added repo

helm-templates/pmm/Chart.yaml

@@ -0,0 +1,20 @@
+apiVersion: v2
+appVersion: 2.41.0
+description: A Helm chart for Percona Monitoring and Management (PMM)
+home: https://github.com/percona/pmm
+icon: https://www.percona.com/sites/default/files/pmm-logo.png
+keywords:
+- PMM
+- Monitoring
+maintainers:
+- email: andrew.minkin@percona.com
+  name: gen1us2k
+- email: tomislav.plavcic@percona.com
+  name: tplavcic
+- email: nurlan.moldomurov@percona.com
+  name: bupychuk
+- email: sergey.pronin@percona.com
+  name: spron-in
+name: pmm
+type: application
+version: 1.3.8

helm-templates/pmm/README.md

@@ -0,0 +1,204 @@
+# Percona Monitoring and Management (PMM)
+
+## Introduction
+
+PMM is an open source database monitoring, observability and management tool.
+
+Check more info here: https://docs.percona.com/percona-monitoring-and-management/index.html
+
+## Prerequisites
+
+- Kubernetes 1.22+
+- Helm 3.2.0+
+- PV provisioner support in the underlying infrastructure
+
+## Installing the Chart
+
+To install the chart with the release name `pmm`:
+
+```sh
+helm repo add percona https://percona.github.io/percona-helm-charts/
+helm install pmm percona/pmm
+```
+
+The command deploys PMM on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
+
+> **Tip**: List all releases using `helm list`
+
+## Uninstalling the Chart
+
+To uninstall `pmm` deployment:
+
+```sh
+helm uninstall pmm
+```
+
+This command takes a release name and uninstalls the release.
+
+It removes all of the resources associated with the last release of the chart as well as the release history.
+
+## Parameters
+
+### Percona Monitoring and Management (PMM) parameters
+
+| Name                                 | Description                                                                                                                                                                                                                                   | Value                |
+| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |----------------------|
+| `image.repository`                   | PMM image repository                                                                                                                                                                                                                          | `percona/pmm-server` |
+| `image.pullPolicy`                   | PMM image pull policy                                                                                                                                                                                                                         | `IfNotPresent`       |
+| `image.tag`                          | PMM image tag (immutable tags are recommended)                                                                                                                                                                                                | `2.41.0`             |
+| `image.imagePullSecrets`             | Global Docker registry secret names as an array                                                                                                                                                                                               | `[]`                 |
+| `pmmEnv.DISABLE_UPDATES`             | Disables a periodic check for new PMM versions as well as ability to apply upgrades using the UI (need to be disabled in k8s environment as updates rolled with helm/container update)                                                        | `1`                  |
+| `pmmResources`                       | optional [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) requested for [PMM container](https://docs.percona.com/percona-monitoring-and-management/setting-up/server/index.html#set-up-pmm-server) | `{}`                 |
+| `readyProbeConf.initialDelaySeconds` | Number of seconds after the container has started before readiness probes is initiated                                                                                                                                                        | `1`                  |
+| `readyProbeConf.periodSeconds`       | How often (in seconds) to perform the probe                                                                                                                                                                                                   | `5`                  |
+| `readyProbeConf.failureThreshold`    | When a probe fails, Kubernetes will try failureThreshold times before giving up                                                                                                                                                               | `6`                  |
+
+
+### PMM secrets
+
+| Name                  | Description                                                                                                                                                                        | Value        |
+| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
+| `secret.name`         | Defines the name of the k8s secret that holds passwords and other secrets                                                                                                          | `pmm-secret` |
+| `secret.create`       | If true then secret will be generated by Helm chart. Otherwise it is expected to be created by user.                                                                               | `true`       |
+| `secret.pmm_password` | Initial PMM password - it changes only on the first deployment, ignored if PMM was already provisioned and just restarted. If PMM admin password is not set, it will be generated. | `""`         |
+| `certs`               | Optional certificates, if not provided PMM would use generated self-signed certificates,                                                                                           | `{}`         |
+
+
+### PMM network configuration
+
+| Name                              | Description                                                                                                                                    | Value                 |
+| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| `service.name`                    | Service name that is dns name monitoring services would send data to. `monitoring-service` used by default by pmm-client in Percona operators. | `monitoring-service`  |
+| `service.type`                    | Kubernetes Service type                                                                                                                        | `NodePort`            |
+| `service.ports[0].port`           | https port number                                                                                                                              | `443`                 |
+| `service.ports[0].targetPort`     | target port to map for statefulset and ingress                                                                                                 | `https`               |
+| `service.ports[0].protocol`       | protocol for https                                                                                                                             | `TCP`                 |
+| `service.ports[0].name`           | port name                                                                                                                                      | `https`               |
+| `service.ports[1].port`           | http port number                                                                                                                               | `80`                  |
+| `service.ports[1].targetPort`     | target port to map for statefulset and ingress                                                                                                 | `http`                |
+| `service.ports[1].protocol`       | protocol for http                                                                                                                              | `TCP`                 |
+| `service.ports[1].name`           | port name                                                                                                                                      | `http`                |
+| `ingress.enabled`                 | -- Enable ingress controller resource                                                                                                          | `false`               |
+| `ingress.nginxInc`                | -- Using ingress controller from NGINX Inc                                                                                                     | `false`               |
+| `ingress.annotations`             | -- Ingress annotations configuration                                                                                                           | `{}`                  |
+| `ingress.community.annotations`   | -- Ingress annotations configuration for community managed ingress (nginxInc = false)                                                          | `{}`                  |
+| `ingress.ingressClassName`        | -- Sets the ingress controller class name to use.                                                                                              | `""`                  |
+| `ingress.hosts[0].host`           | hostname                                                                                                                                       | `chart-example.local` |
+| `ingress.hosts[0].paths`          | path mapping                                                                                                                                   | `[]`                  |
+| `ingress.pathType`                | -- How ingress paths should be treated.                                                                                                        | `Prefix`              |
+| `ingress.tls`                     | -- Ingress TLS configuration                                                                                                                   | `[]`                  |
+
+
+### PMM storage configuration
+
+| Name                       | Description                                                                                                                                                                             | Value         |
+| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
+| `storage.name`             | name of PVC                                                                                                                                                                             | `pmm-storage` |
+| `storage.storageClassName` | optional PMM data Persistent Volume Storage Class                                                                                                                                       | `""`          |
+| `storage.size`             | size of storage [depends](https://docs.percona.com/percona-monitoring-and-management/setting-up/server/index.html#set-up-pmm-server) on number of monitored services and data retention | `10Gi`        |
+| `storage.dataSource`       | VolumeSnapshot to start from                                                                                                                                                            | `{}`          |
+| `storage.selector`         | select existing PersistentVolume                                                                                                                                                        | `{}`          |
+
+
+### PMM kubernetes configurations
+
+| Name                         | Description                                                                                                         | Value                 |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| `nameOverride`               | String to partially override common.names.fullname template with a string (will prepend the release name)           | `""`                  |
+| `extraLabels`                | Labels to add to all deployed objects                                                                               | `{}`                  |
+| `serviceAccount.create`      | Specifies whether a ServiceAccount should be created                                                                | `true`                |
+| `serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`.                          | `{}`                  |
+| `serviceAccount.name`        | Name of the service account to use. If not set and create is true, a name is generated using the fullname template. | `pmm-service-account` |
+| `podAnnotations`             | Pod annotations                                                                                                     | `{}`                  |
+| `podSecurityContext`         | Configure Pods Security Context                                                                                     | `{}`                  |
+| `securityContext`            | Configure Container Security Context                                                                                | `{}`                  |
+| `nodeSelector`               | Node labels for pod assignment                                                                                      | `{}`                  |
+| `tolerations`                | Tolerations for pod assignment                                                                                      | `[]`                  |
+| `affinity`                   | Affinity for pod assignment                                                                                         | `{}`                  |
+
+
+Specify each parameter using the `--set key=value[,key=value]` or `--set-string key=value[,key=value]` arguments to `helm install`. For example,
+
+```sh
+helm install pmm \
+  --set service.type="NodePort" \
+  --set storage.storageClassName="linode-block-storage-retain" \
+    percona/pmm
+```
+
+The above command installs PMM with the Service network type set to `NodePort` and storage class to `linode-block-storage-retain` for persistence storage on LKE.
+
+> NOTE: Once this chart is deployed, it is impossible to change the application's access credentials, such as password, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available.
+
+Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example:
+
+```sh
+helm install pmm -f values.yaml percona/pmm
+```
+
+> **Tip**: You can use the default [values.yaml](values.yaml) or get them from chart definition: `helm show values percona/pmm > values.yaml`
+
+## Configuration and installation details
+
+### [Image tags](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
+
+It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.
+
+Percona will release a new chart updating its containers if a new version of the main container is available, there are any significant changes, or critical vulnerabilities exist.
+
+### PMM admin password
+
+PMM admin password would be set only on the first deployment. That setting is ignored if PMM was already provisioned and just restarted and/or updated. In real-life situations it is recommended to create the `pmm-secret` secret manually before the release and set `secret.create` to false. The chart then won't overwrite secret during install or upgrade and values.yaml won't contain any secret.
+
+If PMM admin password is not set explicitly (default), it will be generated.
+
+To get admin password execute:
+
+```sh
+kubectl get secret pmm-secret -o jsonpath='{.data.PMM_ADMIN_PASSWORD}' | base64 --decode
+```
+
+### PMM SSL certificates
+
+PMM ships with self signed SSL certificates to provide secure connection between client and server ([check here](https://docs.percona.com/percona-monitoring-and-management/how-to/secure.html#ssl-encryption)).
+You could see the warning when connecting to PMM. To further increase security, you could provide your certificates and add values of credentials to the fields of the `cert` section:
+
+```yaml
+certs:
+  name: pmm-certs
+  files:
+    certificate.crt: <content>
+    certificate.key: <content>
+    ca-certs.pem: <content>
+    dhparam.pem: <content>
+```
+
+### PMM updates
+
+By default UI update feature is disabled and should not be enabled. Do not modify that parameter or add it while modifying the custom `values.yaml` file:
+
+```yaml
+pmmEnv:
+  DISABLE_UPDATES: "1"
+```
+
+Before updating the helm chart,  it is recommended to pre-pull the image on the node where PMM is running, as the PMM images could be large and could take time to download
+
+PMM updates should happen in a standard way:
+
+```sh
+helm repo update percona
+helm upgrade pmm -f values.yaml percona/pmm
+```
+
+This will check updates in the repo and upgrade deployment if the updates are available.
+
+### [PMM environment variables](https://docs.percona.com/percona-monitoring-and-management/setting-up/server/docker.html#environment-variables)
+
+In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `pmmEnv` property.
+
+```yaml
+pmmEnv:
+  DISABLE_UPDATES: "1"
+  DATA_RETENTION: "2160h" # 90 days
+```

helm-templates/pmm/templates/NOTES.txt

@@ -0,0 +1,32 @@
+
+Percona Monitoring and Management (PMM)
+
+An open source database monitoring, observability and management tool
+Check more info here: https://docs.percona.com/percona-monitoring-and-management/index.html
+
+Get the application URL:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ .Values.service.name }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo https://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ .Values.service.name }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ .Values.service.name }} -o jsonpath="{.status.loadBalancer.ingress[0].ip}")
+  echo https://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "pmm.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[1].containerPort}")
+  echo "Visit https://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+
+Get password for the "admin" user:
+  export ADMIN_PASS=$(kubectl get secret pmm-secret --namespace {{ .Release.Namespace }} -o jsonpath='{.data.PMM_ADMIN_PASSWORD}' | base64 --decode)
+  echo $ADMIN_PASS

helm-templates/pmm/templates/_helpers.tpl

@@ -0,0 +1,79 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "pmm.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "pmm.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "pmm.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "pmm.labels" -}}
+helm.sh/chart: {{ include "pmm.chart" . }}
+{{ include "pmm.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "pmm.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "pmm.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: pmm-server
+app.kubernetes.io/part-of: percona-platform
+{{- if .Values.extraLabels }}
+{{ toYaml .Values.extraLabels }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "pmm.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "pmm.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Pod annotation
+*/}}
+{{- define "pmm.podAnnotations" -}}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ include "pmm.chart" . }}
+checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+{{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations }}
+{{- end }}
+{{- end }}

helm-templates/pmm/templates/clusterrole.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "pmm.fullname" . }}
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+rules:
+# standard RBAC
+- apiGroups: [""] # "" indicates the core API group
+  resources:
+  - namespaces
+  - endpoints
+  - services
+  - nodes
+  - pods
+  - secrets
+  - serviceaccounts
+  verbs:
+  - get
+  - watch
+  - list
+- nonResourceURLs:
+  - /metrics
+  - /metrics/resources
+  verbs:
+  - get
+{{- end }}

helm-templates/pmm/templates/clusterrolebinding.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.serviceAccount.create -}}
+{{- if .Values.pmmEnv.ENABLE_CLUSTER_ROLE_ADMIN -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "pmm.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: {{ include "pmm.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "pmm.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "pmm.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "pmm.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}

helm-templates/pmm/templates/configmap.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.pmmEnv -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "pmm.fullname" . }}
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+data:
+# environment passed to the PMM
+  {{- with .Values.pmmEnv }}
+    {{- . | toYaml | nindent 6 }}
+  {{- end }}
+{{- end }}

helm-templates/pmm/templates/ingress.yaml

@@ -0,0 +1,148 @@
+{{- if .Values.ingress.enabled -}}
+{{- $serviceName := .Values.service.name -}}
+{{- $grpcPort := (index $.Values.service.ports 0).port  -}}
+{{- $servicePort := (index $.Values.service.ports 1).port  -}}
+{{- $ingressPathType := .Values.ingress.pathType -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "pmm.fullname" . }}
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+{{- if or .Values.ingress.annotations .Values.ingress.nginxInc }}
+  annotations:
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+    {{- if .Values.ingress.nginxInc }}
+    nginx.org/ssl-services: {{ $serviceName }}-grpc
+    nginx.org/grpc-services: {{ $serviceName }}-grpc
+    {{- end }}
+{{- end }}
+spec:
+{{- if .Values.ingress.ingressClassName }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+{{- end }}
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+  rules:
+  {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+        {{- range .paths }}
+          - path: {{ . }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}
+                port: 
+                  number: {{ $servicePort }}
+          {{- if $.Values.ingress.nginxInc }}
+          # gRPC paths
+          - path: {{ printf "%s/agent." . | replace "//" "/" }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}-grpc
+                port: 
+                  number: {{ $grpcPort }} # MUST proxy to HTTPS
+          - path: {{ printf "%s/inventory." . | replace "//" "/" }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}-grpc
+                port: 
+                  number: {{ $grpcPort }} # MUST proxy to HTTPS
+          - path: {{ printf "%s/management." . | replace "//" "/" }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}-grpc
+                port: 
+                  number: {{ $grpcPort }} # MUST proxy to HTTPS
+          - path: {{ printf "%s/server." . | replace "//" "/" }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}-grpc
+                port: 
+                  number: {{ $grpcPort }} # MUST proxy to HTTPS
+          {{- end }}
+        {{- end }}
+  {{- end }}
+{{- if not .Values.ingress.nginxInc }}
+--- 
+# Community version of ingress-nginx requires second Ingress for gRPC
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "pmm.fullname" . }}-grpc
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+  annotations:
+    {{- with .Values.ingress.community.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    nginx.ingress.kubernetes.io/backend-protocol: "GRPCS"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+{{- if .Values.ingress.ingressClassName }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+{{- end }}
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+  rules:
+  {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+        {{- range .paths }}
+          # gRPC paths
+          - path: {{ printf "%s/agent." . | replace "//" "/" }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}-grpc
+                port: 
+                  number: {{ $grpcPort }} # MUST proxy to HTTPS
+          - path: {{ printf "%s/inventory." . | replace "//" "/" }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}-grpc
+                port: 
+                  number: {{ $grpcPort }} # MUST proxy to HTTPS
+          - path: {{ printf "%s/management." . | replace "//" "/" }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}-grpc
+                port: 
+                  number: {{ $grpcPort }} # MUST proxy to HTTPS
+          - path: {{ printf "%s/server." . | replace "//" "/" }}
+            pathType: {{ $ingressPathType }}
+            backend:
+              service:
+                name: {{ $serviceName }}-grpc
+                port: 
+                  number: {{ $grpcPort }} # MUST proxy to HTTPS
+        {{- end }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}

helm-templates/pmm/templates/secret-certs.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.certs.name -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.certs.name }}
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+# ngnix ssl certificates
+  {{- with .Values.certs.files }}
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

helm-templates/pmm/templates/secret.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.secret.create -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.name }}
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+# base64 encoded password
+# encode some password: `echo -n "admin" | base64`
+# to get the password on deployed cluster: `kubectl get secret pmm-secret -o jsonpath='{.data.PMM_ADMIN_PASSWORD}' | base64 --decode`
+  PMM_ADMIN_PASSWORD: {{ .Values.secret.pmm_password | default (randAscii 16) | b64enc | quote }}
+  {{- if .Values.secret.GF_AUTH_GENERIC_OAUTH_CLIENT_ID -}}
+  GF_AUTH_GENERIC_OAUTH_CLIENT_ID: {{ .Values.secret.GF_AUTH_GENERIC_OAUTH_CLIENT_ID }}
+  {{- end }}
+  {{- if .Values.secret.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET -}}
+  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: {{ .Values.secret.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET }}
+  {{- end }}
+{{- end }}

helm-templates/pmm/templates/service.yaml

@@ -0,0 +1,49 @@
+{{- $serviceType := .Values.service.type -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.service.name }}
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  {{- with .Values.service.finalizers }}
+  finalizers:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+spec:
+  type: {{ $serviceType | default "ClusterIP" }}
+  {{- with .Values.service.ports }}
+  ports:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  selector:
+    {{- include "pmm.selectorLabels" . | nindent 4 }}
+{{- if .Values.ingress.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.service.name }}-grpc
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  {{- with .Values.service.finalizers }}
+  finalizers:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+spec:
+  type: {{ $serviceType | default "ClusterIP" }}
+  {{- with .Values.service.ports }}
+  ports:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  selector:
+    {{- include "pmm.selectorLabels" . | nindent 4 }}
+---
+{{- end }}

helm-templates/pmm/templates/serviceaccount.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "pmm.serviceAccountName" . }}
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+secrets:
+  - name: {{ include "pmm.serviceAccountName" . }}-token
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: {{ include "pmm.serviceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ include "pmm.serviceAccountName" . }}
+{{- end }}

helm-templates/pmm/templates/statefulset.yaml

@@ -0,0 +1,149 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "pmm.fullname" . }}
+  labels:
+    {{- include "pmm.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Values.service.name }}
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "pmm.selectorLabels" . | nindent 6 }}
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        {{- include "pmm.podAnnotations" . | nindent 8 }}
+      labels:
+        {{- include "pmm.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.image.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ include "pmm.serviceAccountName" . }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          {{- if .Values.pmmResources }}
+          resources:
+            {{- toYaml .Values.pmmResources | nindent 12 }}
+          {{- end }}
+
+          # environment passed to PMM, defined in configMap
+          envFrom:
+            - configMapRef:
+                name: {{ include "pmm.fullname" . }}
+                optional: true
+
+          # additional secrets that could be used for Grafana iDP 
+          env:
+            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secret.name }}
+                  key: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+                  optional: true
+            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secret.name }}
+                  key: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+                  optional: true
+            - name: GF_SECURITY_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secret.name }}
+                  key: PMM_ADMIN_PASSWORD
+                  optional: true
+            - name: PMM_INSTALL_METHOD
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.annotations['app.kubernetes.io/managed-by']
+          ports:
+            - name: http
+              containerPort: 80
+            - name: https
+              containerPort: 443
+          readinessProbe:
+            httpGet:
+              path: /v1/readyz
+              port: http
+          {{- if .Values.readyProbeConf }} 
+            {{- toYaml .Values.readyProbeConf | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: {{ .Values.storage.name }}
+              mountPath: /srv
+            - name: annotations
+              mountPath: "/var/run/pmm/annotations"
+              readOnly: true
+            {{- if .Values.certs.name }}
+            - name: {{ .Values.certs.name }}
+              mountPath: /srv/nginx
+              readOnly: true
+            {{- end }}
+            {{- if .Values.extraVolumeMounts }}
+            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+            {{- end }}
+      volumes:
+        - name: annotations
+          projected:
+            sources:
+            - downwardAPI:
+                items:
+                  - path: "annotations"
+                    fieldRef:
+                      fieldPath: metadata.annotations
+      {{- if .Values.certs.name }}
+        - name: {{ .Values.certs.name }}
+          secret:
+            secretName: {{ .Values.certs.name }}
+            optional: false
+      {{- end }}
+      {{- if .Values.extraVolumes }}
+        {{- toYaml .Values.extraVolumes | nindent 8 }}
+      {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: {{ .Values.storage.name }}
+      spec:
+        {{- if .Values.storage.selector }}
+        selector:
+          {{- toYaml .Values.storage.selector | nindent 10 }}
+        {{- end }}
+        {{ if .Values.storage.storageClassName }}
+        storageClassName: {{ .Values.storage.storageClassName }}
+        {{ end }}
+        {{- if .Values.storage.dataSource }}
+        dataSource:
+          {{- toYaml .Values.storage.dataSource | nindent 10 }}
+        {{- end }}
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: {{ .Values.storage.size }}

helm-templates/pmm/values.yaml

@@ -0,0 +1,265 @@
+## @section Percona Monitoring and Management (PMM) parameters
+## Default values for PMM.
+## This is a YAML-formatted file.
+## Declare variables to be passed into your templates.
+
+## PMM image version
+## ref: https://hub.docker.com/r/percona/pmm-server/tags
+## @param image.repository PMM image repository
+## @param image.pullPolicy PMM image pull policy
+## @param image.tag PMM image tag (immutable tags are recommended)
+## @param image.imagePullSecrets Global Docker registry secret names as an array
+##
+image:
+  repository: registry-1.percona.com/percona/pmm-server
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: "2.41.0"
+  imagePullSecrets: []
+
+## PMM environment variables
+## ref: https://docs.percona.com/percona-monitoring-and-management/setting-up/server/docker.html#environment-variables
+##
+pmmEnv:
+  ## @param pmmEnv.DISABLE_UPDATES Disables a periodic check for new PMM versions as well as ability to apply upgrades using the UI (need to be disabled in k8s environment as updates rolled with helm/container update)
+  ##
+  DISABLE_UPDATES: "1"
+#  optional variables to integrate Grafana with internal iDP, see also secret part
+#  GF_AUTH_GENERIC_OAUTH_ENABLED: 'true'
+#  GF_AUTH_GENERIC_OAUTH_SCOPES: ''
+#  GF_AUTH_GENERIC_OAUTH_AUTH_URL: ''
+#  GF_AUTH_GENERIC_OAUTH_TOKEN_URL: ''
+#  GF_AUTH_GENERIC_OAUTH_API_URL: ''
+#  GF_AUTH_GENERIC_OAUTH_ALLOWED_DOMAINS: ''
+
+## @param pmmResources optional [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) requested for [PMM container](https://docs.percona.com/percona-monitoring-and-management/setting-up/server/index.html#set-up-pmm-server)
+    ##  pmmResources:
+    ##    requests:
+    ##      memory: "32Gi"
+    ##      cpu: "8"
+    ##    limits:
+    ##      memory: "64Gi"
+    ##      cpu: "32"
+pmmResources: {}
+
+## Readiness probe Config
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
+## @param readyProbeConf.initialDelaySeconds  Number of seconds after the container has started before readiness probes is initiated
+## @param readyProbeConf.periodSeconds How often (in seconds) to perform the probe
+## @param readyProbeConf.failureThreshold When a probe fails, Kubernetes will try failureThreshold times before giving up
+##
+readyProbeConf:
+  initialDelaySeconds: 1
+  periodSeconds: 5
+  failureThreshold: 6
+
+## @section PMM secrets
+##
+secret:
+  ## @param secret.name Defines the name of the k8s secret that holds passwords and other secrets
+  ##
+  name: pmm-secret
+  ## @param secret.create If true then secret will be generated by Helm chart. Otherwise it is expected to be created by user.
+  ##
+  create: true
+  ## @param secret.pmm_password Initial PMM password - it changes only on the first deployment, ignored if PMM was already provisioned and just restarted. If PMM admin password is not set, it will be generated.
+  ## E.g.
+  ## pmm_password: admin
+  ##
+  ## To get password execute `kubectl get secret pmm-secret -o jsonpath='{.data.PMM_ADMIN_PASSWORD}' | base64 --decode`
+  ##
+  pmm_password: ""
+  ##
+  # GF_AUTH_GENERIC_OAUTH_CLIENT_ID optional client ID to integrate Grafana with internal iDP, requires other env defined as well under pmmEnv
+  # GF_AUTH_GENERIC_OAUTH_CLIENT_ID:
+  # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET optional secret to integrate Grafana with internal iDP, requires other env defined as well under pmmEnv
+  # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
+
+## @param certs Optional certificates, if not provided PMM would use generated self-signed certificates,
+##   please provide your own signed ssl certificates like this in base 64 format:
+## certs:
+  ## name: pmm-certs
+  ## files:
+  ##  certificate.crt:
+  ##  certificate.key:
+  ##  ca-certs.pem:
+  ##  dhparam.pem:
+  ##  certificate.conf:
+certs: {}
+
+## @section PMM network configuration
+## Service configuration
+##
+service:
+  ## @param service.name Service name that is dns name monitoring services would send data to. `monitoring-service` used by default by pmm-client in Percona operators.
+  ##
+  name: monitoring-service
+  ## @param service.type Kubernetes Service type
+  ##
+  type: NodePort
+
+  ## Ports 443 and/or 80
+  ##
+  ports:
+    ## @param service.ports[0].port https port number
+    - port: 443
+      ## @param service.ports[0].targetPort target port to map for statefulset and ingress
+      targetPort: https
+      ## @param service.ports[0].protocol protocol for https
+      protocol: TCP
+      ## @param service.ports[0].name port name
+      name: https
+    ## @param service.ports[1].port http port number
+    - port: 80
+      ## @param service.ports[1].targetPort target port to map for statefulset and ingress
+      targetPort: http
+      ## @param service.ports[1].protocol protocol for http
+      protocol: TCP
+      ## @param service.ports[1].name port name
+      name: http
+
+## Ingress controller configuration
+##
+ingress:
+  ## @param ingress.enabled -- Enable ingress controller resource
+  enabled: false
+  ## @param ingress.nginxInc -- Using ingress controller from NGINX Inc
+  nginxInc: false
+  ## @param ingress.annotations -- Ingress annotations configuration
+  annotations: {}
+    ## kubernetes.io/ingress.class: nginx
+    ## kubernetes.io/tls-acme: "true"
+    ###  nginx proxy to https
+    ## nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+  ## @param ingress.community.annotations -- Ingress annotations configuration for community managed ingress (nginxInc = false)
+  community:
+    annotations: {}
+      ## kubernetes.io/ingress.class: nginx
+      ## kubernetes.io/tls-acme: "true"
+  ## @param ingress.ingressClassName -- Sets the ingress controller class name to use.
+  ingressClassName: ""
+
+  ## Ingress resource hostnames and path mappings
+  hosts:
+    ## @param ingress.hosts[0].host hostname
+    - host: chart-example.local
+    ## @param ingress.hosts[0].paths path mapping
+      paths: []
+
+  ## @param ingress.pathType -- How ingress paths should be treated.
+  pathType: Prefix
+
+  ## @param ingress.tls -- Ingress TLS configuration
+  tls: []
+  ##  - secretName: chart-example-tls
+  ##    hosts:
+  ##      - chart-example.local
+
+## @section PMM storage configuration
+## Claiming storage for PMM using Persistent Volume Claims (PVC)
+## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/
+##
+storage:
+  ## @param storage.name name of PVC
+  name: pmm-storage
+  ## @param storage.storageClassName optional PMM data Persistent Volume Storage Class
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  ##   GKE, AWS & OpenStack)
+  ##
+  storageClassName: ""
+  ##
+  ## @param storage.size size of storage [depends](https://docs.percona.com/percona-monitoring-and-management/setting-up/server/index.html#set-up-pmm-server) on number of monitored services and data retention
+  ##
+  size: 10Gi
+  ##
+  ## @param storage.dataSource VolumeSnapshot to start from
+  ##
+  dataSource: {}
+    ## name: before-vX.Y.Z-upgrade
+    ## kind: VolumeSnapshot
+    ## apiGroup: snapshot.storage.k8s.io
+  ##
+  ## @param storage.selector select existing PersistentVolume
+  ##
+  selector: {}
+  ##   matchLabels:
+  ##     release: "stable"
+  ##   matchExpressions:
+  ##     - key: environment
+  ##       operator: In
+  ##       values:
+  ##         - dev
+
+## @section PMM kubernetes configurations
+## @param nameOverride String to partially override common.names.fullname template with a string (will prepend the release name)
+##
+nameOverride: ""
+
+## @param extraLabels Labels to add to all deployed objects
+##
+extraLabels: {}
+
+## Pods Service Account
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+## @param serviceAccount.create Specifies whether a ServiceAccount should be created
+## @param serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.
+## @param serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template.
+##
+serviceAccount:
+  create: true
+  annotations: {}
+  name: "pmm-service-account"
+
+## @param podAnnotations Pod annotations
+## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+##
+podAnnotations: {}
+
+## @param podSecurityContext Configure Pods Security Context
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+## E.g
+## podSecurityContext:
+  ## fsGroup: 2000
+##
+podSecurityContext: {}
+
+## @param securityContext Configure Container Security Context
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+## securityContext.capabilities The capabilities to add/drop when running containers
+## securityContext.runAsUser Set pmm containers' Security Context runAsUser
+## securityContext.runAsNonRoot Set pmm container's Security Context runAsNonRoot
+## E.g.
+## securityContext:
+  ## capabilities:
+  ##   drop:
+  ##   - ALL
+  ## readOnlyRootFilesystem: true
+  ## runAsNonRoot: true
+  ## runAsUser: 1000
+securityContext: {}
+
+
+## @param nodeSelector Node labels for pod assignment
+## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+##
+nodeSelector: {}
+
+## @param tolerations Tolerations for pod assignment
+## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+##
+tolerations: []
+
+## @param affinity Affinity for pod assignment
+## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+##
+affinity: {}
+
+## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts
+##
+extraVolumeMounts: []
+## @param extraVolumes Optionally specify extra list of additional volumes
+##
+extraVolumes: []