | string | `"rfc3339"` | Logging time encoding for KEDA Operator. allowed values are `epoch`, `millis`, `nano`, `iso8601`, `rfc3339` or `rfc3339nano` |
|
||||
| `podAnnotations.webhooks` | object | `{}` | Pod annotations for KEDA Admission webhooks |
|
||||
| `podDisruptionBudget.webhooks` | object | `{}` | Capability to configure [Pod Disruption Budget] |
|
||||
| `podLabels.webhooks` | object | `{}` | Pod labels for KEDA Admission webhooks |
|
||||
| `podSecurityContext.webhooks` | object | [See below](#KEDA-is-secure-by-default) | [Pod security context] of the KEDA admission webhooks |
|
||||
| `resources.webhooks` | object | `{"limits":{"cpu":1,"memory":"1000Mi"},"requests":{"cpu":"100m","memory":"100Mi"}}` | Manage [resource request & limits] of KEDA admission webhooks pod |
|
||||
| `securityContext.webhooks` | object | [See below](#KEDA-is-secure-by-default) | [Security context] of the admission webhooks container |
|
||||
| `serviceAccount.webhooks.annotations` | object | `{}` | Annotations to add to the service account |
|
||||
| `serviceAccount.webhooks.automountServiceAccountToken` | bool | `true` | Specifies whether a service account should automount API-Credentials |
|
||||
| `serviceAccount.webhooks.create` | bool | `true` | Specifies whether a service account should be created |
|
||||
| `serviceAccount.webhooks.name` | string | `"keda-webhook"` | The name of the service account to use. |
|
||||
| `topologySpreadConstraints.webhooks` | list | `[]` | [Pod Topology Constraints] of KEDA admission webhooks pod |
|
||||
| `upgradeStrategy.webhooks` | object | `{}` | Capability to configure [Deployment upgrade strategy] for Admission webhooks |
|
||||
| `volumes.webhooks.extraVolumeMounts` | list | `[]` | Extra volume mounts for admission webhooks deployment |
|
||||
| `volumes.webhooks.extraVolumes` | list | `[]` | Extra volumes for admission webhooks deployment |
|
||||
| `webhooks.affinity` | object | `{}` | [Affinity] for pod scheduling for KEDA admission webhooks. Takes precedence over the `affinity` field |
|
||||
| `webhooks.enabled` | bool | `true` | |
|
||||
| `webhooks.failurePolicy` | string | `"Ignore"` | [Failure policy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy) to use with KEDA admission webhooks |
|
||||
| `webhooks.healthProbePort` | int | `8081` | Port number to use for KEDA admission webhooks health probe |
|
||||
| `webhooks.livenessProbe` | object | `{"failureThreshold":3,"initialDelaySeconds":25,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1}` | Liveness probes for admission webhooks ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)) |
|
||||
| `webhooks.name` | string | `"keda-admission-webhooks"` | Name of the KEDA admission webhooks |
|
||||
| `webhooks.port` | string | `""` | Port number to use for KEDA admission webhooks. Default is 9443. |
|
||||
| `webhooks.readinessProbe` | object | `{"failureThreshold":3,"initialDelaySeconds":20,"periodSeconds":3,"successThreshold":1,"timeoutSeconds":1}` | Readiness probes for admission webhooks ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes)) |
|
||||
| `webhooks.replicaCount` | int | `1` | Capability to configure the number of replicas for KEDA admission webhooks |
|
||||
| `webhooks.revisionHistoryLimit` | int | `10` | ReplicaSets for this Deployment you want to retain (Default: 10) |
|
||||
| `webhooks.timeoutSeconds` | int | `10` | Timeout in seconds for KEDA admission webhooks |
|
||||
| `webhooks.useHostNetwork` | bool | `false` | Enable webhook to use host network, this is required on EKS with custom CNI |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to
|
||||
`helm install`. For example:
|
||||
|
||||
```console
|
||||
$ helm install keda kedacore/keda --namespace keda \
|
||||
--set image.keda.tag=<different tag from app version> \
|
||||
--set image.metricsApiServer.tag=<different tag from app version> \
|
||||
--set image.webhooks.tag=<different tag from app version>
|
||||
```
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can
|
||||
be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
helm install keda kedacore/keda --namespace keda -f values.yaml
|
||||
```
|
||||
|
||||
## KEDA is secure by default
|
||||
|
||||
Our default configuration strives to be as secure as possible. Because of that, KEDA will run as non-root and be secure-by-default:
|
||||
```yaml
|
||||
securityContext:
|
||||
operator:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
metricServer:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
## Metrics server needs to write the self-signed cert. See FAQ for discussion of options.
|
||||
# readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
webhooks:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
podSecurityContext:
|
||||
operator:
|
||||
runAsNonRoot: true
|
||||
metricServer:
|
||||
runAsNonRoot: true
|
||||
webhooks:
|
||||
runAsNonRoot: true
|
||||
```
|
||||
|
||||
----------------------------------------------
|
||||
Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs)
|
||||
|
||||
[Affinity]: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/
|
||||
[Deployment upgrade strategy]: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
|
||||
[GCP Workload Identity]: https://keda.sh/docs/2.10/authentication-providers/gcp-workload-identity/
|
||||
[Pod Disruption Budget]: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
|
||||
[Pod security context]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
[Security context]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
[Pod Topology Constraints]: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
[RelabelConfig Spec]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.RelabelConfig
|
||||
[resource request & limits]: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
[ServiceMonitor Spec]: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.ServiceMonitor
|
||||
@@ -0,0 +1,72 @@
|
||||
{{- if .Values.asciiArt }}
|
||||
:::^. .::::^: ::::::::::::::: .:::::::::. .^.
|
||||
7???~ .^7????~. 7??????????????. :?????????77!^. .7?7.
|
||||
7???~ ^7???7~. ~!!!!!!!!!!!!!!. :????!!!!7????7~. .7???7.
|
||||
7???~^7????~. :????: :~7???7. :7?????7.
|
||||
7???7????!. ::::::::::::. :????: .7???! :7??77???7.
|
||||
7????????7: 7???????????~ :????: :????: :???7?5????7.
|
||||
7????!~????^ !77777777777^ :????: :????: ^???7?#P7????7.
|
||||
7???~ ^????~ :????: :7???! ^???7J#@J7?????7.
|
||||
7???~ :7???!. :????: .:~7???!. ~???7Y&@#7777????7.
|
||||
7???~ .7???7: !!!!!!!!!!!!!!! :????7!!77????7^ ~??775@@@GJJYJ?????7.
|
||||
7???~ .!????^ 7?????????????7. :?????????7!~: !????G@@@@@@@@5??????7:
|
||||
::::. ::::: ::::::::::::::: .::::::::.. .::::JGGGB@@@&7:::::::::
|
||||
?@@#~
|
||||
P@B^
|
||||
:&G:
|
||||
!5.
|
||||
.
|
||||
{{- end -}}
|
||||
|
||||
Kubernetes Event-driven Autoscaling (KEDA) - Application autoscaling made simple.
|
||||
|
||||
Get started by deploying Scaled Objects to your cluster:
|
||||
- Information about Scaled Objects : https://keda.sh/docs/latest/concepts/
|
||||
- Samples: https://github.com/kedacore/samples
|
||||
|
||||
Get information about the deployed ScaledObjects:
|
||||
kubectl get scaledobject [--namespace <namespace>]
|
||||
|
||||
Get details about a deployed ScaledObject:
|
||||
kubectl describe scaledobject <scaled-object-name> [--namespace <namespace>]
|
||||
|
||||
Get information about the deployed ScaledObjects:
|
||||
kubectl get triggerauthentication [--namespace <namespace>]
|
||||
|
||||
Get details about a deployed ScaledObject:
|
||||
kubectl describe triggerauthentication <trigger-authentication-name> [--namespace <namespace>]
|
||||
|
||||
Get an overview of the Horizontal Pod Autoscalers (HPA) that KEDA is using behind the scenes:
|
||||
kubectl get hpa [--all-namespaces] [--namespace <namespace>]
|
||||
|
||||
{{- if .Values.prometheus.operator.serviceMonitor.relabellings}}
|
||||
-------------------------------------------------------------------------------------
|
||||
WARNING - prometheus.operator.serviceMonitor.relabellings is deprecated, please migrate to prometheus.operator.serviceMonitor.relabelings instead.
|
||||
-------------------------------------------------------------------------------------
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.metricServer.serviceMonitor.relabellings}}
|
||||
WARNING - prometheus.metricServer.serviceMonitor.relabellings is deprecated, please migrate to prometheus.metricServer.serviceMonitor.relabelings instead.
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.webhooks.serviceMonitor.relabellings}}
|
||||
-------------------------------------------------------------------------------------
|
||||
WARNING - prometheus.webhooks.serviceMonitor.relabellings is deprecated, please migrate to prometheus.webhooks.serviceMonitor.relabelings instead.
|
||||
-------------------------------------------------------------------------------------
|
||||
{{- end }}
|
||||
|
||||
{{- if lt .Capabilities.KubeVersion.Minor "28" }}
|
||||
-------------------------------------------------------------------------------------
|
||||
WARNING - Running on unsupported Kubernetes version "1.{{.Capabilities.KubeVersion.Minor}}". KEDA 2.13 is supported and tested on Kubernetes "1.28" or higher. See https://keda.sh/docs/latest/operate/cluster/ for details.
|
||||
-------------------------------------------------------------------------------------
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.serviceAccount.name }}
|
||||
-------------------------------------------------------------------------------------
|
||||
WARNING - .serviceAccount.name has been deprecated, please migrate to newest version of the Helm Chart values that allows overriding the service account name for each KEDA component.
|
||||
New version: serviceAccount.{operator,metricServer,webhooks}.{create,name,automountServiceAccountToken,annotations}
|
||||
-------------------------------------------------------------------------------------
|
||||
{{- end }}
|
||||
|
||||
Learn more about KEDA:
|
||||
- Documentation: https://keda.sh/
|
||||
- Support: https://keda.sh/support/
|
||||
- File an issue: https://github.com/kedacore/keda/issues/new/choose
|
||||
@@ -0,0 +1,32 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "keda.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate basic labels for CRD
|
||||
*/}}
|
||||
{{- define "keda.crd-labels" }}
|
||||
helm.sh/chart: {{ include "keda.chart" . }}
|
||||
app.kubernetes.io/component: operator
|
||||
app.kubernetes.io/managed-by: {{ .Values.customManagedBy | default .Release.Service }}
|
||||
app.kubernetes.io/part-of: {{ .Values.operator.name }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Generate basic labels
|
||||
*/}}
|
||||
{{- define "keda.labels" -}}
|
||||
{{- include "keda.crd-labels" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Values.additionalLabels }}
|
||||
{{ toYaml .Values.additionalLabels }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if and .Values.certificates.certManager.enabled .Values.certificates.certManager.issuer.generate }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ .Values.operator.name }}-issuer
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
ca:
|
||||
secretName: {{ .Values.certificates.certManager.caSecretName }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- if .Values.certificates.certManager.enabled }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}-tls-certificates
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
commonName: {{ .Values.operator.name }}
|
||||
dnsNames:
|
||||
- {{ .Values.operator.name }}.{{ .Release.Namespace }}
|
||||
- {{ .Values.operator.name }}.{{ .Release.Namespace }}.svc
|
||||
- {{ .Values.operator.name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
|
||||
- {{ .Values.operator.name }}-metrics-apiserver.{{ .Release.Namespace }}
|
||||
- {{ .Values.operator.name }}-metrics-apiserver.{{ .Release.Namespace }}.svc
|
||||
- {{ .Values.operator.name }}-metrics-apiserver.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
|
||||
- {{ .Values.webhooks.name }}.{{ .Release.Namespace }}
|
||||
- {{ .Values.webhooks.name }}.{{ .Release.Namespace }}.svc
|
||||
- {{ .Values.webhooks.name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
|
||||
secretName: {{ .Values.certificates.secretName }}
|
||||
secretTemplate:
|
||||
{{- toYaml .Values.certificates.certManager.secretTemplate | nindent 4 }}
|
||||
usages:
|
||||
- server auth
|
||||
- client auth
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 2048
|
||||
duration: {{ .Values.certificates.certManager.duration }}
|
||||
renewBefore: {{ .Values.certificates.certManager.renewBefore }}
|
||||
issuerRef:
|
||||
{{- if .Values.certificates.certManager.issuer.generate }}
|
||||
name: {{ .Values.operator.name }}-issuer
|
||||
kind: Issuer
|
||||
group: cert-manager.io
|
||||
{{- else }}
|
||||
{{- if .Values.certificates.certManager.issuer.name }}
|
||||
name: {{ .Values.certificates.certManager.issuer.name }}
|
||||
{{- end }}
|
||||
{{- if .Values.certificates.certManager.issuer.kind }}
|
||||
kind: {{ .Values.certificates.certManager.issuer.kind }}
|
||||
{{- end }}
|
||||
{{- if .Values.certificates.certManager.issuer.group }}
|
||||
group: {{ .Values.certificates.certManager.issuer.group }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- if and .Values.certificates.certManager.enabled .Values.certificates.certManager.generateCA .Values.certificates.certManager.issuer.generate }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}-ca
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
isCA: true
|
||||
commonName: {{ .Values.operator.name }}
|
||||
secretName: {{ .Values.certificates.certManager.caSecretName }}
|
||||
secretTemplate:
|
||||
{{- toYaml .Values.certificates.certManager.secretTemplate | nindent 4 }}
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 2048
|
||||
duration: 43800h0m0s # 5 years
|
||||
renewBefore: 14600h0m0s # 1.6 year, 1/3rd of the duration
|
||||
issuerRef:
|
||||
name: {{ .Values.operator.name }}-selfsigned-issuer
|
||||
kind: Issuer
|
||||
group: cert-manager.io
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.certificates.certManager.enabled .Values.certificates.certManager.generateCA .Values.certificates.certManager.issuer.generate }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ .Values.operator.name }}-selfsigned-issuer
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
selfSigned: {}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,163 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.5
|
||||
{{- if (or .Values.crds.additionalAnnotations .Values.additionalAnnotations) }}
|
||||
{{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.crd-labels" . | indent 4 }}
|
||||
name: cloudeventsources.eventing.keda.sh
|
||||
spec:
|
||||
group: eventing.keda.sh
|
||||
names:
|
||||
kind: CloudEventSource
|
||||
listKind: CloudEventSourceList
|
||||
plural: cloudeventsources
|
||||
singular: cloudeventsource
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.conditions[?(@.type=="Active")].status
|
||||
name: Active
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: CloudEventSource defines how a KEDA event will be sent to event
|
||||
sink
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CloudEventSourceSpec defines the spec of CloudEventSource
|
||||
properties:
|
||||
authenticationRef:
|
||||
description: |-
|
||||
AuthenticationRef points to the TriggerAuthentication or ClusterTriggerAuthentication object that
|
||||
is used to authenticate the scaler with the environment
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the resource being referred to. Defaults
|
||||
to TriggerAuthentication.
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
clusterName:
|
||||
type: string
|
||||
destination:
|
||||
description: Destination defines the various ways to emit events
|
||||
properties:
|
||||
azureEventGridTopic:
|
||||
properties:
|
||||
endpoint:
|
||||
type: string
|
||||
required:
|
||||
- endpoint
|
||||
type: object
|
||||
http:
|
||||
properties:
|
||||
uri:
|
||||
type: string
|
||||
required:
|
||||
- uri
|
||||
type: object
|
||||
type: object
|
||||
eventSubscription:
|
||||
description: EventSubscription defines filters for events
|
||||
properties:
|
||||
excludedEventTypes:
|
||||
items:
|
||||
enum:
|
||||
- keda.scaledobject.ready.v1
|
||||
- keda.scaledobject.failed.v1
|
||||
- keda.scaledobject.removed.v1
|
||||
- keda.scaledjob.ready.v1
|
||||
- keda.scaledjob.failed.v1
|
||||
- keda.scaledjob.removed.v1
|
||||
- keda.authentication.triggerauthentication.created.v1
|
||||
- keda.authentication.triggerauthentication.updated.v1
|
||||
- keda.authentication.triggerauthentication.removed.v1
|
||||
- keda.authentication.clustertriggerauthentication.created.v1
|
||||
- keda.authentication.clustertriggerauthentication.updated.v1
|
||||
- keda.authentication.clustertriggerauthentication.removed.v1
|
||||
type: string
|
||||
type: array
|
||||
includedEventTypes:
|
||||
items:
|
||||
enum:
|
||||
- keda.scaledobject.ready.v1
|
||||
- keda.scaledobject.failed.v1
|
||||
- keda.scaledobject.removed.v1
|
||||
- keda.scaledjob.ready.v1
|
||||
- keda.scaledjob.failed.v1
|
||||
- keda.scaledjob.removed.v1
|
||||
- keda.authentication.triggerauthentication.created.v1
|
||||
- keda.authentication.triggerauthentication.updated.v1
|
||||
- keda.authentication.triggerauthentication.removed.v1
|
||||
- keda.authentication.clustertriggerauthentication.created.v1
|
||||
- keda.authentication.clustertriggerauthentication.updated.v1
|
||||
- keda.authentication.clustertriggerauthentication.removed.v1
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
required:
|
||||
- destination
|
||||
type: object
|
||||
status:
|
||||
description: CloudEventSourceStatus defines the observed state of CloudEventSource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions an array representation to store multiple
|
||||
Conditions
|
||||
items:
|
||||
description: Condition to store the condition state
|
||||
properties:
|
||||
message:
|
||||
description: A human readable message indicating details about
|
||||
the transition.
|
||||
type: string
|
||||
reason:
|
||||
description: The reason for the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of True, False, Unknown.
|
||||
type: string
|
||||
type:
|
||||
description: Type of condition
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,161 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.5
|
||||
{{- if (or .Values.crds.additionalAnnotations .Values.additionalAnnotations) }}
|
||||
{{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.crd-labels" . | indent 4 }}
|
||||
name: clustercloudeventsources.eventing.keda.sh
|
||||
spec:
|
||||
group: eventing.keda.sh
|
||||
names:
|
||||
kind: ClusterCloudEventSource
|
||||
listKind: ClusterCloudEventSourceList
|
||||
plural: clustercloudeventsources
|
||||
singular: clustercloudeventsource
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.conditions[?(@.type=="Active")].status
|
||||
name: Active
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CloudEventSourceSpec defines the spec of CloudEventSource
|
||||
properties:
|
||||
authenticationRef:
|
||||
description: |-
|
||||
AuthenticationRef points to the TriggerAuthentication or ClusterTriggerAuthentication object that
|
||||
is used to authenticate the scaler with the environment
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the resource being referred to. Defaults
|
||||
to TriggerAuthentication.
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
clusterName:
|
||||
type: string
|
||||
destination:
|
||||
description: Destination defines the various ways to emit events
|
||||
properties:
|
||||
azureEventGridTopic:
|
||||
properties:
|
||||
endpoint:
|
||||
type: string
|
||||
required:
|
||||
- endpoint
|
||||
type: object
|
||||
http:
|
||||
properties:
|
||||
uri:
|
||||
type: string
|
||||
required:
|
||||
- uri
|
||||
type: object
|
||||
type: object
|
||||
eventSubscription:
|
||||
description: EventSubscription defines filters for events
|
||||
properties:
|
||||
excludedEventTypes:
|
||||
items:
|
||||
enum:
|
||||
- keda.scaledobject.ready.v1
|
||||
- keda.scaledobject.failed.v1
|
||||
- keda.scaledobject.removed.v1
|
||||
- keda.scaledjob.ready.v1
|
||||
- keda.scaledjob.failed.v1
|
||||
- keda.scaledjob.removed.v1
|
||||
- keda.authentication.triggerauthentication.created.v1
|
||||
- keda.authentication.triggerauthentication.updated.v1
|
||||
- keda.authentication.triggerauthentication.removed.v1
|
||||
- keda.authentication.clustertriggerauthentication.created.v1
|
||||
- keda.authentication.clustertriggerauthentication.updated.v1
|
||||
- keda.authentication.clustertriggerauthentication.removed.v1
|
||||
type: string
|
||||
type: array
|
||||
includedEventTypes:
|
||||
items:
|
||||
enum:
|
||||
- keda.scaledobject.ready.v1
|
||||
- keda.scaledobject.failed.v1
|
||||
- keda.scaledobject.removed.v1
|
||||
- keda.scaledjob.ready.v1
|
||||
- keda.scaledjob.failed.v1
|
||||
- keda.scaledjob.removed.v1
|
||||
- keda.authentication.triggerauthentication.created.v1
|
||||
- keda.authentication.triggerauthentication.updated.v1
|
||||
- keda.authentication.triggerauthentication.removed.v1
|
||||
- keda.authentication.clustertriggerauthentication.created.v1
|
||||
- keda.authentication.clustertriggerauthentication.updated.v1
|
||||
- keda.authentication.clustertriggerauthentication.removed.v1
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
required:
|
||||
- destination
|
||||
type: object
|
||||
status:
|
||||
description: CloudEventSourceStatus defines the observed state of CloudEventSource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions an array representation to store multiple
|
||||
Conditions
|
||||
items:
|
||||
description: Condition to store the condition state
|
||||
properties:
|
||||
message:
|
||||
description: A human readable message indicating details about
|
||||
the transition.
|
||||
type: string
|
||||
reason:
|
||||
description: The reason for the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of True, False, Unknown.
|
||||
type: string
|
||||
type:
|
||||
description: Type of condition
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,586 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.5
|
||||
{{- if (or .Values.crds.additionalAnnotations .Values.additionalAnnotations) }}
|
||||
{{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.crd-labels" . | indent 4 }}
|
||||
name: clustertriggerauthentications.keda.sh
|
||||
spec:
|
||||
group: keda.sh
|
||||
names:
|
||||
kind: ClusterTriggerAuthentication
|
||||
listKind: ClusterTriggerAuthenticationList
|
||||
plural: clustertriggerauthentications
|
||||
shortNames:
|
||||
- cta
|
||||
- clustertriggerauth
|
||||
singular: clustertriggerauthentication
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.podIdentity.provider
|
||||
name: PodIdentity
|
||||
type: string
|
||||
- jsonPath: .spec.secretTargetRef[*].name
|
||||
name: Secret
|
||||
type: string
|
||||
- jsonPath: .spec.env[*].name
|
||||
name: Env
|
||||
type: string
|
||||
- jsonPath: .spec.hashiCorpVault.address
|
||||
name: VaultAddress
|
||||
type: string
|
||||
- jsonPath: .status.scaledobjects
|
||||
name: ScaledObjects
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .status.scaledjobs
|
||||
name: ScaledJobs
|
||||
priority: 1
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterTriggerAuthentication defines how a trigger can authenticate
|
||||
globally
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TriggerAuthenticationSpec defines the various ways to authenticate
|
||||
properties:
|
||||
awsSecretManager:
|
||||
description: AwsSecretManager is used to authenticate using AwsSecretManager
|
||||
properties:
|
||||
credentials:
|
||||
properties:
|
||||
accessKey:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
accessSecretKey:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
accessToken:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
required:
|
||||
- accessKey
|
||||
- accessSecretKey
|
||||
type: object
|
||||
podIdentity:
|
||||
description: |-
|
||||
AuthPodIdentity allows users to select the platform native identity
|
||||
mechanism
|
||||
properties:
|
||||
identityAuthorityHost:
|
||||
description: Set identityAuthorityHost to override the default
|
||||
Azure authority host. If this is set, then the IdentityTenantID
|
||||
must also be set
|
||||
type: string
|
||||
identityId:
|
||||
type: string
|
||||
identityOwner:
|
||||
description: IdentityOwner configures which identity has to
|
||||
be used during auto discovery, keda or the scaled workload.
|
||||
Mutually exclusive with roleArn
|
||||
enum:
|
||||
- keda
|
||||
- workload
|
||||
type: string
|
||||
identityTenantId:
|
||||
description: Set identityTenantId to override the default
|
||||
Azure tenant id. If this is set, then the IdentityID must
|
||||
also be set
|
||||
type: string
|
||||
provider:
|
||||
description: PodIdentityProvider contains the list of providers
|
||||
enum:
|
||||
- azure-workload
|
||||
- gcp
|
||||
- aws
|
||||
- aws-eks
|
||||
- none
|
||||
type: string
|
||||
roleArn:
|
||||
description: RoleArn sets the AWS RoleArn to be used. Mutually
|
||||
exclusive with IdentityOwner
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
region:
|
||||
type: string
|
||||
secrets:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
secretKey:
|
||||
type: string
|
||||
versionId:
|
||||
type: string
|
||||
versionStage:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- secrets
|
||||
type: object
|
||||
azureKeyVault:
|
||||
description: AzureKeyVault is used to authenticate using Azure Key
|
||||
Vault
|
||||
properties:
|
||||
cloud:
|
||||
properties:
|
||||
activeDirectoryEndpoint:
|
||||
type: string
|
||||
keyVaultResourceURL:
|
||||
type: string
|
||||
type:
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
credentials:
|
||||
properties:
|
||||
clientId:
|
||||
type: string
|
||||
clientSecret:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
tenantId:
|
||||
type: string
|
||||
required:
|
||||
- clientId
|
||||
- clientSecret
|
||||
- tenantId
|
||||
type: object
|
||||
podIdentity:
|
||||
description: |-
|
||||
AuthPodIdentity allows users to select the platform native identity
|
||||
mechanism
|
||||
properties:
|
||||
identityAuthorityHost:
|
||||
description: Set identityAuthorityHost to override the default
|
||||
Azure authority host. If this is set, then the IdentityTenantID
|
||||
must also be set
|
||||
type: string
|
||||
identityId:
|
||||
type: string
|
||||
identityOwner:
|
||||
description: IdentityOwner configures which identity has to
|
||||
be used during auto discovery, keda or the scaled workload.
|
||||
Mutually exclusive with roleArn
|
||||
enum:
|
||||
- keda
|
||||
- workload
|
||||
type: string
|
||||
identityTenantId:
|
||||
description: Set identityTenantId to override the default
|
||||
Azure tenant id. If this is set, then the IdentityID must
|
||||
also be set
|
||||
type: string
|
||||
provider:
|
||||
description: PodIdentityProvider contains the list of providers
|
||||
enum:
|
||||
- azure-workload
|
||||
- gcp
|
||||
- aws
|
||||
- aws-eks
|
||||
- none
|
||||
type: string
|
||||
roleArn:
|
||||
description: RoleArn sets the AWS RoleArn to be used. Mutually
|
||||
exclusive with IdentityOwner
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
secrets:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
vaultUri:
|
||||
type: string
|
||||
required:
|
||||
- secrets
|
||||
- vaultUri
|
||||
type: object
|
||||
boundServiceAccountToken:
|
||||
items:
|
||||
properties:
|
||||
parameter:
|
||||
type: string
|
||||
serviceAccountName:
|
||||
type: string
|
||||
required:
|
||||
- parameter
|
||||
- serviceAccountName
|
||||
type: object
|
||||
type: array
|
||||
configMapTargetRef:
|
||||
items:
|
||||
description: AuthConfigMapTargetRef is used to authenticate using
|
||||
a reference to a config map
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
env:
|
||||
items:
|
||||
description: |-
|
||||
AuthEnvironment is used to authenticate using environment variables
|
||||
in the destination ScaleTarget spec
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
gcpSecretManager:
|
||||
properties:
|
||||
credentials:
|
||||
properties:
|
||||
clientSecret:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
required:
|
||||
- clientSecret
|
||||
type: object
|
||||
podIdentity:
|
||||
description: |-
|
||||
AuthPodIdentity allows users to select the platform native identity
|
||||
mechanism
|
||||
properties:
|
||||
identityAuthorityHost:
|
||||
description: Set identityAuthorityHost to override the default
|
||||
Azure authority host. If this is set, then the IdentityTenantID
|
||||
must also be set
|
||||
type: string
|
||||
identityId:
|
||||
type: string
|
||||
identityOwner:
|
||||
description: IdentityOwner configures which identity has to
|
||||
be used during auto discovery, keda or the scaled workload.
|
||||
Mutually exclusive with roleArn
|
||||
enum:
|
||||
- keda
|
||||
- workload
|
||||
type: string
|
||||
identityTenantId:
|
||||
description: Set identityTenantId to override the default
|
||||
Azure tenant id. If this is set, then the IdentityID must
|
||||
also be set
|
||||
type: string
|
||||
provider:
|
||||
description: PodIdentityProvider contains the list of providers
|
||||
enum:
|
||||
- azure-workload
|
||||
- gcp
|
||||
- aws
|
||||
- aws-eks
|
||||
- none
|
||||
type: string
|
||||
roleArn:
|
||||
description: RoleArn sets the AWS RoleArn to be used. Mutually
|
||||
exclusive with IdentityOwner
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
secrets:
|
||||
items:
|
||||
properties:
|
||||
id:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- id
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- secrets
|
||||
type: object
|
||||
hashiCorpVault:
|
||||
description: HashiCorpVault is used to authenticate using Hashicorp
|
||||
Vault
|
||||
properties:
|
||||
address:
|
||||
type: string
|
||||
authentication:
|
||||
description: VaultAuthentication contains the list of Hashicorp
|
||||
Vault authentication methods
|
||||
type: string
|
||||
credential:
|
||||
description: Credential defines the Hashicorp Vault credentials
|
||||
depending on the authentication method
|
||||
properties:
|
||||
serviceAccount:
|
||||
type: string
|
||||
token:
|
||||
type: string
|
||||
type: object
|
||||
mount:
|
||||
type: string
|
||||
namespace:
|
||||
type: string
|
||||
role:
|
||||
type: string
|
||||
secrets:
|
||||
items:
|
||||
description: VaultSecret defines the mapping between the path
|
||||
of the secret in Vault to the parameter
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
pkiData:
|
||||
properties:
|
||||
altNames:
|
||||
type: string
|
||||
commonName:
|
||||
type: string
|
||||
format:
|
||||
type: string
|
||||
ipSans:
|
||||
type: string
|
||||
otherSans:
|
||||
type: string
|
||||
ttl:
|
||||
type: string
|
||||
uriSans:
|
||||
type: string
|
||||
type: object
|
||||
type:
|
||||
description: VaultSecretType defines the type of vault secret
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- parameter
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- address
|
||||
- authentication
|
||||
- secrets
|
||||
type: object
|
||||
podIdentity:
|
||||
description: |-
|
||||
AuthPodIdentity allows users to select the platform native identity
|
||||
mechanism
|
||||
properties:
|
||||
identityAuthorityHost:
|
||||
description: Set identityAuthorityHost to override the default
|
||||
Azure authority host. If this is set, then the IdentityTenantID
|
||||
must also be set
|
||||
type: string
|
||||
identityId:
|
||||
type: string
|
||||
identityOwner:
|
||||
description: IdentityOwner configures which identity has to be
|
||||
used during auto discovery, keda or the scaled workload. Mutually
|
||||
exclusive with roleArn
|
||||
enum:
|
||||
- keda
|
||||
- workload
|
||||
type: string
|
||||
identityTenantId:
|
||||
description: Set identityTenantId to override the default Azure
|
||||
tenant id. If this is set, then the IdentityID must also be
|
||||
set
|
||||
type: string
|
||||
provider:
|
||||
description: PodIdentityProvider contains the list of providers
|
||||
enum:
|
||||
- azure-workload
|
||||
- gcp
|
||||
- aws
|
||||
- aws-eks
|
||||
- none
|
||||
type: string
|
||||
roleArn:
|
||||
description: RoleArn sets the AWS RoleArn to be used. Mutually
|
||||
exclusive with IdentityOwner
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
secretTargetRef:
|
||||
items:
|
||||
description: AuthSecretTargetRef is used to authenticate using a
|
||||
reference to a secret
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: TriggerAuthenticationStatus defines the observed state of
|
||||
TriggerAuthentication
|
||||
properties:
|
||||
scaledjobs:
|
||||
type: string
|
||||
scaledobjects:
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end -}}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,423 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.5
|
||||
{{- if (or .Values.crds.additionalAnnotations .Values.additionalAnnotations) }}
|
||||
{{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.crd-labels" . | indent 4 }}
|
||||
name: scaledobjects.keda.sh
|
||||
spec:
|
||||
group: keda.sh
|
||||
names:
|
||||
kind: ScaledObject
|
||||
listKind: ScaledObjectList
|
||||
plural: scaledobjects
|
||||
shortNames:
|
||||
- so
|
||||
singular: scaledobject
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.scaleTargetKind
|
||||
name: ScaleTargetKind
|
||||
type: string
|
||||
- jsonPath: .spec.scaleTargetRef.name
|
||||
name: ScaleTargetName
|
||||
type: string
|
||||
- jsonPath: .spec.minReplicaCount
|
||||
name: Min
|
||||
type: integer
|
||||
- jsonPath: .spec.maxReplicaCount
|
||||
name: Max
|
||||
type: integer
|
||||
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
||||
name: Ready
|
||||
type: string
|
||||
- jsonPath: .status.conditions[?(@.type=="Active")].status
|
||||
name: Active
|
||||
type: string
|
||||
- jsonPath: .status.conditions[?(@.type=="Fallback")].status
|
||||
name: Fallback
|
||||
type: string
|
||||
- jsonPath: .status.conditions[?(@.type=="Paused")].status
|
||||
name: Paused
|
||||
type: string
|
||||
- jsonPath: .status.triggersTypes
|
||||
name: Triggers
|
||||
type: string
|
||||
- jsonPath: .status.authenticationsTypes
|
||||
name: Authentications
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ScaledObject is a specification for a ScaledObject resource
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ScaledObjectSpec is the spec for a ScaledObject resource
|
||||
properties:
|
||||
advanced:
|
||||
description: AdvancedConfig specifies advance scaling options
|
||||
properties:
|
||||
horizontalPodAutoscalerConfig:
|
||||
description: HorizontalPodAutoscalerConfig specifies horizontal
|
||||
scale config
|
||||
properties:
|
||||
behavior:
|
||||
description: |-
|
||||
HorizontalPodAutoscalerBehavior configures the scaling behavior of the target
|
||||
in both Up and Down directions (scaleUp and scaleDown fields respectively).
|
||||
properties:
|
||||
scaleDown:
|
||||
description: |-
|
||||
scaleDown is scaling policy for scaling Down.
|
||||
If not set, the default value is to allow to scale down to minReplicas pods, with a
|
||||
300 second stabilization window (i.e., the highest recommendation for
|
||||
the last 300sec is used).
|
||||
properties:
|
||||
policies:
|
||||
description: |-
|
||||
policies is a list of potential scaling polices which can be used during scaling.
|
||||
At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
|
||||
items:
|
||||
description: HPAScalingPolicy is a single policy
|
||||
which must hold true for a specified past interval.
|
||||
properties:
|
||||
periodSeconds:
|
||||
description: |-
|
||||
periodSeconds specifies the window of time for which the policy should hold true.
|
||||
PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).
|
||||
format: int32
|
||||
type: integer
|
||||
type:
|
||||
description: type is used to specify the scaling
|
||||
policy.
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
value contains the amount of change which is permitted by the policy.
|
||||
It must be greater than zero
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- periodSeconds
|
||||
- type
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
selectPolicy:
|
||||
description: |-
|
||||
selectPolicy is used to specify which policy should be used.
|
||||
If not set, the default value Max is used.
|
||||
type: string
|
||||
stabilizationWindowSeconds:
|
||||
description: |-
|
||||
stabilizationWindowSeconds is the number of seconds for which past recommendations should be
|
||||
considered while scaling up or scaling down.
|
||||
StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour).
|
||||
If not set, use the default values:
|
||||
- For scale up: 0 (i.e. no stabilization is done).
|
||||
- For scale down: 300 (i.e. the stabilization window is 300 seconds long).
|
||||
format: int32
|
||||
maximum: 3600
|
||||
minimum: 0
|
||||
type: integer
|
||||
type: object
|
||||
scaleUp:
|
||||
description: |-
|
||||
scaleUp is scaling policy for scaling Up.
|
||||
If not set, the default value is the higher of:
|
||||
* increase no more than 4 pods per 60 seconds
|
||||
* double the number of pods per 60 seconds
|
||||
No stabilization is used.
|
||||
properties:
|
||||
policies:
|
||||
description: |-
|
||||
policies is a list of potential scaling polices which can be used during scaling.
|
||||
At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
|
||||
items:
|
||||
description: HPAScalingPolicy is a single policy
|
||||
which must hold true for a specified past interval.
|
||||
properties:
|
||||
periodSeconds:
|
||||
description: |-
|
||||
periodSeconds specifies the window of time for which the policy should hold true.
|
||||
PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).
|
||||
format: int32
|
||||
type: integer
|
||||
type:
|
||||
description: type is used to specify the scaling
|
||||
policy.
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
value contains the amount of change which is permitted by the policy.
|
||||
It must be greater than zero
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- periodSeconds
|
||||
- type
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
selectPolicy:
|
||||
description: |-
|
||||
selectPolicy is used to specify which policy should be used.
|
||||
If not set, the default value Max is used.
|
||||
type: string
|
||||
stabilizationWindowSeconds:
|
||||
description: |-
|
||||
stabilizationWindowSeconds is the number of seconds for which past recommendations should be
|
||||
considered while scaling up or scaling down.
|
||||
StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour).
|
||||
If not set, use the default values:
|
||||
- For scale up: 0 (i.e. no stabilization is done).
|
||||
- For scale down: 300 (i.e. the stabilization window is 300 seconds long).
|
||||
format: int32
|
||||
maximum: 3600
|
||||
minimum: 0
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
restoreToOriginalReplicaCount:
|
||||
type: boolean
|
||||
scalingModifiers:
|
||||
description: ScalingModifiers describes advanced scaling logic
|
||||
options like formula
|
||||
properties:
|
||||
activationTarget:
|
||||
type: string
|
||||
formula:
|
||||
type: string
|
||||
metricType:
|
||||
description: |-
|
||||
MetricTargetType specifies the type of metric being targeted, and should be either
|
||||
"Value", "AverageValue", or "Utilization"
|
||||
enum:
|
||||
- AverageValue
|
||||
- Value
|
||||
type: string
|
||||
target:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
cooldownPeriod:
|
||||
format: int32
|
||||
type: integer
|
||||
fallback:
|
||||
description: Fallback is the spec for fallback options
|
||||
properties:
|
||||
behavior:
|
||||
default: static
|
||||
enum:
|
||||
- static
|
||||
- currentReplicas
|
||||
- currentReplicasIfHigher
|
||||
- currentReplicasIfLower
|
||||
type: string
|
||||
failureThreshold:
|
||||
format: int32
|
||||
type: integer
|
||||
replicas:
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- failureThreshold
|
||||
- replicas
|
||||
type: object
|
||||
idleReplicaCount:
|
||||
format: int32
|
||||
type: integer
|
||||
initialCooldownPeriod:
|
||||
format: int32
|
||||
type: integer
|
||||
maxReplicaCount:
|
||||
format: int32
|
||||
type: integer
|
||||
minReplicaCount:
|
||||
format: int32
|
||||
type: integer
|
||||
pollingInterval:
|
||||
format: int32
|
||||
type: integer
|
||||
scaleTargetRef:
|
||||
description: ScaleTarget holds the reference to the scale target Object
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
envSourceContainerName:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
triggers:
|
||||
items:
|
||||
description: ScaleTriggers reference the scaler that will be used
|
||||
properties:
|
||||
authenticationRef:
|
||||
description: |-
|
||||
AuthenticationRef points to the TriggerAuthentication or ClusterTriggerAuthentication object that
|
||||
is used to authenticate the scaler with the environment
|
||||
properties:
|
||||
kind:
|
||||
description: Kind of the resource being referred to. Defaults
|
||||
to TriggerAuthentication.
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
metadata:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
metricType:
|
||||
description: |-
|
||||
MetricTargetType specifies the type of metric being targeted, and should be either
|
||||
"Value", "AverageValue", or "Utilization"
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
type:
|
||||
type: string
|
||||
useCachedMetrics:
|
||||
type: boolean
|
||||
required:
|
||||
- metadata
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- scaleTargetRef
|
||||
- triggers
|
||||
type: object
|
||||
status:
|
||||
description: ScaledObjectStatus is the status for a ScaledObject resource
|
||||
properties:
|
||||
authenticationsTypes:
|
||||
type: string
|
||||
compositeScalerName:
|
||||
type: string
|
||||
conditions:
|
||||
description: Conditions an array representation to store multiple
|
||||
Conditions
|
||||
items:
|
||||
description: Condition to store the condition state
|
||||
properties:
|
||||
message:
|
||||
description: A human readable message indicating details about
|
||||
the transition.
|
||||
type: string
|
||||
reason:
|
||||
description: The reason for the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of True, False, Unknown.
|
||||
type: string
|
||||
type:
|
||||
description: Type of condition
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
externalMetricNames:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
health:
|
||||
additionalProperties:
|
||||
description: HealthStatus is the status for a ScaledObject's health
|
||||
properties:
|
||||
numberOfFailures:
|
||||
format: int32
|
||||
type: integer
|
||||
status:
|
||||
description: HealthStatusType is an indication of whether the
|
||||
health status is happy or failing
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
hpaName:
|
||||
type: string
|
||||
lastActiveTime:
|
||||
format: date-time
|
||||
type: string
|
||||
originalReplicaCount:
|
||||
format: int32
|
||||
type: integer
|
||||
pausedReplicaCount:
|
||||
format: int32
|
||||
type: integer
|
||||
resourceMetricNames:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
scaleTargetGVKR:
|
||||
description: GroupVersionKindResource provides unified structure for
|
||||
schema.GroupVersionKind and Resource
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
scaleTargetKind:
|
||||
type: string
|
||||
triggersTypes:
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,585 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.5
|
||||
{{- if (or .Values.crds.additionalAnnotations .Values.additionalAnnotations) }}
|
||||
{{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.crd-labels" . | indent 4 }}
|
||||
name: triggerauthentications.keda.sh
|
||||
spec:
|
||||
group: keda.sh
|
||||
names:
|
||||
kind: TriggerAuthentication
|
||||
listKind: TriggerAuthenticationList
|
||||
plural: triggerauthentications
|
||||
shortNames:
|
||||
- ta
|
||||
- triggerauth
|
||||
singular: triggerauthentication
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.podIdentity.provider
|
||||
name: PodIdentity
|
||||
type: string
|
||||
- jsonPath: .spec.secretTargetRef[*].name
|
||||
name: Secret
|
||||
type: string
|
||||
- jsonPath: .spec.env[*].name
|
||||
name: Env
|
||||
type: string
|
||||
- jsonPath: .spec.hashiCorpVault.address
|
||||
name: VaultAddress
|
||||
type: string
|
||||
- jsonPath: .status.scaledobjects
|
||||
name: ScaledObjects
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .status.scaledjobs
|
||||
name: ScaledJobs
|
||||
priority: 1
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: TriggerAuthentication defines how a trigger can authenticate
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TriggerAuthenticationSpec defines the various ways to authenticate
|
||||
properties:
|
||||
awsSecretManager:
|
||||
description: AwsSecretManager is used to authenticate using AwsSecretManager
|
||||
properties:
|
||||
credentials:
|
||||
properties:
|
||||
accessKey:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
accessSecretKey:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
accessToken:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
required:
|
||||
- accessKey
|
||||
- accessSecretKey
|
||||
type: object
|
||||
podIdentity:
|
||||
description: |-
|
||||
AuthPodIdentity allows users to select the platform native identity
|
||||
mechanism
|
||||
properties:
|
||||
identityAuthorityHost:
|
||||
description: Set identityAuthorityHost to override the default
|
||||
Azure authority host. If this is set, then the IdentityTenantID
|
||||
must also be set
|
||||
type: string
|
||||
identityId:
|
||||
type: string
|
||||
identityOwner:
|
||||
description: IdentityOwner configures which identity has to
|
||||
be used during auto discovery, keda or the scaled workload.
|
||||
Mutually exclusive with roleArn
|
||||
enum:
|
||||
- keda
|
||||
- workload
|
||||
type: string
|
||||
identityTenantId:
|
||||
description: Set identityTenantId to override the default
|
||||
Azure tenant id. If this is set, then the IdentityID must
|
||||
also be set
|
||||
type: string
|
||||
provider:
|
||||
description: PodIdentityProvider contains the list of providers
|
||||
enum:
|
||||
- azure-workload
|
||||
- gcp
|
||||
- aws
|
||||
- aws-eks
|
||||
- none
|
||||
type: string
|
||||
roleArn:
|
||||
description: RoleArn sets the AWS RoleArn to be used. Mutually
|
||||
exclusive with IdentityOwner
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
region:
|
||||
type: string
|
||||
secrets:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
secretKey:
|
||||
type: string
|
||||
versionId:
|
||||
type: string
|
||||
versionStage:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- secrets
|
||||
type: object
|
||||
azureKeyVault:
|
||||
description: AzureKeyVault is used to authenticate using Azure Key
|
||||
Vault
|
||||
properties:
|
||||
cloud:
|
||||
properties:
|
||||
activeDirectoryEndpoint:
|
||||
type: string
|
||||
keyVaultResourceURL:
|
||||
type: string
|
||||
type:
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
credentials:
|
||||
properties:
|
||||
clientId:
|
||||
type: string
|
||||
clientSecret:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
tenantId:
|
||||
type: string
|
||||
required:
|
||||
- clientId
|
||||
- clientSecret
|
||||
- tenantId
|
||||
type: object
|
||||
podIdentity:
|
||||
description: |-
|
||||
AuthPodIdentity allows users to select the platform native identity
|
||||
mechanism
|
||||
properties:
|
||||
identityAuthorityHost:
|
||||
description: Set identityAuthorityHost to override the default
|
||||
Azure authority host. If this is set, then the IdentityTenantID
|
||||
must also be set
|
||||
type: string
|
||||
identityId:
|
||||
type: string
|
||||
identityOwner:
|
||||
description: IdentityOwner configures which identity has to
|
||||
be used during auto discovery, keda or the scaled workload.
|
||||
Mutually exclusive with roleArn
|
||||
enum:
|
||||
- keda
|
||||
- workload
|
||||
type: string
|
||||
identityTenantId:
|
||||
description: Set identityTenantId to override the default
|
||||
Azure tenant id. If this is set, then the IdentityID must
|
||||
also be set
|
||||
type: string
|
||||
provider:
|
||||
description: PodIdentityProvider contains the list of providers
|
||||
enum:
|
||||
- azure-workload
|
||||
- gcp
|
||||
- aws
|
||||
- aws-eks
|
||||
- none
|
||||
type: string
|
||||
roleArn:
|
||||
description: RoleArn sets the AWS RoleArn to be used. Mutually
|
||||
exclusive with IdentityOwner
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
secrets:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
vaultUri:
|
||||
type: string
|
||||
required:
|
||||
- secrets
|
||||
- vaultUri
|
||||
type: object
|
||||
boundServiceAccountToken:
|
||||
items:
|
||||
properties:
|
||||
parameter:
|
||||
type: string
|
||||
serviceAccountName:
|
||||
type: string
|
||||
required:
|
||||
- parameter
|
||||
- serviceAccountName
|
||||
type: object
|
||||
type: array
|
||||
configMapTargetRef:
|
||||
items:
|
||||
description: AuthConfigMapTargetRef is used to authenticate using
|
||||
a reference to a config map
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
env:
|
||||
items:
|
||||
description: |-
|
||||
AuthEnvironment is used to authenticate using environment variables
|
||||
in the destination ScaleTarget spec
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
gcpSecretManager:
|
||||
properties:
|
||||
credentials:
|
||||
properties:
|
||||
clientSecret:
|
||||
properties:
|
||||
valueFrom:
|
||||
properties:
|
||||
secretKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- secretKeyRef
|
||||
type: object
|
||||
required:
|
||||
- valueFrom
|
||||
type: object
|
||||
required:
|
||||
- clientSecret
|
||||
type: object
|
||||
podIdentity:
|
||||
description: |-
|
||||
AuthPodIdentity allows users to select the platform native identity
|
||||
mechanism
|
||||
properties:
|
||||
identityAuthorityHost:
|
||||
description: Set identityAuthorityHost to override the default
|
||||
Azure authority host. If this is set, then the IdentityTenantID
|
||||
must also be set
|
||||
type: string
|
||||
identityId:
|
||||
type: string
|
||||
identityOwner:
|
||||
description: IdentityOwner configures which identity has to
|
||||
be used during auto discovery, keda or the scaled workload.
|
||||
Mutually exclusive with roleArn
|
||||
enum:
|
||||
- keda
|
||||
- workload
|
||||
type: string
|
||||
identityTenantId:
|
||||
description: Set identityTenantId to override the default
|
||||
Azure tenant id. If this is set, then the IdentityID must
|
||||
also be set
|
||||
type: string
|
||||
provider:
|
||||
description: PodIdentityProvider contains the list of providers
|
||||
enum:
|
||||
- azure-workload
|
||||
- gcp
|
||||
- aws
|
||||
- aws-eks
|
||||
- none
|
||||
type: string
|
||||
roleArn:
|
||||
description: RoleArn sets the AWS RoleArn to be used. Mutually
|
||||
exclusive with IdentityOwner
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
secrets:
|
||||
items:
|
||||
properties:
|
||||
id:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- id
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- secrets
|
||||
type: object
|
||||
hashiCorpVault:
|
||||
description: HashiCorpVault is used to authenticate using Hashicorp
|
||||
Vault
|
||||
properties:
|
||||
address:
|
||||
type: string
|
||||
authentication:
|
||||
description: VaultAuthentication contains the list of Hashicorp
|
||||
Vault authentication methods
|
||||
type: string
|
||||
credential:
|
||||
description: Credential defines the Hashicorp Vault credentials
|
||||
depending on the authentication method
|
||||
properties:
|
||||
serviceAccount:
|
||||
type: string
|
||||
token:
|
||||
type: string
|
||||
type: object
|
||||
mount:
|
||||
type: string
|
||||
namespace:
|
||||
type: string
|
||||
role:
|
||||
type: string
|
||||
secrets:
|
||||
items:
|
||||
description: VaultSecret defines the mapping between the path
|
||||
of the secret in Vault to the parameter
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
pkiData:
|
||||
properties:
|
||||
altNames:
|
||||
type: string
|
||||
commonName:
|
||||
type: string
|
||||
format:
|
||||
type: string
|
||||
ipSans:
|
||||
type: string
|
||||
otherSans:
|
||||
type: string
|
||||
ttl:
|
||||
type: string
|
||||
uriSans:
|
||||
type: string
|
||||
type: object
|
||||
type:
|
||||
description: VaultSecretType defines the type of vault secret
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- parameter
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- address
|
||||
- authentication
|
||||
- secrets
|
||||
type: object
|
||||
podIdentity:
|
||||
description: |-
|
||||
AuthPodIdentity allows users to select the platform native identity
|
||||
mechanism
|
||||
properties:
|
||||
identityAuthorityHost:
|
||||
description: Set identityAuthorityHost to override the default
|
||||
Azure authority host. If this is set, then the IdentityTenantID
|
||||
must also be set
|
||||
type: string
|
||||
identityId:
|
||||
type: string
|
||||
identityOwner:
|
||||
description: IdentityOwner configures which identity has to be
|
||||
used during auto discovery, keda or the scaled workload. Mutually
|
||||
exclusive with roleArn
|
||||
enum:
|
||||
- keda
|
||||
- workload
|
||||
type: string
|
||||
identityTenantId:
|
||||
description: Set identityTenantId to override the default Azure
|
||||
tenant id. If this is set, then the IdentityID must also be
|
||||
set
|
||||
type: string
|
||||
provider:
|
||||
description: PodIdentityProvider contains the list of providers
|
||||
enum:
|
||||
- azure-workload
|
||||
- gcp
|
||||
- aws
|
||||
- aws-eks
|
||||
- none
|
||||
type: string
|
||||
roleArn:
|
||||
description: RoleArn sets the AWS RoleArn to be used. Mutually
|
||||
exclusive with IdentityOwner
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
secretTargetRef:
|
||||
items:
|
||||
description: AuthSecretTargetRef is used to authenticate using a
|
||||
reference to a secret
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
- parameter
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: TriggerAuthenticationStatus defines the observed state of
|
||||
TriggerAuthentication
|
||||
properties:
|
||||
scaledjobs:
|
||||
type: string
|
||||
scaledobjects:
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,4 @@
|
||||
{{ range .Values.extraObjects }}
|
||||
---
|
||||
{{ tpl (toYaml .) $ }}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if and .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") }}
|
||||
apiVersion: "cilium.io/v2"
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ .Values.operator.name }}
|
||||
name: {{ .Values.operator.name }}
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: {{ .Values.operator.name }}
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- cluster
|
||||
{{- if and .Values.networkPolicy.cilium.operator.extraEgressRules }}
|
||||
{{ toYaml .Values.networkPolicy.cilium.operator.extraEgressRules | nindent 4 }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- cluster
|
||||
{{ end }}
|
||||
@@ -0,0 +1,260 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- configmaps/status
|
||||
- limitranges
|
||||
- pods
|
||||
- services
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
{{- if not .Values.permissions.operator.restrict.secret }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
{{- with .Values.permissions.operator.restrict.namesAllowList }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
resourceNames: {{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.rbac.enabledCustomScaledRefKinds }}
|
||||
{{- range .Values.rbac.scaledRefKinds }}
|
||||
- apiGroups:
|
||||
- {{ .apiGroup | quote }}
|
||||
resources:
|
||||
- {{ printf "%s/scale" .kind | quote }}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- {{ .apiGroup | quote }}
|
||||
resources:
|
||||
- {{ .kind | quote }}
|
||||
verbs:
|
||||
- get
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments/scale
|
||||
- statefulsets/scale
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- statefulsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- autoscaling
|
||||
resources:
|
||||
- horizontalpodautoscalers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- jobs
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- eventing.keda.sh
|
||||
resources:
|
||||
- cloudeventsources
|
||||
- cloudeventsources/status
|
||||
- clustercloudeventsources
|
||||
- clustercloudeventsources/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- keda.sh
|
||||
resources:
|
||||
- scaledjobs
|
||||
- scaledjobs/finalizers
|
||||
- scaledjobs/status
|
||||
- scaledobjects
|
||||
- scaledobjects/finalizers
|
||||
- scaledobjects/status
|
||||
- triggerauthentications
|
||||
- triggerauthentications/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
{{- if .Values.rbac.aggregateToDefaultRoles }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: keda:edit
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- keda.sh
|
||||
resources:
|
||||
- clustertriggerauthentications
|
||||
- scaledjobs
|
||||
- scaledobjects
|
||||
- triggerauthentications
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- eventing.keda.sh
|
||||
resources:
|
||||
- cloudeventsources
|
||||
- clustercloudeventsources
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- patch
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: keda:view
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- keda.sh
|
||||
resources:
|
||||
- clustertriggerauthentications
|
||||
- scaledjobs
|
||||
- scaledobjects
|
||||
- triggerauthentications
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- eventing.keda.sh
|
||||
resources:
|
||||
- cloudeventsources
|
||||
- clustercloudeventsources
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
{{- if .Values.permissions.operator.restrict.serviceAccountTokenCreationRoles }}
|
||||
{{- range $r := .Values.permissions.operator.restrict.serviceAccountTokenCreationRoles }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
{{- with $.Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ $.Values.operator.name }}
|
||||
{{- include "keda.labels" $ | indent 4 }}
|
||||
name: {{ $.Values.operator.name }}-token-creator-{{ $r.name }}
|
||||
namespace: {{ $r.namespace }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts/token
|
||||
verbs:
|
||||
- create
|
||||
resourceNames:
|
||||
- {{ $r.name }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
{{- with $.Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ $.Values.operator.name }}
|
||||
{{- include "keda.labels" $ | indent 4 }}
|
||||
name: {{ $.Values.operator.name }}-token-creator-{{ $r.name }}
|
||||
namespace: {{ $r.namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ $.Values.operator.name }}-token-creator-{{ $r.name }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $.Values.operator.name }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,50 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
{{- if not .Values.watchNamespace }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Values.operator.name }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- else }}
|
||||
{{- $namespaces := append (splitList "," .Values.watchNamespace) .Release.Namespace -}}
|
||||
{{- range $namespaces }}
|
||||
---
|
||||
# Role binding for namespace '{{ . }}'
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
{{- with $.Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ $.Values.operator.name }}
|
||||
{{- include "keda.labels" $ | indent 4 }}
|
||||
name: {{ $.Values.operator.name }}
|
||||
namespace: {{ . | trim }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ $.Values.operator.name }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ ($.Values.serviceAccount.operator).name | default $.Values.serviceAccount.name }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,244 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ .Values.operator.name }}
|
||||
name: {{ .Values.operator.name }}
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
revisionHistoryLimit: {{ .Values.operator.revisionHistoryLimit}}
|
||||
replicas: {{ .Values.operator.replicaCount}}
|
||||
{{- with .Values.upgradeStrategy.operator }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Values.operator.name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ .Values.operator.name }}
|
||||
name: {{ .Values.operator.name }}
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 8 }}
|
||||
{{- if .Values.podLabels.keda }}
|
||||
{{- toYaml .Values.podLabels.keda | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.podIdentity.azureWorkload.enabled }}
|
||||
azure.workload.identity/use: "true"
|
||||
{{- end }}
|
||||
{{- if or .Values.podAnnotations.keda .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.podAnnotations.keda }}
|
||||
{{- toYaml .Values.podAnnotations.keda | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.additionalAnnotations }}
|
||||
{{- toYaml .Values.additionalAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
|
||||
automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.operator).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.operator).automountServiceAccountToken }}
|
||||
securityContext:
|
||||
{{- if .Values.podSecurityContext.operator }}
|
||||
{{- toYaml .Values.podSecurityContext.operator | nindent 8 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Values.operator.name }}
|
||||
securityContext:
|
||||
{{- if .Values.securityContext.operator }}
|
||||
{{- toYaml .Values.securityContext.operator | nindent 12 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- $registry := .Values.global.image.registry | default .Values.image.keda.registry | default "" }}
|
||||
{{- if $registry }}
|
||||
image: "{{ $registry }}/{{ .Values.image.keda.repository }}:{{ .Values.image.keda.tag | default .Chart.AppVersion }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.image.keda.repository }}:{{ .Values.image.keda.tag | default .Chart.AppVersion }}"
|
||||
{{- end }}
|
||||
command:
|
||||
- "/keda"
|
||||
args:
|
||||
- "--leader-elect"
|
||||
- "--disable-compression={{ .Values.operator.disableCompression}}"
|
||||
- "--zap-log-level={{ .Values.logging.operator.level }}"
|
||||
- "--zap-encoder={{ .Values.logging.operator.format }}"
|
||||
- "--zap-time-encoding={{ .Values.logging.operator.timeEncoding }}"
|
||||
- "--enable-webhook-patching={{ .Values.webhooks.enabled }}"
|
||||
{{- if .Values.logging.operator.stackTracesEnabled }}
|
||||
- "--zap-stacktrace-level=error"
|
||||
{{- end }}
|
||||
- "--cert-dir={{ .Values.certificates.mountPath }}"
|
||||
- "--enable-cert-rotation={{ and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) }}"
|
||||
- "--cert-secret-name={{ .Values.certificates.secretName }}"
|
||||
- "--operator-service-name={{ .Values.operator.name }}"
|
||||
- "--metrics-server-service-name={{ .Values.operator.name }}-metrics-apiserver"
|
||||
- "--webhooks-service-name={{ .Values.webhooks.name }}"
|
||||
- "--k8s-cluster-name={{ tpl .Values.clusterName . }}"
|
||||
- "--k8s-cluster-domain={{ .Values.clusterDomain }}"
|
||||
- "--enable-prometheus-metrics={{ .Values.prometheus.operator.enabled }}"
|
||||
{{- if .Values.prometheus.operator.enabled }}
|
||||
- "--metrics-bind-address=:{{ .Values.prometheus.operator.port }}"
|
||||
{{- end }}
|
||||
{{- if .Values.opentelemetry.operator.enabled }}
|
||||
- "--enable-opentelemetry-metrics={{ .Values.opentelemetry.operator.enabled}}"
|
||||
{{- end }}
|
||||
{{- if .Values.profiling.operator.enabled }}
|
||||
- "--profiling-bind-address=:{{ .Values.profiling.operator.port }}"
|
||||
{{- end }}
|
||||
{{- with (.Values.certificates.operator).caDirs }}
|
||||
{{- range . }}
|
||||
- "--ca-dir={{ . }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.extraArgs.keda }}
|
||||
- "--{{ $key }}={{ $value }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: {{ .Values.operator.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.operator.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.operator.livenessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.operator.livenessProbe.failureThreshold }}
|
||||
successThreshold: {{ .Values.operator.livenessProbe.successThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: {{ .Values.operator.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.operator.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.operator.readinessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.operator.readinessProbe.failureThreshold }}
|
||||
successThreshold: {{ .Values.operator.readinessProbe.successThreshold }}
|
||||
ports:
|
||||
{{- if .Values.prometheus.operator.enabled }}
|
||||
- containerPort: {{ .Values.prometheus.operator.port }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
- containerPort: 9666
|
||||
name: metricsservice
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: WATCH_NAMESPACE
|
||||
value: {{ .Values.watchNamespace | quote }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: OPERATOR_NAME
|
||||
value: {{ .Values.operator.name }}
|
||||
- name: KEDA_HTTP_DEFAULT_TIMEOUT
|
||||
value: {{ .Values.http.timeout | quote }}
|
||||
- name: KEDA_HTTP_MIN_TLS_VERSION
|
||||
value: {{ .Values.http.minTlsVersion }}
|
||||
{{- if ( not .Values.http.keepAlive.enabled ) }}
|
||||
- name: KEDA_HTTP_DISABLE_KEEP_ALIVE
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.permissions.operator.restrict.secret }}
|
||||
- name: KEDA_RESTRICT_SECRET_ACCESS
|
||||
value: {{ .Values.permissions.operator.restrict.secret | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.opentelemetry.collector.uri }}
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: {{ .Values.opentelemetry.collector.uri | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.env }}
|
||||
{{- toYaml .Values.env | nindent 12 -}}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: {{ .Values.certificates.mountPath }}
|
||||
name: certificates
|
||||
readOnly: true
|
||||
{{- if .Values.grpcTLSCertsSecret }}
|
||||
- name: grpc-certs
|
||||
mountPath: /grpccerts
|
||||
{{- end }}
|
||||
{{- if .Values.hashiCorpVaultTLS }}
|
||||
- name: hashicorp-vault-certs
|
||||
mountPath: /hashicorp-vaultcerts
|
||||
{{- end }}
|
||||
{{- if .Values.volumes.keda.extraVolumeMounts }}
|
||||
{{- toYaml .Values.volumes.keda.extraVolumeMounts | nindent 10 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- if .Values.resources.operator }}
|
||||
{{- toYaml .Values.resources.operator | nindent 12 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.extraContainers }}
|
||||
{{- toYaml .Values.operator.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.extraInitContainers }}
|
||||
initContainers:
|
||||
{{- toYaml .Values.operator.extraInitContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: certificates
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: {{ .Values.certificates.secretName }}
|
||||
optional: {{ and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) }}
|
||||
{{- if .Values.grpcTLSCertsSecret }}
|
||||
- name: grpc-certs
|
||||
secret:
|
||||
secretName: {{ .Values.grpcTLSCertsSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.hashiCorpVaultTLS }}
|
||||
- name: hashicorp-vault-certs
|
||||
secret:
|
||||
secretName: {{ .Values.hashiCorpVaultTLS }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumes.keda.extraVolumes }}
|
||||
{{- toYaml .Values.volumes.keda.extraVolumes | nindent 6 }}
|
||||
{{- end }}
|
||||
nodeSelector:
|
||||
{{- with .Values.nodeSelector }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.podIdentity.gcp.enabled }}
|
||||
iam.gke.io/gke-metadata-server-enabled: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.operator.affinity }}
|
||||
affinity:
|
||||
{{- toYaml .Values.operator.affinity | nindent 8 }}
|
||||
{{- else if .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml .Values.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints.operator }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,149 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-certs
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-certs
|
||||
namespace: {{ .Release.Namespace }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
{{- if and .Values.certificates.autoGenerated (not .Values.certificates.certManager.enabled) }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
resourceNames:
|
||||
- {{ .Values.certificates.secretName | quote }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
{{- if .Values.permissions.operator.restrict.secret }}
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-certs
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-certs
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ .Values.operator.name }}-certs
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-minimal-cluster-role
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-minimal-cluster-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- keda.sh
|
||||
resources:
|
||||
- clustertriggerauthentications
|
||||
- clustertriggerauthentications/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
{{- if and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) }}
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apiregistration.k8s.io
|
||||
resources:
|
||||
- apiservices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- eventing.keda.sh
|
||||
resources:
|
||||
- cloudeventsources
|
||||
- cloudeventsources/status
|
||||
- clustercloudeventsources
|
||||
- clustercloudeventsources/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-minimal
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-minimal
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Values.operator.name }}-minimal-cluster-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if or (or .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable) .Values.podDisruptionBudget.operator }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ .Values.operator.name }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
{{- if .Values.podDisruptionBudget.minAvailable }}
|
||||
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.operator }}
|
||||
{{- if .Values.podDisruptionBudget.operator.minAvailable }}
|
||||
minAvailable: {{ .Values.podDisruptionBudget.operator.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.operator.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.operator.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Values.operator.name }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- if and .Values.prometheus.operator.enabled .Values.prometheus.operator.podMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.prometheus.operator.podMonitor.additionalLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.podMonitor.namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
{{- with .Values.prometheus.operator.podMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.podMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.podMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.podMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Values.operator.name }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- if and .Values.prometheus.operator.enabled .Values.prometheus.operator.prometheusRules.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.prometheus.operator.prometheusRules.additionalLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.prometheusRules.namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups:
|
||||
- name: {{ .Values.operator.name }}
|
||||
rules:
|
||||
{{ toYaml .Values.prometheus.operator.prometheusRules.alerts | indent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,46 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
{{- if or .Values.additionalAnnotations .Values.service.annotations (and .Values.prometheus.operator.enabled ( not (or .Values.prometheus.operator.podMonitor.enabled .Values.prometheus.operator.serviceMonitor.enabled ))) }}
|
||||
annotations:
|
||||
{{- if and .Values.prometheus.operator.enabled ( not (or .Values.prometheus.operator.podMonitor.enabled .Values.prometheus.operator.serviceMonitor.enabled )) }}
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.prometheus.operator.port | quote }}
|
||||
prometheus.io/path: "/metrics"
|
||||
{{- end }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.annotations }}
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- name: metricsservice
|
||||
port: 9666
|
||||
targetPort: 9666
|
||||
{{- if .Values.prometheus.operator.enabled }}
|
||||
- name: metrics
|
||||
port: {{ .Values.prometheus.operator.port }}
|
||||
targetPort: {{ .Values.prometheus.operator.port }}
|
||||
{{- with .Values.prometheus.operator.appProtocol }}
|
||||
appProtocol: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.profiling.operator.enabled }}
|
||||
- name: profiling
|
||||
port: {{ .Values.profiling.operator.port }}
|
||||
targetPort: {{ .Values.profiling.operator.port }}
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ .Values.operator.name }}
|
||||
@@ -0,0 +1,49 @@
|
||||
{{- if (.Values.serviceAccount.operator).create | default .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
|
||||
{{- if .Values.podIdentity.azureWorkload.enabled }}
|
||||
azure.workload.identity/use: "true"
|
||||
{{- end }}
|
||||
{{- include "keda.labels" . | nindent 4 }}
|
||||
{{- if or .Values.podIdentity.azureWorkload.enabled .Values.podIdentity.aws.irsa.enabled ((.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations) .Values.podIdentity.gcp.enabled }}
|
||||
annotations:
|
||||
{{- if .Values.additionalAnnotations }}
|
||||
{{- toYaml .Values.additionalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.podIdentity.azureWorkload.enabled }}
|
||||
{{- if .Values.podIdentity.azureWorkload.clientId }}
|
||||
azure.workload.identity/client-id: {{ .Values.podIdentity.azureWorkload.clientId | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.podIdentity.azureWorkload.tenantId }}
|
||||
azure.workload.identity/tenant-id: {{ .Values.podIdentity.azureWorkload.tenantId | quote }}
|
||||
{{- end }}
|
||||
azure.workload.identity/service-account-token-expiration: {{ .Values.podIdentity.azureWorkload.tokenExpiration | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.podIdentity.aws.irsa.enabled }}
|
||||
{{- if .Values.podIdentity.aws.irsa.audience }}
|
||||
eks.amazonaws.com/audience: {{ .Values.podIdentity.aws.irsa.audience | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.podIdentity.aws.irsa.roleArn }}
|
||||
eks.amazonaws.com/role-arn: {{ .Values.podIdentity.aws.irsa.roleArn | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.podIdentity.aws.irsa.stsRegionalEndpoints }}
|
||||
eks.amazonaws.com/sts-regional-endpoints: {{ .Values.podIdentity.aws.irsa.stsRegionalEndpoints | quote }}
|
||||
{{- end }}
|
||||
eks.amazonaws.com/token-expiration: {{ .Values.podIdentity.aws.irsa.tokenExpiration | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.podIdentity.gcp.enabled }}
|
||||
{{- if .Values.podIdentity.gcp.gcpIAMServiceAccount }}
|
||||
iam.gke.io/gcp-service-account: {{ .Values.podIdentity.gcp.gcpIAMServiceAccount }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations }}
|
||||
{{- toYaml ((.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations) | nindent 4}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.operator).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.operator).automountServiceAccountToken }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{- if and .Values.prometheus.operator.enabled .Values.prometheus.operator.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.prometheus.operator.serviceMonitor.additionalLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.targetLabels }}
|
||||
targetLabels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.podTargetLabels }}
|
||||
podTargetLabels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
endpoints:
|
||||
- port: {{ .Values.prometheus.operator.serviceMonitor.port }}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.targetPort }}
|
||||
targetPort: {{ . }}
|
||||
{{- end }}
|
||||
path: /metrics
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.operator.serviceMonitor.relabelings}}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.relabellings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
scheme: {{ .Values.prometheus.operator.serviceMonitor.scheme }}
|
||||
{{- with .Values.prometheus.operator.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{ toYaml . | nindent 6}}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: apiregistration.k8s.io/v1
|
||||
kind: APIService
|
||||
metadata:
|
||||
{{- if or .Values.certificates.certManager.enabled .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.certificates.certManager.enabled }}
|
||||
{{- if and (not .Values.certificates.certManager.generateCA) .Values.certificates.certManager.issuer.generate }}
|
||||
cert-manager.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ .Values.certificates.certManager.caSecretName }}
|
||||
{{- else }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.operator.name }}-tls-certificates
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.additionalAnnotations }}
|
||||
{{- toYaml .Values.additionalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: v1beta1.external.metrics.k8s.io
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: v1beta1.external.metrics.k8s.io
|
||||
spec:
|
||||
service:
|
||||
name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
namespace: {{ .Release.Namespace }}
|
||||
port: {{ .Values.service.portHttps }}
|
||||
group: external.metrics.k8s.io
|
||||
version: v1beta1
|
||||
groupPriorityMinimum: 100
|
||||
versionPriority: 100
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- if and .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") }}
|
||||
apiVersion: "cilium.io/v2"
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- cluster
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- cluster
|
||||
{{ end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-external-metrics-reader
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-external-metrics-reader
|
||||
rules:
|
||||
- apiGroups:
|
||||
- external.metrics.k8s.io
|
||||
resources:
|
||||
- 'externalmetrics'
|
||||
verbs:
|
||||
- 'get'
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,63 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-system-auth-delegator
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-system-auth-delegator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:auth-delegator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ (.Values.serviceAccount.metricServer).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
# https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/#extension-apiserver-authenticates-the-request
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-auth-reader
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-auth-reader
|
||||
namespace: {{ .Values.rbac.controlPlaneServiceAccountsNamespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: extension-apiserver-authentication-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ (.Values.serviceAccount.metricServer).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-hpa-controller-external-metrics
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-hpa-controller-external-metrics
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Values.operator.name }}-external-metrics-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: horizontal-pod-autoscaler
|
||||
namespace: kube-system
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,206 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
revisionHistoryLimit: {{ .Values.metricsServer.revisionHistoryLimit}}
|
||||
replicas: {{ .Values.metricsServer.replicaCount }}
|
||||
{{- with .Values.upgradeStrategy.metricsApiServer }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- include "keda.labels" . | indent 8 }}
|
||||
{{- if .Values.podLabels.metricsAdapter }}
|
||||
{{- toYaml .Values.podLabels.metricsAdapter | nindent 8}}
|
||||
{{- end }}
|
||||
{{- if or .Values.additionalAnnotations .Values.podAnnotations.metricsAdapter (and .Values.prometheus.metricServer.enabled ( not (or .Values.prometheus.metricServer.podMonitor.enabled .Values.prometheus.metricServer.serviceMonitor.enabled )) )}}
|
||||
annotations:
|
||||
{{- if .Values.additionalAnnotations }}
|
||||
{{- toYaml .Values.additionalAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.prometheus.metricServer.enabled ( not (or .Values.prometheus.metricServer.podMonitor.enabled .Values.prometheus.metricServer.serviceMonitor.enabled )) }}
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.prometheus.metricServer.port | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.podAnnotations.metricsAdapter }}
|
||||
{{- toYaml .Values.podAnnotations.metricsAdapter | nindent 8}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ (.Values.serviceAccount.metricServer).name | default .Values.serviceAccount.name }}
|
||||
automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.metricServer).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.metricServer).automountServiceAccountToken }}
|
||||
securityContext:
|
||||
{{- if .Values.podSecurityContext.metricServer }}
|
||||
{{- toYaml .Values.podSecurityContext.metricServer | nindent 8 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
securityContext:
|
||||
{{- if .Values.securityContext.metricServer }}
|
||||
{{- toYaml .Values.securityContext.metricServer | nindent 12 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- $registry := .Values.global.image.registry | default .Values.image.metricsApiServer.registry | default "" }}
|
||||
{{- if $registry }}
|
||||
image: "{{ $registry }}/{{ .Values.image.metricsApiServer.repository }}:{{ .Values.image.metricsApiServer.tag | default .Chart.AppVersion }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.image.metricsApiServer.repository }}:{{ .Values.image.metricsApiServer.tag | default .Chart.AppVersion }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ .Values.service.portHttpsTarget }}
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: {{ .Values.metricsServer.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.metricsServer.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.metricsServer.livenessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.metricsServer.livenessProbe.failureThreshold }}
|
||||
successThreshold: {{ .Values.metricsServer.livenessProbe.successThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: {{ .Values.service.portHttpsTarget }}
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: {{ .Values.metricsServer.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.metricsServer.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.metricsServer.readinessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.metricsServer.readinessProbe.failureThreshold }}
|
||||
successThreshold: {{ .Values.metricsServer.readinessProbe.successThreshold }}
|
||||
env:
|
||||
- name: WATCH_NAMESPACE
|
||||
value: {{ .Values.watchNamespace | quote }}
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KEDA_HTTP_DEFAULT_TIMEOUT
|
||||
value: {{ .Values.http.timeout | quote }}
|
||||
- name: KEDA_HTTP_MIN_TLS_VERSION
|
||||
value: {{ .Values.http.minTlsVersion }}
|
||||
{{- if ( not .Values.http.keepAlive.enabled ) }}
|
||||
- name: KEDA_HTTP_DISABLE_KEEP_ALIVE
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.permissions.metricServer.restrict.secret }}
|
||||
- name: KEDA_RESTRICT_SECRET_ACCESS
|
||||
value: {{ .Values.permissions.metricServer.restrict.secret | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.env }}
|
||||
{{- toYaml .Values.env | nindent 12 -}}
|
||||
{{- end }}
|
||||
command:
|
||||
- /keda-adapter
|
||||
args:
|
||||
- --port={{ .Values.prometheus.metricServer.port }}
|
||||
- --secure-port={{ .Values.service.portHttpsTarget }}
|
||||
- --logtostderr=true
|
||||
- --stderrthreshold={{ .Values.logging.metricServer.stderrthreshold }}
|
||||
- --disable-compression={{ .Values.metricsServer.disableCompression}}
|
||||
- --metrics-service-address={{ .Values.operator.name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:9666
|
||||
- --client-ca-file={{ .Values.certificates.mountPath }}/ca.crt
|
||||
- --tls-cert-file={{ .Values.certificates.mountPath }}/tls.crt
|
||||
- --tls-private-key-file={{ .Values.certificates.mountPath }}/tls.key
|
||||
- --cert-dir={{ .Values.certificates.mountPath }}
|
||||
- --v={{ .Values.logging.metricServer.level }}
|
||||
{{- if .Values.profiling.metricsServer.enabled }}
|
||||
- "--profiling-bind-address=:{{ .Values.profiling.metricsServer.port }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.extraArgs.metricsAdapter }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.service.portHttpsTarget }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.prometheus.metricServer.port }}
|
||||
name: {{ .Values.prometheus.metricServer.portName }}
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- mountPath: {{ .Values.certificates.mountPath }}
|
||||
name: certificates
|
||||
readOnly: true
|
||||
{{- if .Values.grpcTLSCertsSecret }}
|
||||
- name: grpc-certs
|
||||
mountPath: /grpccerts
|
||||
{{- end }}
|
||||
{{- if .Values.hashiCorpVaultTLS }}
|
||||
- name: hashicorp-vault-certs
|
||||
mountPath: /hashicorp-vaultcerts
|
||||
{{- end }}
|
||||
{{- if .Values.volumes.metricsApiServer.extraVolumeMounts }}
|
||||
{{- toYaml .Values.volumes.metricsApiServer.extraVolumeMounts | nindent 10 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- if .Values.resources.metricServer }}
|
||||
{{- toYaml .Values.resources.metricServer | nindent 12 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: certificates
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: {{ .Values.certificates.secretName }}
|
||||
{{- if .Values.grpcTLSCertsSecret }}
|
||||
- name: grpc-certs
|
||||
secret:
|
||||
secretName: {{ .Values.grpcTLSCertsSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.hashiCorpVaultTLS }}
|
||||
- name: hashicorp-vault-certs
|
||||
secret:
|
||||
secretName: {{ .Values.hashiCorpVaultTLS }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumes.metricsApiServer.extraVolumes }}
|
||||
{{- toYaml .Values.volumes.metricsApiServer.extraVolumes | nindent 6 }}
|
||||
{{- end }}
|
||||
dnsPolicy: {{ .Values.metricsServer.dnsPolicy }}
|
||||
hostNetwork: {{ .Values.metricsServer.useHostNetwork }}
|
||||
nodeSelector:
|
||||
{{- with .Values.nodeSelector }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metricsServer.affinity }}
|
||||
affinity:
|
||||
{{- toYaml .Values.metricsServer.affinity | nindent 8 }}
|
||||
{{- else if .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml .Values.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints.metricsServer}}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,33 @@
|
||||
{{- if or (or .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable) .Values.podDisruptionBudget.metricServer }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
{{- if .Values.podDisruptionBudget.minAvailable }}
|
||||
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.metricServer }}
|
||||
{{- if .Values.podDisruptionBudget.metricServer.minAvailable }}
|
||||
minAvailable: {{ .Values.podDisruptionBudget.metricServer.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.metricServer.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.metricServer.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- if and .Values.prometheus.metricServer.enabled .Values.prometheus.metricServer.podMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.prometheus.metricServer.podMonitor.additionalLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.metricServer.podMonitor.namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podMetricsEndpoints:
|
||||
- port: {{ .Values.prometheus.metricServer.portName }}
|
||||
path: /metrics
|
||||
{{- with .Values.prometheus.metricServer.podMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.metricServer.podMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.metricServer.podMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.metricServer.podMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- end }}
|
||||
@@ -0,0 +1,50 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if or .Values.additionalAnnotations .Values.service.annotations (and .Values.prometheus.metricServer.enabled ( not (or .Values.prometheus.metricServer.podMonitor.enabled .Values.prometheus.metricServer.serviceMonitor.enabled )))}}
|
||||
annotations:
|
||||
{{- if and .Values.prometheus.metricServer.enabled ( not (or .Values.prometheus.metricServer.podMonitor.enabled .Values.prometheus.metricServer.serviceMonitor.enabled )) }}
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.prometheus.metricServer.port | quote }}
|
||||
prometheus.io/path: "/metrics"
|
||||
{{- end }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.annotations }}
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.service.portHttps }}
|
||||
targetPort: {{ .Values.service.portHttpsTarget }}
|
||||
protocol: TCP
|
||||
appProtocol: https
|
||||
- name: {{ .Values.prometheus.metricServer.portName }}
|
||||
port: {{ .Values.prometheus.metricServer.port }}
|
||||
targetPort: {{ .Values.prometheus.metricServer.port }}
|
||||
protocol: TCP
|
||||
{{- with .Values.prometheus.metricServer.appProtocol }}
|
||||
appProtocol: {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.profiling.metricsServer.enabled }}
|
||||
- name: profiling
|
||||
port: {{ .Values.profiling.metricsServer.port }}
|
||||
targetPort: {{ .Values.profiling.metricsServer.port }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ .Values.operator.name }}-metrics-apiserver
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if (.Values.serviceAccount.metricServer).create | default .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ (.Values.serviceAccount.metricServer).name | default .Values.serviceAccount.name }}
|
||||
{{- include "keda.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- if .Values.additionalAnnotations }}
|
||||
{{- toYaml .Values.additionalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if (.Values.serviceAccount.metricServer).annotations | default .Values.serviceAccount.annotations }}
|
||||
{{- toYaml ((.Values.serviceAccount.metricServer).annotations | default .Values.serviceAccount.annotations) | nindent 4}}
|
||||
{{- end }}
|
||||
name: {{ (.Values.serviceAccount.metricServer).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.metricServer).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.metricServer).automountServiceAccountToken }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{- if and .Values.prometheus.metricServer.enabled .Values.prometheus.metricServer.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.prometheus.metricServer.serviceMonitor.additionalLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.targetLabels }}
|
||||
targetLabels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.podTargetLabels }}
|
||||
podTargetLabels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
endpoints:
|
||||
- port: {{ .Values.prometheus.metricServer.portName }}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.targetPort }}
|
||||
targetPort: {{ . }}
|
||||
{{- end }}
|
||||
path: /metrics
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.metricServer.serviceMonitor.relabelings}}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.relabellings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
scheme: {{ .Values.prometheus.metricServer.serviceMonitor.scheme }}
|
||||
{{- with .Values.prometheus.metricServer.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{ toYaml . | nindent 6}}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-metrics-apiserver
|
||||
{{- end }}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if and .Values.webhooks.enabled .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") }}
|
||||
apiVersion: "cilium.io/v2"
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: {{ .Values.webhooks.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ .Values.webhooks.name }}
|
||||
name: {{ .Values.webhooks.name }}
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: {{ .Values.webhooks.name }}
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- cluster
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- cluster
|
||||
{{ end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-webhook
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-webhook
|
||||
rules:
|
||||
- apiGroups:
|
||||
- autoscaling
|
||||
resources:
|
||||
- horizontalpodautoscalers
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- keda.sh
|
||||
resources:
|
||||
- scaledobjects
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- statefulsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- limitranges
|
||||
verbs:
|
||||
- list
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.operator.name }}-webhook
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.operator.name }}-webhook
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Values.operator.name }}-webhook
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ (.Values.serviceAccount.webhooks).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,177 @@
|
||||
{{- if and .Values.webhooks.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Values.webhooks.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ .Values.webhooks.name }}
|
||||
name: {{ .Values.webhooks.name }}
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
revisionHistoryLimit: {{ .Values.webhooks.revisionHistoryLimit}}
|
||||
replicas: {{ .Values.webhooks.replicaCount}}
|
||||
{{- with .Values.upgradeStrategy.webhooks }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Values.webhooks.name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ .Values.webhooks.name }}
|
||||
name: {{ .Values.webhooks.name }}
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- include "keda.labels" . | indent 8 }}
|
||||
{{- if .Values.podLabels.webhooks }}
|
||||
{{- toYaml .Values.podLabels.webhooks | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.podAnnotations.webhooks .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.podAnnotations.webhooks }}
|
||||
{{- toYaml .Values.podAnnotations.webhooks | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.additionalAnnotations }}
|
||||
{{- toYaml .Values.additionalAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ (.Values.serviceAccount.webhooks).name | default .Values.serviceAccount.name }}
|
||||
automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.webhooks).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.webhooks).automountServiceAccountToken }}
|
||||
securityContext:
|
||||
{{- if .Values.podSecurityContext.webhooks }}
|
||||
{{- toYaml .Values.podSecurityContext.webhooks | nindent 8 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Values.webhooks.name }}
|
||||
securityContext:
|
||||
{{- if .Values.securityContext.webhooks }}
|
||||
{{- toYaml .Values.securityContext.webhooks | nindent 12 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- $registry := .Values.global.image.registry | default .Values.image.webhooks.registry | default "" }}
|
||||
{{- if $registry }}
|
||||
image: "{{ $registry }}/{{ .Values.image.webhooks.repository }}:{{ .Values.image.webhooks.tag | default .Chart.AppVersion }}"
|
||||
{{- else }}
|
||||
image: "{{ .Values.image.webhooks.repository }}:{{ .Values.image.webhooks.tag | default .Chart.AppVersion }}"
|
||||
{{- end }}
|
||||
command:
|
||||
- /keda-admission-webhooks
|
||||
args:
|
||||
- "--zap-log-level={{ .Values.logging.webhooks.level }}"
|
||||
- "--zap-encoder={{ .Values.logging.webhooks.format }}"
|
||||
- "--zap-time-encoding={{ .Values.logging.webhooks.timeEncoding }}"
|
||||
- "--cert-dir={{ .Values.certificates.mountPath }}"
|
||||
- "--health-probe-bind-address=:{{ .Values.webhooks.healthProbePort }}"
|
||||
{{- if .Values.webhooks.port }}
|
||||
- "--port={{ .Values.webhooks.port }}"
|
||||
{{- end }}
|
||||
- --metrics-bind-address=:{{ .Values.prometheus.webhooks.port }}
|
||||
{{- if .Values.profiling.webhooks.enabled }}
|
||||
- "--profiling-bind-address=:{{ .Values.profiling.webhooks.port }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.extraArgs.webhooks }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ .Values.webhooks.healthProbePort }}
|
||||
initialDelaySeconds: {{ .Values.webhooks.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.webhooks.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.webhooks.livenessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.webhooks.livenessProbe.failureThreshold }}
|
||||
successThreshold: {{ .Values.webhooks.livenessProbe.successThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: {{ .Values.webhooks.healthProbePort }}
|
||||
initialDelaySeconds: {{ .Values.webhooks.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.webhooks.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.webhooks.readinessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.webhooks.readinessProbe.failureThreshold }}
|
||||
successThreshold: {{ .Values.webhooks.readinessProbe.successThreshold }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.webhooks.port | default 9443 }}
|
||||
name: http
|
||||
protocol: TCP
|
||||
{{- if .Values.prometheus.webhooks.enabled }}
|
||||
- containerPort: {{ .Values.prometheus.webhooks.port }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
env:
|
||||
- name: WATCH_NAMESPACE
|
||||
value: {{ .Values.watchNamespace | quote }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- if .Values.env }}
|
||||
{{- toYaml .Values.env | nindent 12 -}}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: {{ .Values.certificates.mountPath }}
|
||||
name: certificates
|
||||
readOnly: true
|
||||
{{- if .Values.volumes.webhooks.extraVolumeMounts }}
|
||||
{{- toYaml .Values.volumes.webhooks.extraVolumeMounts | nindent 10 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- if .Values.resources.webhooks }}
|
||||
{{- toYaml .Values.resources.webhooks | nindent 12 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: certificates
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: {{ .Values.certificates.secretName }}
|
||||
{{- if .Values.volumes.webhooks.extraVolumes }}
|
||||
{{- toYaml .Values.volumes.webhooks.extraVolumes | nindent 6 }}
|
||||
{{- end }}
|
||||
hostNetwork: {{ .Values.webhooks.useHostNetwork }}
|
||||
nodeSelector:
|
||||
{{- with .Values.nodeSelector }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.webhooks.affinity }}
|
||||
affinity:
|
||||
{{- toYaml .Values.webhooks.affinity | nindent 8 }}
|
||||
{{- else if .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml .Values.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints.webhooks }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,34 @@
|
||||
{{- if and .Values.webhooks.enabled }}
|
||||
{{- if or (or .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable) .Values.podDisruptionBudget.webhooks }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ .Values.webhooks.name }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
spec:
|
||||
{{- if .Values.podDisruptionBudget.minAvailable }}
|
||||
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.webhooks }}
|
||||
{{- if .Values.podDisruptionBudget.webhooks.minAvailable }}
|
||||
minAvailable: {{ .Values.podDisruptionBudget.webhooks.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.webhooks.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.webhooks.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Values.webhooks.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- if and .Values.webhooks.enabled }}
|
||||
{{- if and .Values.prometheus.webhooks.enabled .Values.prometheus.webhooks.prometheusRules.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ .Values.webhooks.name }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.prometheus.webhooks.prometheusRules.additionalLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.webhooks.prometheusRules.namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups:
|
||||
- name: {{ .Values.webhooks.name }}
|
||||
rules:
|
||||
{{ toYaml .Values.prometheus.webhooks.prometheusRules.alerts | indent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,50 @@
|
||||
{{- if and .Values.webhooks.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
{{- if or .Values.prometheus.webhooks.enabled .Values.additionalAnnotations .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- if and .Values.prometheus.webhooks.enabled ( not .Values.prometheus.webhooks.serviceMonitor.enabled ) }}
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: {{ .Values.prometheus.webhooks.port | quote }}
|
||||
prometheus.io/path: "/metrics"
|
||||
{{- end }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.annotations }}
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: {{ .Values.webhooks.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.webhooks.port | default 9443 }}
|
||||
appProtocol: https
|
||||
{{- if .Values.prometheus.webhooks.enabled }}
|
||||
- name: {{ .Values.prometheus.webhooks.serviceMonitor.port }}
|
||||
port: {{ .Values.prometheus.webhooks.port }}
|
||||
targetPort: {{ .Values.prometheus.webhooks.port }}
|
||||
{{- with .Values.prometheus.webhooks.appProtocol }}
|
||||
appProtocol: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.profiling.webhooks.enabled }}
|
||||
- name: profiling
|
||||
port: {{ .Values.profiling.webhooks.port }}
|
||||
targetPort: {{ .Values.profiling.webhooks.port }}
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ .Values.webhooks.name }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if (.Values.serviceAccount.webhooks).create | default .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ (.Values.serviceAccount.webhooks).name | default .Values.serviceAccount.name }}
|
||||
{{- include "keda.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- if .Values.additionalAnnotations }}
|
||||
{{- toYaml .Values.additionalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if (.Values.serviceAccount.webhooks).annotations | default .Values.serviceAccount.annotations }}
|
||||
{{- toYaml ((.Values.serviceAccount.webhooks).annotations | default .Values.serviceAccount.annotations) | nindent 4}}
|
||||
{{- end }}
|
||||
name: {{ (.Values.serviceAccount.webhooks).name | default .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.webhooks).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.webhooks).automountServiceAccountToken }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,71 @@
|
||||
{{- if and .Values.webhooks.enabled }}
|
||||
{{- if and .Values.prometheus.webhooks.enabled .Values.prometheus.webhooks.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ .Values.webhooks.name }}
|
||||
{{- with .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.prometheus.webhooks.serviceMonitor.additionalLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.targetLabels }}
|
||||
targetLabels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.podTargetLabels }}
|
||||
podTargetLabels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
endpoints:
|
||||
- port: {{ .Values.prometheus.webhooks.serviceMonitor.port }}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.targetPort }}
|
||||
targetPort: {{ . }}
|
||||
{{- end }}
|
||||
path: /metrics
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.webhooks.serviceMonitor.relabelings}}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.relabellings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
scheme: {{ .Values.prometheus.webhooks.serviceMonitor.scheme }}
|
||||
{{- with .Values.prometheus.webhooks.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{ toYaml . | nindent 6}}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,95 @@
|
||||
{{- if and .Values.webhooks.enabled }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if or .Values.certificates.certManager.enabled .Values.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.certificates.certManager.enabled }}
|
||||
{{- if and (not .Values.certificates.certManager.generateCA) .Values.certificates.certManager.issuer.generate }}
|
||||
cert-manager.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ .Values.certificates.certManager.caSecretName }}
|
||||
{{- else }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.operator.name }}-tls-certificates
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.additionalAnnotations }}
|
||||
{{- toYaml .Values.additionalAnnotations | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Values.webhooks.name }}
|
||||
{{- include "keda.labels" . | indent 4 }}
|
||||
name: keda-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ .Values.webhooks.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-keda-sh-v1alpha1-scaledobject
|
||||
failurePolicy: {{ .Values.webhooks.failurePolicy }}
|
||||
matchPolicy: Equivalent
|
||||
name: vscaledobject.kb.io
|
||||
namespaceSelector: {}
|
||||
objectSelector: {}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- keda.sh
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- scaledobjects
|
||||
sideEffects: None
|
||||
timeoutSeconds: {{ .Values.webhooks.timeoutSeconds | default 10 }}
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ .Values.webhooks.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-keda-sh-v1alpha1-triggerauthentication
|
||||
failurePolicy: {{ .Values.webhooks.failurePolicy }}
|
||||
matchPolicy: Equivalent
|
||||
name: vstriggerauthentication.kb.io
|
||||
namespaceSelector: {}
|
||||
objectSelector: {}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- keda.sh
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- triggerauthentications
|
||||
sideEffects: None
|
||||
timeoutSeconds: {{ .Values.webhooks.timeoutSeconds | default 10 }}
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ .Values.webhooks.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-keda-sh-v1alpha1-clustertriggerauthentication
|
||||
failurePolicy: {{ .Values.webhooks.failurePolicy }}
|
||||
matchPolicy: Equivalent
|
||||
name: vsclustertriggerauthentication.kb.io
|
||||
namespaceSelector: {}
|
||||
objectSelector: {}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- keda.sh
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- clustertriggerauthentications
|
||||
sideEffects: None
|
||||
timeoutSeconds: {{ .Values.webhooks.timeoutSeconds | default 10 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,876 @@
|
||||
# Default values for keda.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
global:
|
||||
image:
|
||||
# -- Global image registry of KEDA components
|
||||
registry: null
|
||||
|
||||
image:
|
||||
keda:
|
||||
# -- Image registry of KEDA operator
|
||||
registry: ghcr.io
|
||||
# -- Image name of KEDA operator
|
||||
repository: kedacore/keda
|
||||
# -- Image tag of KEDA operator. Optional, given app version of Helm chart is used by default
|
||||
tag: ""
|
||||
metricsApiServer:
|
||||
# -- Image registry of KEDA Metrics API Server
|
||||
registry: ghcr.io
|
||||
# -- Image name of KEDA Metrics API Server
|
||||
repository: kedacore/keda-metrics-apiserver
|
||||
# -- Image tag of KEDA Metrics API Server. Optional, given app version of Helm chart is used by default
|
||||
tag: ""
|
||||
webhooks:
|
||||
# -- Image registry of KEDA admission-webhooks
|
||||
registry: ghcr.io
|
||||
# -- Image name of KEDA admission-webhooks
|
||||
repository: kedacore/keda-admission-webhooks
|
||||
# -- Image tag of KEDA admission-webhooks . Optional, given app version of Helm chart is used by default
|
||||
tag: ""
|
||||
# -- Image pullPolicy for all KEDA components
|
||||
pullPolicy: Always
|
||||
|
||||
# -- Kubernetes cluster name. Used in features such as emitting CloudEvents
|
||||
clusterName: kubernetes-default
|
||||
|
||||
# -- Kubernetes cluster domain
|
||||
clusterDomain: cluster.local
|
||||
|
||||
crds:
|
||||
# -- Defines whether the KEDA CRDs have to be installed or not.
|
||||
install: true
|
||||
|
||||
# -- Custom annotations specifically for CRDs
|
||||
additionalAnnotations:
|
||||
{}
|
||||
# foo: bar
|
||||
|
||||
# -- Defines Kubernetes namespaces to watch to scale their workloads. Default watches all namespaces
|
||||
watchNamespace: ""
|
||||
|
||||
# -- Name of secret to use to pull images to use to pull Docker images
|
||||
imagePullSecrets: []
|
||||
|
||||
networkPolicy:
|
||||
# -- Enable network policies
|
||||
enabled: false
|
||||
# -- Flavor of the network policies (cilium)
|
||||
flavor: "cilium"
|
||||
# -- Allow use of extra egress rules for cilium network policies
|
||||
cilium:
|
||||
operator:
|
||||
extraEgressRules: []
|
||||
|
||||
operator:
|
||||
# -- Name of the KEDA operator
|
||||
name: keda-operator
|
||||
# -- ReplicaSets for this Deployment you want to retain (Default: 10)
|
||||
revisionHistoryLimit: 10
|
||||
# -- Capability to configure the number of replicas for KEDA operator.
|
||||
# While you can run more replicas of our operator, only one operator instance will be the leader and serving traffic.
|
||||
# You can run multiple replicas, but they will not improve the performance of KEDA, it could only reduce downtime during a failover.
|
||||
# Learn more in [our documentation](https://keda.sh/docs/latest/operate/cluster/#high-availability).
|
||||
replicaCount: 1
|
||||
# --Disable response compression for k8s restAPI in client-go.
|
||||
# Disabling compression simply means that turns off the process of making data smaller for K8s restAPI in client-go for faster transmission.
|
||||
disableCompression: true
|
||||
# -- [Affinity] for pod scheduling for KEDA operator. Takes precedence over the `affinity` field
|
||||
affinity: {}
|
||||
# podAntiAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# - labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app
|
||||
# operator: In
|
||||
# values:
|
||||
# - keda-operator
|
||||
# topologyKey: "kubernetes.io/hostname"
|
||||
# -- Additional containers to run as part of the operator deployment
|
||||
extraContainers: []
|
||||
# - name: hello-many
|
||||
# args:
|
||||
# - -c
|
||||
# - "while true; do echo hi; sleep 300; done"
|
||||
# command:
|
||||
# - /bin/sh
|
||||
# image: 'busybox:glibc'
|
||||
# -- Additional init containers to run as part of the operator deployment
|
||||
extraInitContainers: []
|
||||
# - name: hello-once
|
||||
# args:
|
||||
# - -c
|
||||
# - "echo 'Hello World!'"
|
||||
# command:
|
||||
# - /bin/sh
|
||||
# image: 'busybox:glibc'
|
||||
# -- Liveness probes for operator ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/))
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 25
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
# -- Readiness probes for operator ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes))
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 3
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
|
||||
metricsServer:
|
||||
# -- ReplicaSets for this Deployment you want to retain (Default: 10)
|
||||
revisionHistoryLimit: 10
|
||||
# -- Capability to configure the number of replicas for KEDA metric server.
|
||||
# While you can run more replicas of our metric server, only one instance will used and serve traffic.
|
||||
# You can run multiple replicas, but they will not improve the performance of KEDA, it could only reduce downtime during a failover.
|
||||
# Learn more in [our documentation](https://keda.sh/docs/latest/operate/cluster/#high-availability).
|
||||
replicaCount: 1
|
||||
# --Disable response compression for k8s restAPI in client-go.
|
||||
# Disabling compression simply means that turns off the process of making data smaller for K8s restAPI in client-go for faster transmission.
|
||||
disableCompression: true
|
||||
# use ClusterFirstWithHostNet if `useHostNetwork: true` https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
|
||||
# -- Defined the DNS policy for the metric server
|
||||
dnsPolicy: ClusterFirst
|
||||
# -- Enable metric server to use host network
|
||||
useHostNetwork: false
|
||||
# -- [Affinity] for pod scheduling for Metrics API Server. Takes precedence over the `affinity` field
|
||||
affinity: {}
|
||||
# podAntiAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# - labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app
|
||||
# operator: In
|
||||
# values:
|
||||
# - keda-operator-metrics-apiserver
|
||||
# topologyKey: "kubernetes.io/hostname"
|
||||
# -- Liveness probes for Metrics API Server ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/))
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
# -- Readiness probes for Metrics API Server ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes))
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 3
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
|
||||
webhooks:
|
||||
# It also used to enable or disable webhook patching in the operator
|
||||
enabled: true
|
||||
# -- Port number to use for KEDA admission webhooks. Default is 9443.
|
||||
port: ""
|
||||
# -- Port number to use for KEDA admission webhooks health probe
|
||||
healthProbePort: 8081
|
||||
# -- Liveness probes for admission webhooks ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/))
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 25
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
# -- Readiness probes for admission webhooks ([docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes))
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 3
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
# -- Timeout in seconds for KEDA admission webhooks
|
||||
timeoutSeconds: 10
|
||||
# -- Enable webhook to use host network, this is required on EKS with custom CNI
|
||||
useHostNetwork: false
|
||||
# -- Name of the KEDA admission webhooks
|
||||
name: keda-admission-webhooks
|
||||
# -- ReplicaSets for this Deployment you want to retain (Default: 10)
|
||||
revisionHistoryLimit: 10
|
||||
# -- Capability to configure the number of replicas for KEDA admission webhooks
|
||||
replicaCount: 1
|
||||
# -- [Affinity] for pod scheduling for KEDA admission webhooks. Takes precedence over the `affinity` field
|
||||
affinity: {}
|
||||
# podAntiAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# - labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app
|
||||
# operator: In
|
||||
# values:
|
||||
# - keda-admission-webhooks
|
||||
# topologyKey: "kubernetes.io/hostname"
|
||||
|
||||
# -- [Failure policy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy) to use with KEDA admission webhooks
|
||||
failurePolicy: Ignore
|
||||
|
||||
upgradeStrategy:
|
||||
# -- Capability to configure [Deployment upgrade strategy] for operator
|
||||
operator: {}
|
||||
# type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxUnavailable: 1
|
||||
# maxSurge: 1
|
||||
|
||||
# -- Capability to configure [Deployment upgrade strategy] for Metrics Api Server
|
||||
metricsApiServer: {}
|
||||
# type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxUnavailable: 1
|
||||
# maxSurge: 1
|
||||
|
||||
# -- Capability to configure [Deployment upgrade strategy] for Admission webhooks
|
||||
webhooks: {}
|
||||
# type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxUnavailable: 1
|
||||
# maxSurge: 1
|
||||
|
||||
podDisruptionBudget:
|
||||
# -- Capability to configure [Pod Disruption Budget]
|
||||
operator: {}
|
||||
# minAvailable: 1
|
||||
# maxUnavailable: 1
|
||||
|
||||
# -- Capability to configure [Pod Disruption Budget]
|
||||
metricServer: {}
|
||||
# minAvailable: 1
|
||||
# maxUnavailable: 1
|
||||
|
||||
# -- Capability to configure [Pod Disruption Budget]
|
||||
webhooks: {}
|
||||
# minAvailable: 1
|
||||
# maxUnavailable: 1
|
||||
|
||||
# -- Custom labels to add into metadata
|
||||
additionalLabels:
|
||||
{}
|
||||
# foo: bar
|
||||
|
||||
# -- Custom annotations to add into metadata
|
||||
additionalAnnotations:
|
||||
{}
|
||||
# foo: bar
|
||||
|
||||
podAnnotations:
|
||||
# -- Pod annotations for KEDA operator
|
||||
keda: {}
|
||||
# -- Pod annotations for KEDA Metrics Adapter
|
||||
metricsAdapter: {}
|
||||
# -- Pod annotations for KEDA Admission webhooks
|
||||
webhooks: {}
|
||||
podLabels:
|
||||
# -- Pod labels for KEDA operator
|
||||
keda: {}
|
||||
# -- Pod labels for KEDA Metrics Adapter
|
||||
metricsAdapter: {}
|
||||
# -- Pod labels for KEDA Admission webhooks
|
||||
webhooks: {}
|
||||
|
||||
rbac:
|
||||
# -- Specifies whether RBAC should be used
|
||||
create: true
|
||||
# -- Specifies whether RBAC for CRDs should be [aggregated](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles) to default roles (view, edit, admin)
|
||||
aggregateToDefaultRoles: false
|
||||
|
||||
# -- Whether RBAC for configured CRDs that can have a `scale` subresource should be created
|
||||
enabledCustomScaledRefKinds: true
|
||||
# -- Customize the namespace of k8s metrics-server deployment
|
||||
# This could also be achieved by the Kubernetes control plane manager flag --use-service-account-credentials:
|
||||
# [docs](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/)
|
||||
controlPlaneServiceAccountsNamespace: kube-system
|
||||
# -- List of custom resources that support the `scale` subresource and can be referenced by `scaledobject.spec.scaleTargetRef`.
|
||||
# The feature needs to be also enabled by `enabledCustomScaledRefKinds`.
|
||||
# If left empty, RBAC for `apiGroups: *` and `resources: *, */scale` will be created
|
||||
# note: Deployments and StatefulSets are supported out of the box
|
||||
scaledRefKinds:
|
||||
- apiGroup: "*"
|
||||
kind: "*"
|
||||
# - apiGroup: argoproj.io
|
||||
# kind: Rollout
|
||||
|
||||
serviceAccount:
|
||||
operator:
|
||||
# -- Specifies whether a service account should be created
|
||||
create: true
|
||||
# -- The name of the service account to use.
|
||||
name: keda-operator
|
||||
# -- Specifies whether a service account should automount API-Credentials
|
||||
automountServiceAccountToken: true
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
metricServer:
|
||||
# -- Specifies whether a service account should be created
|
||||
create: true
|
||||
# -- The name of the service account to use.
|
||||
name: keda-metrics-server
|
||||
# -- Specifies whether a service account should automount API-Credentials
|
||||
automountServiceAccountToken: true
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
webhooks:
|
||||
# -- Specifies whether a service account should be created
|
||||
create: true
|
||||
# -- The name of the service account to use.
|
||||
name: keda-webhook
|
||||
# -- Specifies whether a service account should automount API-Credentials
|
||||
automountServiceAccountToken: true
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
|
||||
podIdentity:
|
||||
azureWorkload:
|
||||
# -- Set to true to enable Azure Workload Identity usage.
|
||||
# See https://keda.sh/docs/concepts/authentication/#azure-workload-identity
|
||||
# This will be set as a label on the KEDA service account.
|
||||
enabled: false
|
||||
# Set to the value of the Azure Active Directory Client and Tenant Ids
|
||||
# respectively. These will be set as annotations on the KEDA service account.
|
||||
# -- Id of Azure Active Directory Client to use for authentication with Azure Workload Identity. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity))
|
||||
clientId: ""
|
||||
# -- Id Azure Active Directory Tenant to use for authentication with for Azure Workload Identity. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity))
|
||||
tenantId: ""
|
||||
# Set to the value of the service account token expiration duration.
|
||||
# This will be set as an annotation on the KEDA service account.
|
||||
# -- Duration in seconds to automatically expire tokens for the service account. ([docs](https://keda.sh/docs/concepts/authentication/#azure-workload-identity))
|
||||
tokenExpiration: 3600
|
||||
aws:
|
||||
irsa:
|
||||
# -- Specifies whether [AWS IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) is to be enabled or not.
|
||||
enabled: false
|
||||
# -- Sets the token audience for IRSA.
|
||||
# This will be set as an annotation on the KEDA service account.
|
||||
audience: "sts.amazonaws.com"
|
||||
# -- Set to the value of the ARN of an IAM role with a web identity provider.
|
||||
# This will be set as an annotation on the KEDA service account.
|
||||
roleArn: ""
|
||||
# -- Sets the use of an STS regional endpoint instead of global.
|
||||
# Recommended to use regional endpoint in almost all cases.
|
||||
# This will be set as an annotation on the KEDA service account.
|
||||
stsRegionalEndpoints: "true"
|
||||
# -- Set to the value of the service account token expiration duration.
|
||||
# This will be set as an annotation on the KEDA service account.
|
||||
tokenExpiration: 86400
|
||||
gcp:
|
||||
# -- Set to true to enable GCP Workload Identity.
|
||||
# See https://keda.sh/docs/2.10/authentication-providers/gcp-workload-identity/
|
||||
# This will be set as a annotation on the KEDA service account.
|
||||
enabled: false
|
||||
# -- GCP IAM Service Account Email which you would like to use for workload identity.
|
||||
gcpIAMServiceAccount: ""
|
||||
|
||||
# -- Set this if you are using an external scaler and want to communicate
|
||||
# over TLS (recommended). This variable holds the name of the secret that
|
||||
# will be mounted to the /grpccerts path on the Pod
|
||||
grpcTLSCertsSecret: ""
|
||||
|
||||
# -- Set this if you are using HashiCorp Vault and want to communicate
|
||||
# over TLS (recommended). This variable holds the name of the secret that
|
||||
# will be mounted to the /vault path on the Pod
|
||||
hashiCorpVaultTLS: ""
|
||||
|
||||
logging:
|
||||
operator:
|
||||
# -- Logging level for KEDA Operator.
|
||||
# allowed values: `debug`, `info`, `error`, or an integer value greater than 0, specified as string
|
||||
level: info
|
||||
# -- Logging format for KEDA Operator.
|
||||
# allowed values: `json` or `console`
|
||||
format: console
|
||||
# -- Logging time encoding for KEDA Operator.
|
||||
# allowed values are `epoch`, `millis`, `nano`, `iso8601`, `rfc3339` or `rfc3339nano`
|
||||
timeEncoding: rfc3339
|
||||
# -- If enabled, the stack traces will be also printed
|
||||
stackTracesEnabled: false
|
||||
metricServer:
|
||||
# -- Logging level for Metrics Server.
|
||||
# allowed values: `0` for info, `4` for debug, or an integer value greater than 0, specified as string
|
||||
level: 0
|
||||
# -- Logging stderrthreshold for Metrics Server
|
||||
# allowed values: 'DEBUG','INFO','WARN','ERROR','ALERT','EMERG'
|
||||
stderrthreshold: ERROR
|
||||
webhooks:
|
||||
# -- Logging level for KEDA Operator.
|
||||
# allowed values: `debug`, `info`, `error`, or an integer value greater than 0, specified as string
|
||||
level: info
|
||||
# -- Logging format for KEDA Admission webhooks.
|
||||
# allowed values: `json` or `console`
|
||||
format: console
|
||||
# -- Logging time encoding for KEDA Operator.
|
||||
# allowed values are `epoch`, `millis`, `nano`, `iso8601`, `rfc3339` or `rfc3339nano`
|
||||
timeEncoding: rfc3339
|
||||
|
||||
# -- [Security context] for all containers
|
||||
# @default -- [See below](#KEDA-is-secure-by-default)
|
||||
securityContext:
|
||||
# -- [Security context] of the operator container
|
||||
# @default -- [See below](#KEDA-is-secure-by-default)
|
||||
operator:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
# -- [Security context] of the metricServer container
|
||||
# @default -- [See below](#KEDA-is-secure-by-default)
|
||||
metricServer:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
# -- [Security context] of the admission webhooks container
|
||||
# @default -- [See below](#KEDA-is-secure-by-default)
|
||||
webhooks:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
# -- [Pod security context] for all pods
|
||||
# @default -- [See below](#KEDA-is-secure-by-default)
|
||||
podSecurityContext:
|
||||
# -- [Pod security context] of the KEDA operator pod
|
||||
# @default -- [See below](#KEDA-is-secure-by-default)
|
||||
operator:
|
||||
runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
# runAsGroup: 1000
|
||||
# fsGroup: 1000
|
||||
|
||||
# -- [Pod security context] of the KEDA metrics apiserver pod
|
||||
# @default -- [See below](#KEDA-is-secure-by-default)
|
||||
metricServer:
|
||||
runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
# runAsGroup: 1000
|
||||
# fsGroup: 1000
|
||||
|
||||
# -- [Pod security context] of the KEDA admission webhooks
|
||||
# @default -- [See below](#KEDA-is-secure-by-default)
|
||||
webhooks:
|
||||
runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
# runAsGroup: 1000
|
||||
# fsGroup: 1000
|
||||
|
||||
service:
|
||||
# -- KEDA Metric Server service type
|
||||
type: ClusterIP
|
||||
# -- HTTPS port for KEDA Metric Server service
|
||||
portHttps: 443
|
||||
# -- HTTPS port for KEDA Metric Server container
|
||||
portHttpsTarget: 6443
|
||||
# -- Annotations to add the KEDA Metric Server service
|
||||
annotations: {}
|
||||
|
||||
# We provides the default values that we describe in our docs:
|
||||
# https://keda.sh/docs/latest/operate/cluster/
|
||||
# If you want to specify the resources (or totally remove the defaults), change or comment the following
|
||||
# lines, adjust them as necessary, or simply add the curly braces after 'operator' and/or 'metricServer'
|
||||
# and remove/comment the default values
|
||||
resources:
|
||||
# -- Manage [resource request & limits] of KEDA operator pod
|
||||
operator:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1000Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
# -- Manage [resource request & limits] of KEDA metrics apiserver pod
|
||||
metricServer:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1000Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
# -- Manage [resource request & limits] of KEDA admission webhooks pod
|
||||
webhooks:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1000Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
# -- Node selector for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/))
|
||||
nodeSelector: {}
|
||||
# -- Tolerations for pod scheduling ([docs](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/))
|
||||
tolerations: []
|
||||
|
||||
topologySpreadConstraints:
|
||||
# -- [Pod Topology Constraints] of KEDA operator pod
|
||||
operator: []
|
||||
# -- [Pod Topology Constraints] of KEDA metrics apiserver pod
|
||||
metricsServer: []
|
||||
# -- [Pod Topology Constraints] of KEDA admission webhooks pod
|
||||
webhooks: []
|
||||
|
||||
# -- [Affinity] for pod scheduling for KEDA operator, Metrics API Server and KEDA admission webhooks.
|
||||
affinity: {}
|
||||
# podAntiAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# - labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app
|
||||
# operator: In
|
||||
# values:
|
||||
# - keda-operator
|
||||
# - keda-operator-metrics-apiserver
|
||||
# - keda-admission-webhooks
|
||||
# topologyKey: "kubernetes.io/hostname"
|
||||
|
||||
# -- priorityClassName for all KEDA components
|
||||
priorityClassName: ""
|
||||
|
||||
## The default HTTP timeout in milliseconds that KEDA should use
|
||||
## when making requests to external services. Removing this defaults to a
|
||||
## reasonable default
|
||||
http:
|
||||
# -- The default HTTP timeout to use for all scalers that use raw HTTP clients (some scalers use SDKs to access target services. These have built-in HTTP clients, and the timeout does not necessarily apply to them)
|
||||
timeout: 3000
|
||||
keepAlive:
|
||||
# -- Enable HTTP connection keep alive
|
||||
enabled: true
|
||||
# -- The minimum TLS version to use for all scalers that use raw HTTP clients (some scalers use SDKs to access target services. These have built-in HTTP clients, and this value does not necessarily apply to them)
|
||||
minTlsVersion: TLS12
|
||||
|
||||
## This setting lets you enable profiling for all of the components of KEDA and in the specific port you choose
|
||||
## This can be useful when trying to investigate errors like memory leaks or CPU or even look at goroutines to understand better
|
||||
## This setting is disabled by default
|
||||
profiling:
|
||||
operator:
|
||||
# -- Enable profiling for KEDA operator
|
||||
enabled: false
|
||||
# -- Expose profiling on a specific port
|
||||
port: 8082
|
||||
metricsServer:
|
||||
# -- Enable profiling for KEDA metrics server
|
||||
enabled: false
|
||||
# -- Expose profiling on a specific port
|
||||
port: 8083
|
||||
webhooks:
|
||||
# -- Enable profiling for KEDA admission webhook
|
||||
enabled: false
|
||||
# -- Expose profiling on a specific port
|
||||
port: 8084
|
||||
|
||||
|
||||
## Extra KEDA Operator and Metrics Adapter container arguments
|
||||
extraArgs:
|
||||
# -- Additional KEDA Operator container arguments
|
||||
keda: {}
|
||||
# -- Additional Metrics Adapter container arguments
|
||||
metricsAdapter: {}
|
||||
|
||||
# -- Additional environment variables that will be passed onto all KEDA components
|
||||
env: []
|
||||
# - name: ENV_NAME
|
||||
# value: 'ENV-VALUE'
|
||||
|
||||
# Extra volumes and volume mounts for the deployment. Optional.
|
||||
volumes:
|
||||
keda:
|
||||
# -- Extra volumes for KEDA deployment
|
||||
extraVolumes: []
|
||||
# -- Extra volume mounts for KEDA deployment
|
||||
extraVolumeMounts: []
|
||||
|
||||
metricsApiServer:
|
||||
# -- Extra volumes for metric server deployment
|
||||
extraVolumes: []
|
||||
# -- Extra volume mounts for metric server deployment
|
||||
extraVolumeMounts: []
|
||||
|
||||
webhooks:
|
||||
# -- Extra volumes for admission webhooks deployment
|
||||
extraVolumes: []
|
||||
# -- Extra volume mounts for admission webhooks deployment
|
||||
extraVolumeMounts: []
|
||||
|
||||
prometheus:
|
||||
metricServer:
|
||||
# -- Enable metric server Prometheus metrics expose
|
||||
enabled: false
|
||||
# -- HTTP port used for exposing metrics server prometheus metrics
|
||||
port: 8080
|
||||
# -- HTTP port name for exposing metrics server prometheus metrics
|
||||
portName: metrics
|
||||
# -- App Protocol for service when scraping metrics endpoint
|
||||
# appProtocol: http
|
||||
serviceMonitor:
|
||||
# -- Enables ServiceMonitor creation for the Prometheus Operator
|
||||
enabled: false
|
||||
# -- JobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec]
|
||||
jobLabel: ""
|
||||
# -- TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics
|
||||
targetLabels: []
|
||||
# -- PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics
|
||||
podTargetLabels: []
|
||||
# -- Name of the service port this endpoint refers to. Mutually exclusive with targetPort
|
||||
port: metrics
|
||||
# -- Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port
|
||||
targetPort: ""
|
||||
# -- Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used.
|
||||
interval: ""
|
||||
# -- Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used
|
||||
scrapeTimeout: ""
|
||||
# -- DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]
|
||||
relabellings: []
|
||||
# -- List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]
|
||||
relabelings: []
|
||||
# -- List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]
|
||||
metricRelabelings: []
|
||||
# -- Additional labels to add for metric server using ServiceMonitor crd (prometheus operator)
|
||||
additionalLabels: {}
|
||||
# -- HTTP scheme used for scraping. Defaults to `http`
|
||||
scheme: http
|
||||
# -- TLS configuration for scraping metrics
|
||||
tlsConfig: {}
|
||||
# caFile: /etc/prom-certs/root-cert.pem
|
||||
# certFile: /etc/prom-certs/cert-chain.pem
|
||||
# insecureSkipVerify: true
|
||||
# keyFile: /etc/prom-certs/key.pem
|
||||
podMonitor:
|
||||
# -- Enables PodMonitor creation for the Prometheus Operator
|
||||
enabled: false
|
||||
# -- Scraping interval for metric server using podMonitor crd (prometheus operator)
|
||||
interval: ""
|
||||
# -- Scraping timeout for metric server using podMonitor crd (prometheus operator)
|
||||
scrapeTimeout: ""
|
||||
# -- Scraping namespace for metric server using podMonitor crd (prometheus operator)
|
||||
namespace: ""
|
||||
# -- Additional labels to add for metric server using podMonitor crd (prometheus operator)
|
||||
additionalLabels: {}
|
||||
# -- List of expressions that define custom relabeling rules for metric server podMonitor crd (prometheus operator)
|
||||
relabelings: []
|
||||
# -- List of expressions that define custom metric relabeling rules for metric server PodMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]
|
||||
metricRelabelings: []
|
||||
operator:
|
||||
# -- Enable KEDA Operator prometheus metrics expose
|
||||
enabled: false
|
||||
# -- Port used for exposing KEDA Operator prometheus metrics
|
||||
port: 8080
|
||||
# -- App Protocol for service when scraping metrics endpoint
|
||||
# appProtocol: http
|
||||
serviceMonitor:
|
||||
# -- Enables ServiceMonitor creation for the Prometheus Operator
|
||||
enabled: false
|
||||
# -- JobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec]
|
||||
jobLabel: ""
|
||||
# -- TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics
|
||||
targetLabels: []
|
||||
# -- PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics
|
||||
podTargetLabels: []
|
||||
# -- Name of the service port this endpoint refers to. Mutually exclusive with targetPort
|
||||
port: metrics
|
||||
# -- Name or number of the target port of the Pod behind the Service,
|
||||
# the port must be specified with container port property. Mutually exclusive with port
|
||||
targetPort: ""
|
||||
# -- Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used.
|
||||
interval: ""
|
||||
# -- Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used
|
||||
scrapeTimeout: ""
|
||||
# -- DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]
|
||||
relabellings: []
|
||||
# -- List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]
|
||||
relabelings: []
|
||||
# -- List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]
|
||||
metricRelabelings: []
|
||||
# -- Additional labels to add for metric server using ServiceMonitor crd (prometheus operator)
|
||||
additionalLabels: {}
|
||||
# -- HTTP scheme used for scraping. Defaults to `http`
|
||||
scheme: http
|
||||
# -- TLS configuration for scraping metrics
|
||||
tlsConfig: {}
|
||||
# caFile: /etc/prom-certs/root-cert.pem
|
||||
# certFile: /etc/prom-certs/cert-chain.pem
|
||||
# insecureSkipVerify: true
|
||||
# keyFile: /etc/prom-certs/key.pem
|
||||
podMonitor:
|
||||
# -- Enables PodMonitor creation for the Prometheus Operator
|
||||
enabled: false
|
||||
# -- Scraping interval for KEDA Operator using podMonitor crd (prometheus operator)
|
||||
interval: ""
|
||||
# -- Scraping timeout for KEDA Operator using podMonitor crd (prometheus operator)
|
||||
scrapeTimeout: ""
|
||||
# -- Scraping namespace for KEDA Operator using podMonitor crd (prometheus operator)
|
||||
namespace: ""
|
||||
# -- Additional labels to add for KEDA Operator using podMonitor crd (prometheus operator)
|
||||
additionalLabels: {}
|
||||
# -- List of expressions that define custom relabeling rules for KEDA Operator podMonitor crd (prometheus operator)
|
||||
relabelings: []
|
||||
# -- List of expressions that define custom metric relabeling rules for metric server PodMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]
|
||||
metricRelabelings: []
|
||||
prometheusRules:
|
||||
# -- Enables PrometheusRules creation for the Prometheus Operator
|
||||
enabled: false
|
||||
# -- Scraping namespace for KEDA Operator using prometheusRules crd (prometheus operator)
|
||||
namespace: ""
|
||||
# -- Additional labels to add for KEDA Operator using prometheusRules crd (prometheus operator)
|
||||
additionalLabels: {}
|
||||
# -- Additional alerts to add for KEDA Operator using prometheusRules crd (prometheus operator)
|
||||
alerts:
|
||||
[]
|
||||
# - alert: KedaScalerErrors
|
||||
# annotations:
|
||||
# description: Keda scaledObject {{ $labels.scaledObject }} is experiencing errors with {{ $labels.scaler }} scaler
|
||||
# summary: Keda Scaler {{ $labels.scaler }} Errors
|
||||
# expr: sum by ( scaledObject , scaler) (rate(keda_metrics_adapter_scaler_errors[2m])) > 0
|
||||
# for: 2m
|
||||
# labels:
|
||||
webhooks:
|
||||
# -- Enable KEDA admission webhooks prometheus metrics expose
|
||||
enabled: false
|
||||
# -- Port used for exposing KEDA admission webhooks prometheus metrics
|
||||
port: 8080
|
||||
# -- App Protocol for service when scraping metrics endpoint
|
||||
# appProtocol: http
|
||||
serviceMonitor:
|
||||
# -- Enables ServiceMonitor creation for the Prometheus webhooks
|
||||
enabled: false
|
||||
# -- jobLabel selects the label from the associated Kubernetes service which will be used as the job label for all metrics. [ServiceMonitor Spec]
|
||||
jobLabel: ""
|
||||
# -- TargetLabels transfers labels from the Kubernetes `Service` onto the created metrics
|
||||
targetLabels: []
|
||||
# -- PodTargetLabels transfers labels on the Kubernetes `Pod` onto the created metrics
|
||||
podTargetLabels: []
|
||||
# -- Name of the service port this endpoint refers to. Mutually exclusive with targetPort
|
||||
port: metrics
|
||||
# -- Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port
|
||||
targetPort: ""
|
||||
# -- Interval at which metrics should be scraped If not specified Prometheus’ global scrape interval is used.
|
||||
interval: ""
|
||||
# -- Timeout after which the scrape is ended If not specified, the Prometheus global scrape timeout is used unless it is less than Interval in which the latter is used
|
||||
scrapeTimeout: ""
|
||||
# -- DEPRECATED. List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]
|
||||
relabellings: []
|
||||
# -- List of expressions that define custom relabeling rules for metric server ServiceMonitor crd (prometheus operator). [RelabelConfig Spec]
|
||||
relabelings: []
|
||||
# -- List of expressions that define custom metric relabeling rules for metric server ServiceMonitor crd after scrape has happened (prometheus operator). [RelabelConfig Spec]
|
||||
metricRelabelings: []
|
||||
# -- Additional labels to add for metric server using ServiceMonitor crd (prometheus operator)
|
||||
additionalLabels: {}
|
||||
# -- HTTP scheme used for scraping. Defaults to `http`
|
||||
scheme: http
|
||||
# -- TLS configuration for scraping metrics
|
||||
tlsConfig: {}
|
||||
# caFile: /etc/prom-certs/root-cert.pem
|
||||
# certFile: /etc/prom-certs/cert-chain.pem
|
||||
# insecureSkipVerify: true
|
||||
# keyFile: /etc/prom-certs/key.pem
|
||||
prometheusRules:
|
||||
# -- Enables PrometheusRules creation for the Prometheus Operator
|
||||
enabled: false
|
||||
# -- Scraping namespace for KEDA admission webhooks using prometheusRules crd (prometheus operator)
|
||||
namespace: ""
|
||||
# -- Additional labels to add for KEDA admission webhooks using prometheusRules crd (prometheus operator)
|
||||
additionalLabels: {}
|
||||
# -- Additional alerts to add for KEDA admission webhooks using prometheusRules crd (prometheus operator)
|
||||
alerts: []
|
||||
|
||||
opentelemetry:
|
||||
collector:
|
||||
# -- Uri of OpenTelemetry Collector to push telemetry to
|
||||
uri: ""
|
||||
operator:
|
||||
# -- Enable pushing metrics to an OpenTelemetry Collector for operator
|
||||
enabled: false
|
||||
|
||||
certificates:
|
||||
# -- Enables the self generation for KEDA TLS certificates inside KEDA operator
|
||||
autoGenerated: true
|
||||
# -- Secret name to be mounted with KEDA TLS certificates
|
||||
secretName: kedaorg-certs
|
||||
# -- Path where KEDA TLS certificates are mounted
|
||||
mountPath: /certs
|
||||
certManager:
|
||||
# -- Enables Cert-manager for certificate management
|
||||
enabled: false
|
||||
# -- Certificate duration
|
||||
duration: 8760h0m0s # 1 year
|
||||
# -- Certificate renewal time before expiration
|
||||
renewBefore: 5840h0m0s # 8 months
|
||||
# -- Generates a self-signed CA with Cert-manager.
|
||||
# If generateCA is false, the secret with the CA
|
||||
# has to be annotated with `cert-manager.io/allow-direct-injection: "true"`
|
||||
generateCA: true
|
||||
# -- Secret name where the CA is stored (generatedby cert-manager or user given)
|
||||
caSecretName: "kedaorg-ca"
|
||||
# -- Add labels/annotations to secrets created by Certificate resources
|
||||
# [docs](https://cert-manager.io/docs/usage/certificate/#creating-certificate-resources)
|
||||
secretTemplate: {}
|
||||
# annotations:
|
||||
# my-secret-annotation-1: "foo"
|
||||
# my-secret-annotation-2: "bar"
|
||||
# labels:
|
||||
# my-secret-label: foo
|
||||
# -- Reference to custom Issuer. If issuer.generate is false, then issuer.group, issuer.kind and issuer.name are required
|
||||
issuer:
|
||||
# -- Generates an Issuer resource with Cert-manager
|
||||
generate: true
|
||||
# -- Custom Issuer name. Required when generate: false
|
||||
name: foo-org-ca
|
||||
# -- Custom Issuer kind. Required when generate: false
|
||||
kind: ClusterIssuer
|
||||
# -- Custom Issuer group. Required when generate: false
|
||||
group: cert-manager.io
|
||||
operator:
|
||||
# -- Location(s) of CA files for authentication of external TLS connections such as TLS-enabled metrics sources
|
||||
# caDirs:
|
||||
# - /custom/ca
|
||||
|
||||
permissions:
|
||||
metricServer:
|
||||
restrict:
|
||||
# -- Restrict Secret Access for Metrics Server
|
||||
secret: false
|
||||
operator:
|
||||
restrict:
|
||||
# -- Restrict Secret Access for KEDA operator
|
||||
# if true, KEDA operator will be able to read only secrets in {{ .Release.Namespace }} namespace
|
||||
secret: false
|
||||
# -- Array of strings denoting what secrets the KEDA operator will be able to read, this takes into account
|
||||
# also the configured `watchNamespace`.
|
||||
# the default is an empty array -> no restriction on the secret name
|
||||
namesAllowList: []
|
||||
# -- Creates roles and rolebindings from namespaced service accounts in the array which allow the KEDA operator
|
||||
# to request service account tokens for use with the boundServiceAccountToken trigger source.
|
||||
# If the namespace does not exist, this will cause the helm chart installation to fail.
|
||||
serviceAccountTokenCreationRoles: []
|
||||
# - name: myServiceAccount
|
||||
# namespace: myServiceAccountNamespace
|
||||
|
||||
# -- Array of extra K8s manifests to deploy
|
||||
extraObjects: []
|
||||
# - apiVersion: keda.sh/v1alpha1
|
||||
# kind: ClusterTriggerAuthentication
|
||||
# metadata:
|
||||
# name: aws-credentials
|
||||
# namespace: keda
|
||||
# spec:
|
||||
# podIdentity:
|
||||
# provider: aws-eks
|
||||
|
||||
# -- Capability to turn on/off ASCII art in Helm installation notes
|
||||
asciiArt: true
|
||||
|
||||
# -- When specified, each rendered resource will have `app.kubernetes.io/managed-by: ${this}` label on it. Useful, when using only helm template with some other solution.
|
||||
customManagedBy: ""
|
||||
|
||||
# -- Enable service links in pods. Although enabled, mirroring k8s default, it is highly recommended to disable,
|
||||
# due to its legacy status [Legacy container links](https://docs.docker.com/engine/network/links/)
|
||||
enableServiceLinks: true
|
||||
|
||||
Reference in New Issue
Block a user