1975 lines
67 KiB
YAML
1975 lines
67 KiB
YAML
# Default values for artifactory.
|
|
# This is a YAML-formatted file.
|
|
|
|
# Beware when changing values here. You should know what you are doing!
|
|
# Access the values with {{ .Values.key.subkey }}
|
|
|
|
global:
|
|
# imageRegistry: releases-docker.jfrog.io
|
|
# imagePullSecrets:
|
|
# - myRegistryKeySecretName
|
|
## Chart.AppVersion can be overidden using global.versions.artifactory or .Values.artifactory.image.tag
|
|
## Note: Order of preference is 1) global.versions 2) .Values.artifactory.image.tag 3) Chart.AppVersion
|
|
## This applies also for nginx images (.Values.nginx.image.tag)
|
|
versions: {}
|
|
# artifactory:
|
|
# joinKey:
|
|
# masterKey:
|
|
# joinKeySecretName:
|
|
# masterKeySecretName:
|
|
|
|
## Note: tags customInitContainersBegin,customInitContainers,customVolumes,customVolumeMounts,customSidecarContainers can be used both from global and application level simultaneously
|
|
# customInitContainersBegin: |
|
|
|
|
# customInitContainers: |
|
|
|
|
# customVolumes: |
|
|
|
|
# customVolumeMounts: |
|
|
|
|
# customSidecarContainers: |
|
|
|
|
## certificates added to this secret will be copied to $JFROG_HOME/artifactory/var/etc/security/keys/trusted directory
|
|
customCertificates:
|
|
enabled: false
|
|
# certificateSecretName:
|
|
## Applies to artifactory and nginx pods
|
|
nodeSelector: {}
|
|
## String to partially override artifactory.fullname template (will maintain the release name)
|
|
##
|
|
# nameOverride:
|
|
|
|
## String to fully override artifactory.fullname template
|
|
##
|
|
# fullnameOverride:
|
|
initContainerImage: releases-docker.jfrog.io/ubi9/ubi-minimal:9.2.750.1697534106
|
|
# Init containers
|
|
initContainers:
|
|
resources:
|
|
requests:
|
|
memory: "50Mi"
|
|
cpu: "10m"
|
|
limits:
|
|
memory: "1Gi"
|
|
cpu: "1"
|
|
installer:
|
|
type:
|
|
platform:
|
|
installerInfo: '{"productId": "Helm_artifactory/{{ .Chart.Version }}", "features": [ { "featureId": "Platform/{{ default "kubernetes" .Values.installer.platform }}"}]}'
|
|
# For supporting pulling from private registries
|
|
# imagePullSecrets:
|
|
# - myRegistryKeySecretName
|
|
|
|
## Artifactory systemYaml override
|
|
## This is for advanced usecases where users wants to provide their own systemYaml for configuring artifactory
|
|
## Refer: https://www.jfrog.com/confluence/display/JFROG/Artifactory+System+YAML
|
|
## Note: This will override existing (default) .Values.artifactory.systemYaml in values.yaml
|
|
## Alternatively, systemYaml can be overidden via customInitContainers using external sources like vaults, external repositories etc. Please refer customInitContainer section below for an example.
|
|
## Note: Order of preference is 1) customInitContainers 2) systemYamlOverride existingSecret 3) default systemYaml in values.yaml
|
|
systemYamlOverride:
|
|
## You can use a pre-existing secret by specifying existingSecret
|
|
existingSecret:
|
|
## The dataKey should be the name of the secret data key created.
|
|
dataKey:
|
|
## Role Based Access Control
|
|
## Ref: https://kubernetes.io/docs/admin/authorization/rbac/
|
|
rbac:
|
|
create: false
|
|
role:
|
|
## Rules to create. It follows the role specification
|
|
rules:
|
|
- apiGroups:
|
|
- ''
|
|
resources:
|
|
- services
|
|
- endpoints
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- watch
|
|
- list
|
|
## Service Account
|
|
## Ref: https://kubernetes.io/docs/admin/service-accounts-admin/
|
|
##
|
|
serviceAccount:
|
|
create: false
|
|
## The name of the ServiceAccount to use.
|
|
## If not set and create is true, a name is generated using the fullname template
|
|
name:
|
|
## Service Account annotations
|
|
annotations: {}
|
|
## Explicitly mounts the API credentials for the Service Account
|
|
automountServiceAccountToken: false
|
|
ingress:
|
|
enabled: false
|
|
defaultBackend:
|
|
enabled: true
|
|
# Used to create an Ingress record.
|
|
hosts: []
|
|
routerPath: /
|
|
artifactoryPath: /artifactory/
|
|
rtfsPath: /artifactory/service/rtfs/
|
|
className: ""
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
# proxy_pass_header Server;
|
|
# proxy_set_header X-JFrog-Override-Base-Url https://<artifactory-domain>;
|
|
# kubernetes.io/tls-acme: "true"
|
|
# nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
labels: {}
|
|
# traffic-type: external
|
|
# traffic-type: internal
|
|
tls: []
|
|
# Secrets must be manually created in the namespace.
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - artifactory.domain.example
|
|
|
|
# Additional ingress rules
|
|
additionalRules: []
|
|
## Allows to add custom ingress
|
|
customIngress: ""
|
|
networkpolicy: []
|
|
# Allows all ingress and egress
|
|
# - name: artifactory
|
|
# podSelector:
|
|
# matchLabels:
|
|
# app: artifactory
|
|
# egress:
|
|
# - {}
|
|
# ingress:
|
|
# - {}
|
|
# Uncomment to allow only artifactory pods to communicate with postgresql (if postgresql.enabled is true)
|
|
# - name: postgresql
|
|
# podSelector:
|
|
# matchLabels:
|
|
# app: postgresql
|
|
# ingress:
|
|
# - from:
|
|
# - podSelector:
|
|
# matchLabels:
|
|
# app: artifactory
|
|
|
|
## Apply horizontal pod auto scaling on artifactory pods
|
|
## Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 3
|
|
targetCPUUtilizationPercentage: 70
|
|
logger:
|
|
image:
|
|
registry: releases-docker.jfrog.io
|
|
repository: ubi9/ubi-minimal
|
|
tag: 9.2.750.1697534106
|
|
## You can use a pre-existing secret with keys license_token and iam_role by specifying licenseConfigSecretName
|
|
## Example : Create a generic secret using `kubectl create secret generic <secret-name> --from-literal=license_token=${TOKEN} --from-literal=iam_role=${ROLE_ARN}`
|
|
aws:
|
|
license:
|
|
enabled: false
|
|
licenseConfigSecretName:
|
|
region: us-east-1
|
|
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
|
containerSecurityContext:
|
|
enabled: true
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
## The following router settings are to configure only when splitServicesToContainers set to true
|
|
## splitServicesToContainers (by default it is false)
|
|
router:
|
|
name: router
|
|
image:
|
|
registry: releases-docker.jfrog.io
|
|
repository: jfrog/router
|
|
tag: 7.81.0
|
|
imagePullPolicy: IfNotPresent
|
|
serviceRegistry:
|
|
## Service registry (Access) TLS verification skipped if enabled
|
|
insecure: false
|
|
internalPort: 8082
|
|
externalPort: 8082
|
|
tlsEnabled: false
|
|
## Extra environment variables that can be used to tune router to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for router container
|
|
lifecycle:
|
|
# From Artifactory versions 7.52.x, Wait for Artifactory to complete any open uploads or downloads before terminating
|
|
preStop:
|
|
exec:
|
|
command: ["sh", "-c", "while [[ $(curl --fail --silent --connect-timeout 2 http://localhost:8081/artifactory/api/v1/system/liveness) =~ OK ]]; do echo Artifactory is still alive; sleep 2; done"]
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
## Add custom volumesMounts
|
|
customVolumeMounts: ""
|
|
# - name: custom-script
|
|
# mountPath: /scripts/script.sh
|
|
# subPath: script.sh
|
|
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} {{ include "artifactory.scheme" . }}://localhost:{{ .Values.router.internalPort }}/router/api/v1/system/liveness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}90{{ else }}0{{ end }}
|
|
periodSeconds: 10
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
failureThreshold: 5
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} {{ include "artifactory.scheme" . }}://localhost:{{ .Values.router.internalPort }}/router/api/v1/system/readiness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}60{{ else }}0{{ end }}
|
|
periodSeconds: 10
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
failureThreshold: 5
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} {{ include "artifactory.scheme" . }}://localhost:{{ .Values.router.internalPort }}/router/api/v1/system/readiness
|
|
initialDelaySeconds: 10
|
|
failureThreshold: 30
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
persistence:
|
|
mountPath: "/var/opt/jfrog/router"
|
|
# Artifactory
|
|
artifactory:
|
|
name: artifactory
|
|
## refer - https://www.jfrog.com/confluence/display/JFROG/Access+Federation#AccessFederation-EstablishingtheCircleofTrust
|
|
## root certificates added will be copied to $JFROG_HOME/artifactory/var/etc/access/keys/trusted folder.
|
|
circleOfTrustCertificatesSecret:
|
|
# unifiedSecretInstallation flag enables single unified secret holding all the artifactory secrets
|
|
unifiedSecretInstallation: false
|
|
# For HA installation, set this value > 1. This is only supported in Artifactory 7.25.x (appVersions) and above.
|
|
replicaCount: 1
|
|
# minAvailable: 1
|
|
|
|
# Note that by default we use appVersion to get image tag/version
|
|
image:
|
|
registry: releases-docker.jfrog.io
|
|
repository: jfrog/artifactory-pro
|
|
# tag:
|
|
pullPolicy: IfNotPresent
|
|
labels: {}
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
|
schedulerName:
|
|
# Create a priority class for the Artifactory pod or use an existing one
|
|
# NOTE - Maximum allowed value of a user defined priority is 1000000000
|
|
priorityClass:
|
|
create: false
|
|
value: 1000000000
|
|
## Override default name
|
|
# name:
|
|
## Use an existing priority class
|
|
# existingPriorityClass:
|
|
# Spread Artifactory pods evenly across your nodes or some other topology
|
|
topologySpreadConstraints: []
|
|
# - maxSkew: 1
|
|
# topologyKey: kubernetes.io/hostname
|
|
# whenUnsatisfiable: DoNotSchedule
|
|
# labelSelector:
|
|
# matchLabels:
|
|
# app: '{{ template "artifactory.name" . }}'
|
|
# role: '{{ template "artifactory.name" . }}'
|
|
# release: "{{ .Release.Name }}"
|
|
|
|
# Delete the db.properties file in ARTIFACTORY_HOME/etc/db.properties
|
|
deleteDBPropertiesOnStartup: true
|
|
# certificates added to this secret will be copied to $JFROG_HOME/artifactory/var/etc/security/keys/trusted directory
|
|
customCertificates:
|
|
enabled: false
|
|
# certificateSecretName:
|
|
database:
|
|
maxOpenConnections: 80
|
|
tomcat:
|
|
maintenanceConnector:
|
|
port: 8091
|
|
connector:
|
|
maxThreads: 200
|
|
sendReasonPhrase: false
|
|
extraConfig: 'acceptCount="400"'
|
|
# Support for open metrics is only available for Artifactory 7.7.x (appVersions) and above.
|
|
# To enable set `.Values.artifactory.openMetrics.enabled` to `true`
|
|
# Refer - https://www.jfrog.com/confluence/display/JFROG/Open+Metrics
|
|
openMetrics:
|
|
enabled: false
|
|
## Settings for pushing metrics to Insight - enable filebeat to true
|
|
filebeat:
|
|
enabled: false
|
|
log:
|
|
enabled: false
|
|
## Log level for filebeat. Possible values: debug, info, warning, or error.
|
|
level: "info"
|
|
## Elasticsearch details for filebeat to connect
|
|
elasticsearch:
|
|
url: "Elasticsearch url where JFrog Insight is installed For example, http://<ip_address>:8082"
|
|
username: ""
|
|
password: ""
|
|
# Support for Cold Artifact Storage
|
|
# set 'coldStorage.enabled' to 'true' only for Artifactory instance that you are designating as the Cold instance
|
|
# Refer - https://jfrog.com/help/r/jfrog-platform-administration-documentation/setting-up-cold-artifact-storage
|
|
coldStorage:
|
|
enabled: false
|
|
# This directory is intended for use with NFS eventual configuration for HA
|
|
haDataDir:
|
|
enabled: false
|
|
path:
|
|
haBackupDir:
|
|
enabled: false
|
|
path:
|
|
# Files to copy to ARTIFACTORY_HOME/ on each Artifactory startup
|
|
# Note : From 107.46.x chart versions, copyOnEveryStartup is not needed for binarystore.xml, it is always copied via initContainers
|
|
copyOnEveryStartup:
|
|
# # Absolute path
|
|
# - source: /artifactory_bootstrap/artifactory.lic
|
|
# # Relative to ARTIFACTORY_HOME/
|
|
# target: etc/artifactory/
|
|
|
|
# Sidecar containers for tailing Artifactory logs
|
|
loggers: []
|
|
# - access-audit.log
|
|
# - access-request.log
|
|
# - access-security-audit.log
|
|
# - access-service.log
|
|
# - artifactory-access.log
|
|
# - artifactory-event.log
|
|
# - artifactory-import-export.log
|
|
# - artifactory-request.log
|
|
# - artifactory-service.log
|
|
# - frontend-request.log
|
|
# - frontend-service.log
|
|
# - metadata-request.log
|
|
# - metadata-service.log
|
|
# - router-request.log
|
|
# - router-service.log
|
|
# - router-traefik.log
|
|
# - derby.log
|
|
|
|
# Loggers containers resources
|
|
loggersResources: {}
|
|
# requests:
|
|
# memory: "10Mi"
|
|
# cpu: "10m"
|
|
# limits:
|
|
# memory: "100Mi"
|
|
# cpu: "50m"
|
|
|
|
# Sidecar containers for tailing Tomcat (catalina) logs
|
|
catalinaLoggers: []
|
|
# - tomcat-catalina.log
|
|
# - tomcat-localhost.log
|
|
|
|
# Tomcat (catalina) loggers resources
|
|
catalinaLoggersResources: {}
|
|
# requests:
|
|
# memory: "10Mi"
|
|
# cpu: "10m"
|
|
# limits:
|
|
# memory: "100Mi"
|
|
# cpu: "50m"
|
|
|
|
# Migration support from 6.x to 7.x
|
|
migration:
|
|
enabled: true
|
|
timeoutSeconds: 3600
|
|
## Extra pre-start command in migration Init Container to install JDBC driver for MySql/MariaDb/Oracle
|
|
# preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar"
|
|
## Add custom init containers execution before predefined init containers
|
|
customInitContainersBegin: ""
|
|
# - name: "custom-setup"
|
|
# image: "{{ .Values.initContainerImage }}"
|
|
# imagePullPolicy: "{{ .Values.artifactory.image.pullPolicy }}"
|
|
# securityContext:
|
|
# runAsNonRoot: true
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - NET_RAW
|
|
# command:
|
|
# - 'sh'
|
|
# - '-c'
|
|
# - 'touch {{ .Values.artifactory.persistence.mountPath }}/example-custom-setup'
|
|
# volumeMounts:
|
|
# - mountPath: "{{ .Values.artifactory.persistence.mountPath }}"
|
|
# name: artifactory-volume
|
|
|
|
## Add custom init containers execution after predefined init containers
|
|
customInitContainers: ""
|
|
# - name: "custom-systemyaml-setup"
|
|
# image: "{{ .Values.initContainerImage }}"
|
|
# imagePullPolicy: "{{ .Values.artifactory.image.pullPolicy }}"
|
|
# securityContext:
|
|
# runAsNonRoot: true
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - NET_RAW
|
|
# command:
|
|
# - 'sh'
|
|
# - '-c'
|
|
# - 'curl -o {{ .Values.artifactory.persistence.mountPath }}/etc/system.yaml https://<repo-url>/systemyaml'
|
|
# volumeMounts:
|
|
# - mountPath: "{{ .Values.artifactory.persistence.mountPath }}"
|
|
# name: artifactory-volume
|
|
|
|
## Add custom sidecar containers
|
|
# - The provided example uses a custom volume (customVolumes)
|
|
customSidecarContainers: ""
|
|
# - name: "sidecar-list-etc"
|
|
# image: "{{ .Values.initContainerImage }}"
|
|
# imagePullPolicy: "{{ .Values.artifactory.image.pullPolicy }}"
|
|
# securityContext:
|
|
# runAsNonRoot: true
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - NET_RAW
|
|
# command:
|
|
# - 'sh'
|
|
# - '-c'
|
|
# - 'sh /scripts/script.sh'
|
|
# volumeMounts:
|
|
# - mountPath: "{{ .Values.artifactory.persistence.mountPath }}"
|
|
# name: artifactory-volume
|
|
# - mountPath: "/scripts/script.sh"
|
|
# name: custom-script
|
|
# subPath: script.sh
|
|
# resources:
|
|
# requests:
|
|
# memory: "32Mi"
|
|
# cpu: "50m"
|
|
# limits:
|
|
# memory: "128Mi"
|
|
# cpu: "100m"
|
|
|
|
## Add custom volumes
|
|
# If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.name" . }}-unified-secret'
|
|
customVolumes: ""
|
|
# - name: custom-script
|
|
# configMap:
|
|
# name: custom-script
|
|
|
|
## Add custom volumesMounts
|
|
customVolumeMounts: ""
|
|
# - name: custom-script
|
|
# mountPath: "/scripts/script.sh"
|
|
# subPath: script.sh
|
|
# - name: posthook-start
|
|
# mountPath: "/scripts/posthoook-start.sh"
|
|
# subPath: posthoook-start.sh
|
|
# - name: prehook-start
|
|
# mountPath: "/scripts/prehook-start.sh"
|
|
# subPath: prehook-start.sh
|
|
|
|
# Add custom persistent volume mounts - Available to the entire namespace
|
|
customPersistentVolumeClaim: {}
|
|
# name:
|
|
# mountPath:
|
|
# accessModes:
|
|
# - "-"
|
|
# size:
|
|
# storageClassName:
|
|
|
|
## Artifactory license.
|
|
license:
|
|
## licenseKey is the license key in plain text. Use either this or the license.secret setting
|
|
licenseKey:
|
|
## If artifactory.license.secret is passed, it will be mounted as
|
|
## ARTIFACTORY_HOME/etc/artifactory.lic and loaded at run time.
|
|
secret:
|
|
## The dataKey should be the name of the secret data key created.
|
|
dataKey:
|
|
## Create configMap with artifactory.config.import.xml and security.import.xml and pass name of configMap in following parameter
|
|
configMapName:
|
|
# Add any list of configmaps to Artifactory
|
|
configMaps: ""
|
|
# posthook-start.sh: |-
|
|
# echo "This is a post start script"
|
|
# posthook-end.sh: |-
|
|
# echo "This is a post end script"
|
|
|
|
## List of secrets for Artifactory user plugins.
|
|
## One Secret per plugin's files.
|
|
userPluginSecrets:
|
|
# - archive-old-artifacts
|
|
# - build-cleanup
|
|
# - webhook
|
|
# - '{{ template "my-chart.fullname" . }}'
|
|
|
|
## Artifactory requires a unique master key.
|
|
## You can generate one with the command: "openssl rand -hex 32"
|
|
## An initial one is auto generated by Artifactory on first startup.
|
|
# masterKey: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
|
|
## Alternatively, you can use a pre-existing secret with a key called master-key by specifying masterKeySecretName
|
|
# masterKeySecretName:
|
|
|
|
## Join Key to connect other services to Artifactory
|
|
## IMPORTANT: Setting this value overrides the existing joinKey
|
|
## IMPORTANT: You should NOT use the example joinKey for a production deployment!
|
|
# joinKey: EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
|
|
## Alternatively, you can use a pre-existing secret with a key called join-key by specifying joinKeySecretName
|
|
# joinKeySecretName:
|
|
|
|
## Registration Token for JFConnect
|
|
# jfConnectToken:
|
|
## Alternatively, you can use a pre-existing secret with a key called jfconnect-token by specifying jfConnectTokenSecretName
|
|
# jfConnectTokenSecretName:
|
|
|
|
# Add custom secrets - secret per file
|
|
# If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.name" . }}-unified-secret' common to all secrets
|
|
customSecrets:
|
|
# - name: custom-secret
|
|
# key: custom-secret.yaml
|
|
# data: >
|
|
# custom_secret_config:
|
|
# parameter1: value1
|
|
# parameter2: value2
|
|
# - name: custom-secret2
|
|
# key: custom-secret2.config
|
|
# data: |
|
|
# here the custom secret 2 config
|
|
|
|
## If false, all service console logs will not redirect to a common console.log
|
|
consoleLog: false
|
|
## admin allows to set the password for the default admin user.
|
|
## See: https://www.jfrog.com/confluence/display/JFROG/Users+and+Groups#UsersandGroups-RecreatingtheDefaultAdminUserrecreate
|
|
admin:
|
|
ip: "127.0.0.1"
|
|
username: "admin"
|
|
password:
|
|
secret:
|
|
dataKey:
|
|
## Extra pre-start command to install JDBC driver for MySql/MariaDb/Oracle
|
|
# preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar"
|
|
|
|
# Add lifecycle hooks for artifactory container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
## Extra environment variables that can be used to tune Artifactory to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: SERVER_XML_ARTIFACTORY_PORT
|
|
# value: "8081"
|
|
# - name: SERVER_XML_ARTIFACTORY_MAX_THREADS
|
|
# value: "200"
|
|
# - name: SERVER_XML_ACCESS_MAX_THREADS
|
|
# value: "50"
|
|
# - name: SERVER_XML_ARTIFACTORY_EXTRA_CONFIG
|
|
# value: ""
|
|
# - name: SERVER_XML_ACCESS_EXTRA_CONFIG
|
|
# value: ""
|
|
# - name: SERVER_XML_EXTRA_CONNECTOR
|
|
# value: ""
|
|
# - name: DB_POOL_MAX_ACTIVE
|
|
# value: "100"
|
|
# - name: DB_POOL_MAX_IDLE
|
|
# value: "10"
|
|
# - name: MY_SECRET_ENV_VAR
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: my-secret-name
|
|
# key: my-secret-key
|
|
|
|
systemYaml: |
|
|
router:
|
|
serviceRegistry:
|
|
insecure: {{ .Values.router.serviceRegistry.insecure }}
|
|
shared:
|
|
{{- if .Values.artifactory.coldStorage.enabled }}
|
|
jfrogColdStorage:
|
|
coldInstanceEnabled: true
|
|
{{- end }}
|
|
{{- if .Values.artifactory.openMetrics.enabled }}
|
|
metrics:
|
|
enabled: true
|
|
{{- if .Values.artifactory.openMetrics.filebeat.enabled }}
|
|
filebeat: {{ toYaml .Values.artifactory.openMetrics.filebeat | nindent 6 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
logging:
|
|
consoleLog:
|
|
enabled: {{ .Values.artifactory.consoleLog }}
|
|
extraJavaOpts: >
|
|
-Dartifactory.graceful.shutdown.max.request.duration.millis={{ mul .Values.artifactory.terminationGracePeriodSeconds 1000 }}
|
|
-Dartifactory.access.client.max.connections={{ .Values.access.tomcat.connector.maxThreads }}
|
|
{{- with .Values.artifactory.javaOpts }}
|
|
{{- if .corePoolSize }}
|
|
-Dartifactory.async.corePoolSize={{ .corePoolSize }}
|
|
{{- end }}
|
|
{{- if .xms }}
|
|
-Xms{{ .xms }}
|
|
{{- end }}
|
|
{{- if .xmx }}
|
|
-Xmx{{ .xmx }}
|
|
{{- end }}
|
|
{{- if .jmx.enabled }}
|
|
-Dcom.sun.management.jmxremote
|
|
-Dcom.sun.management.jmxremote.port={{ .jmx.port }}
|
|
-Dcom.sun.management.jmxremote.rmi.port={{ .jmx.port }}
|
|
-Dcom.sun.management.jmxremote.ssl={{ .jmx.ssl }}
|
|
{{- if .jmx.host }}
|
|
-Djava.rmi.server.hostname={{ tpl .jmx.host $ }}
|
|
{{- else }}
|
|
-Djava.rmi.server.hostname={{ template "artifactory.fullname" $ }}
|
|
{{- end }}
|
|
{{- if .jmx.authenticate }}
|
|
-Dcom.sun.management.jmxremote.authenticate=true
|
|
-Dcom.sun.management.jmxremote.access.file={{ .jmx.accessFile }}
|
|
-Dcom.sun.management.jmxremote.password.file={{ .jmx.passwordFile }}
|
|
{{- else }}
|
|
-Dcom.sun.management.jmxremote.authenticate=false
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .other }}
|
|
{{ .other }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if or .Values.database.type .Values.postgresql.enabled }}
|
|
database:
|
|
{{- if .Values.postgresql.enabled }}
|
|
type: postgresql
|
|
url: "jdbc:postgresql://{{ .Release.Name }}-postgresql:{{ .Values.postgresql.service.port }}/{{ .Values.postgresql.postgresqlDatabase }}"
|
|
driver: org.postgresql.Driver
|
|
username: "{{ .Values.postgresql.postgresqlUsername }}"
|
|
{{- else }}
|
|
type: "{{ .Values.database.type }}"
|
|
driver: "{{ .Values.database.driver }}"
|
|
{{- end }}
|
|
{{- end }}
|
|
artifactory:
|
|
{{- if or .Values.artifactory.haDataDir.enabled .Values.artifactory.haBackupDir.enabled }}
|
|
node:
|
|
{{- if .Values.artifactory.haDataDir.path }}
|
|
haDataDir: {{ .Values.artifactory.haDataDir.path }}
|
|
{{- end }}
|
|
{{- if .Values.artifactory.haBackupDir.path }}
|
|
haBackupDir: {{ .Values.artifactory.haBackupDir.path }}
|
|
{{- end }}
|
|
{{- end }}
|
|
database:
|
|
maxOpenConnections: {{ .Values.artifactory.database.maxOpenConnections }}
|
|
tomcat:
|
|
maintenanceConnector:
|
|
port: {{ .Values.artifactory.tomcat.maintenanceConnector.port }}
|
|
connector:
|
|
maxThreads: {{ .Values.artifactory.tomcat.connector.maxThreads }}
|
|
sendReasonPhrase: {{ .Values.artifactory.tomcat.connector.sendReasonPhrase }}
|
|
extraConfig: {{ .Values.artifactory.tomcat.connector.extraConfig }}
|
|
frontend:
|
|
session:
|
|
timeMinutes: {{ .Values.frontend.session.timeoutMinutes | quote }}
|
|
access:
|
|
database:
|
|
maxOpenConnections: {{ .Values.access.database.maxOpenConnections }}
|
|
tomcat:
|
|
connector:
|
|
maxThreads: {{ .Values.access.tomcat.connector.maxThreads }}
|
|
sendReasonPhrase: {{ .Values.access.tomcat.connector.sendReasonPhrase }}
|
|
extraConfig: {{ .Values.access.tomcat.connector.extraConfig }}
|
|
{{- if .Values.mc.enabled }}
|
|
mc:
|
|
enabled: true
|
|
database:
|
|
maxOpenConnections: {{ .Values.mc.database.maxOpenConnections }}
|
|
idgenerator:
|
|
maxOpenConnections: {{ .Values.mc.idgenerator.maxOpenConnections }}
|
|
tomcat:
|
|
connector:
|
|
maxThreads: {{ .Values.mc.tomcat.connector.maxThreads }}
|
|
sendReasonPhrase: {{ .Values.mc.tomcat.connector.sendReasonPhrase }}
|
|
extraConfig: {{ .Values.mc.tomcat.connector.extraConfig }}
|
|
{{- end }}
|
|
metadata:
|
|
database:
|
|
maxOpenConnections: {{ .Values.metadata.database.maxOpenConnections }}
|
|
{{- if .Values.artifactory.replicator.enabled }}
|
|
replicator:
|
|
enabled: true
|
|
{{- end }}
|
|
{{- if and .Values.jfconnect.enabled (not (regexMatch "^.*(oss|cpp-ce|jcr).*$" .Values.artifactory.image.repository)) }}
|
|
jfconnect:
|
|
enabled: true
|
|
{{- else }}
|
|
jfconnect:
|
|
enabled: false
|
|
jfconnect_service:
|
|
enabled: false
|
|
{{- end }}
|
|
{{- if and .Values.federation.enabled (not (regexMatch "^.*(oss|cpp-ce|jcr).*$" .Values.artifactory.image.repository)) }}
|
|
federation:
|
|
enabled: true
|
|
extraJavaOpts: {{ .Values.federation.extraJavaOpts }}
|
|
port: {{ .Values.federation.internalPort }}
|
|
rtfs:
|
|
database:
|
|
driver: org.postgresql.Driver
|
|
type: postgresql
|
|
username: {{ .Values.federation.database.username }}
|
|
password: {{ .Values.federation.database.password }}
|
|
url: jdbc:postgresql://{{ .Values.federation.database.host }}:{{ .Values.federation.database.port }}/{{ .Values.federation.database.name }}
|
|
{{- else }}
|
|
federation:
|
|
enabled: false
|
|
{{- end }}
|
|
{{- if .Values.event.webhooks }}
|
|
event:
|
|
webhooks: {{ toYaml .Values.event.webhooks | nindent 6 }}
|
|
{{- end }}
|
|
annotations: {}
|
|
service:
|
|
name: artifactory
|
|
type: ClusterIP
|
|
## For supporting whitelist on the Artifactory service (useful if setting service.type=LoadBalancer)
|
|
## Set this to a list of IP CIDR ranges
|
|
## Example: loadBalancerSourceRanges: ['10.10.10.5/32', '10.11.10.5/32']
|
|
## or pass from helm command line
|
|
## Example: helm install ... --set nginx.service.loadBalancerSourceRanges='{10.10.10.5/32,10.11.10.5/32}'
|
|
loadBalancerSourceRanges: []
|
|
annotations: {}
|
|
## If the type is NodePort you can set a fixed port
|
|
# nodePort: 32082
|
|
statefulset:
|
|
annotations: {}
|
|
## The following setting are to configure a dedicated Ingress object for Replicator service
|
|
replicator:
|
|
name: replicator
|
|
enabled: false
|
|
## Extra environment variables that can be used to tune replicator to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for replicator container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
ingress:
|
|
enabled: true
|
|
name:
|
|
hosts: []
|
|
className: ""
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# nginx.ingress.kubernetes.io/proxy-buffering: "off"
|
|
# nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
# chunked_transfer_encoding on;
|
|
tls: []
|
|
# Secrets must be manually created in the namespace.
|
|
# - hosts:
|
|
# - artifactory.domain.example
|
|
# secretName: chart-example-tls-secret
|
|
## When replicator is enabled and want to use tracker feature, trackerIngress.enabled flag should be set to true
|
|
## Please refer - https://www.jfrog.com/confluence/display/JFROG/JFrog+Peer-to-Peer+%28P2P%29+Downloads
|
|
trackerIngress:
|
|
enabled: false
|
|
name:
|
|
hosts: []
|
|
className: ""
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# nginx.ingress.kubernetes.io/proxy-buffering: "off"
|
|
# nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
# chunked_transfer_encoding on;
|
|
tls: []
|
|
# Secrets must be manually created in the namespace.
|
|
# - hosts:
|
|
# - artifactory.domain.example
|
|
# secretName: chart-example-tls-secret
|
|
## IMPORTANT: If overriding artifactory.internalPort:
|
|
## DO NOT use port lower than 1024 as Artifactory runs as non-root and cannot bind to ports lower than 1024!
|
|
externalPort: 8082
|
|
internalPort: 8082
|
|
externalArtifactoryPort: 8081
|
|
internalArtifactoryPort: 8081
|
|
uid: 1030
|
|
gid: 1030
|
|
# fsGroupChangePolicy: "Always"
|
|
# seLinuxOptions: {}
|
|
terminationGracePeriodSeconds: 30
|
|
## By default, the Artifactory StatefulSet is created with a securityContext that sets the `runAsUser` and the `fsGroup` to the `artifactory.uid` value.
|
|
## If you want to disable the securityContext for the Artifactory StatefulSet, set this tag to false
|
|
setSecurityContext: true
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.artifactory.tomcat.maintenanceConnector.port }}/artifactory/api/v1/system/liveness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
periodSeconds: 10
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
failureThreshold: 5
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.artifactory.tomcat.maintenanceConnector.port }}/artifactory/api/v1/system/readiness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}90{{ else }}0{{ end }}
|
|
periodSeconds: 10
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
failureThreshold: 5
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.artifactory.tomcat.maintenanceConnector.port }}/artifactory/api/v1/system/readiness
|
|
initialDelaySeconds: 10
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
persistence:
|
|
mountPath: "/var/opt/jfrog/artifactory"
|
|
enabled: true
|
|
## A manually managed Persistent Volume and Claim
|
|
## Requires persistence.enabled: true
|
|
## If defined, PVC must be created manually before volume will be bound
|
|
# existingClaim:
|
|
|
|
accessMode: ReadWriteOnce
|
|
## Storage default size. Should be increased for production deployments.
|
|
size: 20Gi
|
|
## Use a custom Secret to be mounted as your binarystore.xml
|
|
## NOTE: This will ignore all settings below that make up binarystore.xml
|
|
customBinarystoreXmlSecret:
|
|
## Redundancy required For HA deployments, with "cluster" persistence storage type
|
|
redundancy: 3
|
|
lenientLimit: 1
|
|
## Cache default size. Should be increased for production deployments.
|
|
maxCacheSize: 5000000000
|
|
cacheProviderDir: cache
|
|
## Set the persistence storage type. This will apply the matching binarystore.xml to Artifactory config
|
|
## Supported types are:
|
|
## file-system (default)
|
|
## cluster-file-system
|
|
## nfs
|
|
## google-storage
|
|
## google-storage-v2
|
|
## google-storage-v2-direct
|
|
## cluster-google-storage-v2
|
|
## aws-s3-v3
|
|
## s3-storage-v3-direct
|
|
## cluster-s3-storage-v3
|
|
## s3-storage-v3-archive
|
|
## azure-blob
|
|
## azure-blob-storage-direct
|
|
## cluster-azure-blob-storage
|
|
type: file-system
|
|
## Use binarystoreXml to provide a custom binarystore.xml
|
|
## This is intentionally commented and below previous content of binarystoreXml is moved under files/binarystore.xml
|
|
## binarystoreXml:
|
|
|
|
## For artifactory.persistence.type nfs
|
|
## If using NFS as the shared storage, you must have a running NFS server that is accessible by your Kubernetes
|
|
## cluster nodes.
|
|
## Need to have the following set
|
|
nfs:
|
|
# Must pass actual IP of NFS server with '--set For artifactory.persistence.nfs.ip=${NFS_IP}'
|
|
ip:
|
|
haDataMount: "/data"
|
|
haBackupMount: "/backup"
|
|
dataDir: "/var/opt/jfrog/artifactory"
|
|
backupDir: "/var/opt/jfrog/artifactory-backup"
|
|
capacity: 200Gi
|
|
## For artifactory.persistence.type file-system
|
|
fileSystem:
|
|
cache:
|
|
enabled: false
|
|
## For artifactory.persistence.type google-storage, google-storage-v2, google-storage-v2-direct, cluster-google-storage-v2
|
|
googleStorage:
|
|
## When using GCP buckets as your binary store
|
|
gcpServiceAccount:
|
|
enabled: false
|
|
## Use either an existing secret prepared in advance or put the config (replace the content) in the values
|
|
## ref: https://github.com/jfrog/charts/blob/master/stable/artifactory-ha/README.md#google-storage
|
|
# customSecretName:
|
|
# config: |
|
|
# {
|
|
# "type": "service_account",
|
|
# "project_id": "<project_id>",
|
|
# "private_key_id": "?????",
|
|
# "private_key": "-----BEGIN PRIVATE KEY-----\n????????==\n-----END PRIVATE KEY-----\n",
|
|
# "client_email": "???@j<project_id>.iam.gserviceaccount.com",
|
|
# "client_id": "???????",
|
|
# "auth_uri": "https://accounts.google.com/o/oauth2/auth",
|
|
# "token_uri": "https://oauth2.googleapis.com/token",
|
|
# "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
|
|
# "client_x509_cert_url": "https://www.googleapis.com/robot/v1....."
|
|
# }
|
|
endpoint: commondatastorage.googleapis.com
|
|
httpsOnly: false
|
|
# Set a unique bucket name
|
|
bucketName: "artifactory-gcp"
|
|
## GCP Bucket Authentication with Identity and Credential is deprecated.
|
|
## identity:
|
|
## credential:
|
|
path: "artifactory/filestore"
|
|
bucketExists: false
|
|
useInstanceCredentials: false
|
|
enableSignedUrlRedirect: false
|
|
## For artifactory.persistence.type aws-s3-v3, s3-storage-v3-direct, cluster-s3-storage-v3, s3-storage-v3-archive
|
|
awsS3V3:
|
|
testConnection: false
|
|
identity:
|
|
credential:
|
|
region:
|
|
bucketName: artifactory-aws
|
|
path: artifactory/filestore
|
|
endpoint:
|
|
port:
|
|
useHttp:
|
|
maxConnections: 50
|
|
kmsServerSideEncryptionKeyId:
|
|
kmsKeyRegion:
|
|
kmsCryptoMode:
|
|
useInstanceCredentials: true
|
|
usePresigning: false
|
|
signatureExpirySeconds: 300
|
|
signedUrlExpirySeconds: 30
|
|
cloudFrontDomainName:
|
|
cloudFrontKeyPairId:
|
|
cloudFrontPrivateKey:
|
|
enableSignedUrlRedirect: false
|
|
enablePathStyleAccess: false
|
|
multiPartLimit:
|
|
multipartElementSize:
|
|
## For artifactory.persistence.type azure-blob, azure-blob-storage-direct, cluster-azure-blob-storage
|
|
azureBlob:
|
|
accountName:
|
|
accountKey:
|
|
endpoint:
|
|
containerName:
|
|
multiPartLimit: 100000000
|
|
multipartElementSize: 50000000
|
|
testConnection: false
|
|
## artifactory data Persistent Volume Storage Class
|
|
## If defined, storageClassName: <storageClass>
|
|
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
|
## If undefined (the default) or set to null, no storageClassName spec is
|
|
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
|
## GKE, AWS & OpenStack)
|
|
##
|
|
# storageClassName: "-"
|
|
## Annotations for the Persistent Volume Claim
|
|
annotations: {}
|
|
## Uncomment the following resources definitions or pass them from command line
|
|
## to control the cpu and memory resources allocated by the Kubernetes cluster
|
|
resources: {}
|
|
# requests:
|
|
# memory: "1Gi"
|
|
# cpu: "500m"
|
|
# limits:
|
|
# memory: "2Gi"
|
|
# cpu: "1"
|
|
## The following Java options are passed to the java process running Artifactory.
|
|
## You should set them according to the resources set above
|
|
javaOpts:
|
|
# xms: "1g"
|
|
# xmx: "2g"
|
|
jmx:
|
|
enabled: false
|
|
port: 9010
|
|
host:
|
|
ssl: false
|
|
# When authenticate is true, accessFile and passwordFile are required
|
|
authenticate: false
|
|
accessFile:
|
|
passwordFile:
|
|
# corePoolSize: 24
|
|
# other: ""
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
## Only used if "affinity" is empty
|
|
podAntiAffinity:
|
|
## Valid values are "soft" or "hard"; any other value indicates no anti-affinity
|
|
type: "soft"
|
|
topologyKey: "kubernetes.io/hostname"
|
|
ssh:
|
|
enabled: false
|
|
internalPort: 1339
|
|
externalPort: 1339
|
|
frontend:
|
|
name: frontend
|
|
enabled: true
|
|
internalPort: 8070
|
|
## Extra environment variables that can be used to tune frontend to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for frontend container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
## Session settings
|
|
session:
|
|
## Time in minutes after which the frontend token will need to be refreshed
|
|
timeoutMinutes: '30'
|
|
## The following settings are to configure the frequency of the liveness and startup probes when splitServicesToContainers set to true
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.frontend.internalPort }}/api/v1/system/liveness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
failureThreshold: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.frontend.internalPort }}/api/v1/system/readiness
|
|
initialDelaySeconds: 30
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
access:
|
|
enabled: true
|
|
## Enable TLS by changing the tls entry (under the security section) in the access.config.yaml file.
|
|
## ref: https://www.jfrog.com/confluence/display/JFROG/Managing+TLS+Certificates#ManagingTLSCertificates
|
|
## When security.tls is set to true, JFrog Access will act as the Certificate Authority (CA) and sign the TLS certificates used by all the different JFrog Platform nodes.
|
|
## This ensures that the node to node communication is done over TLS.
|
|
accessConfig:
|
|
security:
|
|
tls: false
|
|
## You can use a pre-existing secret by specifying customCertificatesSecretName
|
|
## Example : Create a tls secret using `kubectl create secret tls <secret-name> --cert=ca.crt --key=ca.private.key`
|
|
# customCertificatesSecretName:
|
|
|
|
## When resetAccessCAKeys is true, Access will regenerate the CA certificate and matching private key
|
|
# resetAccessCAKeys: false
|
|
database:
|
|
maxOpenConnections: 80
|
|
tomcat:
|
|
connector:
|
|
maxThreads: 50
|
|
sendReasonPhrase: false
|
|
extraConfig: 'acceptCount="100"'
|
|
metadata:
|
|
name: metadata
|
|
enabled: true
|
|
internalPort: 8086
|
|
database:
|
|
maxOpenConnections: 80
|
|
## Extra environment variables that can be used to tune metadata to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for metadata container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
## The following settings are to configure the frequency of the liveness and startup probes when splitServicesToContainers set to true
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.metadata.internalPort }}/api/v1/system/liveness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
failureThreshold: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.metadata.internalPort }}/api/v1/system/readiness
|
|
initialDelaySeconds: 30
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
event:
|
|
name: event
|
|
enabled: true
|
|
internalPort: 8061
|
|
## WebHook handlers settings for event
|
|
webhooks: {}
|
|
# urlStrictPolicy: false
|
|
|
|
## Extra environment variables that can be used to tune event to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for event container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
## The following settings are to configure the frequency of the liveness and startup probes when splitServicesToContainers set to true
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.event.internalPort }}/api/v1/system/liveness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
failureThreshold: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.event.internalPort }}/api/v1/system/readiness
|
|
initialDelaySeconds: 30
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
jfconnect:
|
|
name: jfconnect
|
|
enabled: true
|
|
internalPort: 8030
|
|
## Extra environment variables that can be used to tune jfconnect to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for jfconnect container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
## The following settings are to configure the frequency of the liveness and startup probes when splitServicesToContainers set to true
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.jfconnect.internalPort }}/api/v1/system/liveness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
failureThreshold: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.jfconnect.internalPort }}/api/v1/system/readiness
|
|
initialDelaySeconds: 30
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
integration:
|
|
name: integration
|
|
enabled: true
|
|
internalPort: 8071
|
|
## Extra environment variables that can be used to tune integration to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for integration container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
## The following settings are to configure the frequency of the liveness and startup probes when splitServicesToContainers set to true
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.integration.internalPort }}/api/v1/system/liveness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
failureThreshold: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.integration.internalPort }}/api/v1/system/readiness
|
|
initialDelaySeconds: 30
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
federation:
|
|
name: federation
|
|
enabled: false
|
|
internalPort: 8085
|
|
extraJavaOpts: ""
|
|
# This section should be removed once rtfs service is GA
|
|
database:
|
|
port: 5432
|
|
host: postgresql
|
|
name: rtfs
|
|
username: rtfs
|
|
password: ""
|
|
## Extra environment variables that can be used to tune federation to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for federation container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
## The following settings are to configure the frequency of the liveness and startup probes when splitServicesToContainers set to true
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.federation.internalPort }}/artifactory/service/rtfs/ping
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
failureThreshold: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.federation.internalPort }}/artifactory/service/rtfs/ping
|
|
initialDelaySeconds: 30
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
observability:
|
|
name: observability
|
|
enabled: true
|
|
internalPort: 8036
|
|
## Extra environment variables that can be used to tune observability to your needs.
|
|
## Uncomment and set value as needed
|
|
extraEnvironmentVariables:
|
|
# - name: MY_ENV_VAR
|
|
# value: ""
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "1"
|
|
|
|
# Add lifecycle hooks for observability container
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","echo Hello from the preStop handler"]
|
|
|
|
## The following settings are to configure the frequency of the liveness and startup probes when splitServicesToContainers set to true
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.observability.internalPort }}/api/v1/system/liveness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
failureThreshold: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.observability.internalPort }}/api/v1/system/readiness
|
|
initialDelaySeconds: 30
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
# MISSION_CONTROL
|
|
mc:
|
|
enabled: false
|
|
database:
|
|
maxOpenConnections: 10
|
|
idgenerator:
|
|
maxOpenConnections: 2
|
|
tomcat:
|
|
connector:
|
|
maxThreads: 50
|
|
sendReasonPhrase: false
|
|
extraConfig: 'acceptCount="100"'
|
|
# Nginx
|
|
nginx:
|
|
enabled: true
|
|
kind: Deployment
|
|
name: nginx
|
|
labels: {}
|
|
replicaCount: 1
|
|
minAvailable: 0
|
|
uid: 104
|
|
gid: 107
|
|
securityContext: {}
|
|
annotations: {}
|
|
terminationGracePeriodSeconds: 30
|
|
disableProxyBuffering: false
|
|
deployment:
|
|
annotations: {}
|
|
# Note that by default we use appVersion to get image tag/version
|
|
image:
|
|
registry: releases-docker.jfrog.io
|
|
repository: jfrog/nginx-artifactory-pro
|
|
# tag:
|
|
pullPolicy: IfNotPresent
|
|
# Priority Class name to be used in deployment if provided
|
|
priorityClassName:
|
|
# Spread nginx pods evenly across your nodes or some other topology
|
|
topologySpreadConstraints: []
|
|
# - maxSkew: 1
|
|
# topologyKey: kubernetes.io/hostname
|
|
# whenUnsatisfiable: DoNotSchedule
|
|
# labelSelector:
|
|
# matchLabels:
|
|
# app: '{{ template "artifactory.name" . }}'
|
|
# release: '{{ .Release.Name }}'
|
|
# component: '{{ .Values.nginx.name }}'
|
|
|
|
# Add lifecycle hooks for the nginx pods
|
|
# For example, you can add a `preStop` hook that sends a SIGQUIT to nginx and wait for it to terminate gracefully
|
|
lifecycle: {}
|
|
# postStart:
|
|
# exec:
|
|
# command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /var/opt/jfrog/nginx/message"]
|
|
# preStop:
|
|
# exec:
|
|
# command: ["/bin/sh","-c","nginx -s quit; while killall -0 nginx; do sleep 1; done"]
|
|
|
|
# Sidecar containers for tailing Nginx logs
|
|
loggers: []
|
|
# - access.log
|
|
# - error.log
|
|
|
|
# Loggers containers resources
|
|
loggersResources: {}
|
|
# requests:
|
|
# memory: "64Mi"
|
|
# cpu: "25m"
|
|
# limits:
|
|
# memory: "128Mi"
|
|
# cpu: "50m"
|
|
|
|
# Logs options
|
|
logs:
|
|
stderr: false
|
|
level: warn
|
|
## A list of custom ports to expose on the NGINX pod. Follows the conventional Kubernetes yaml syntax for container ports.
|
|
customPorts: []
|
|
# customPorts:
|
|
# - containerPort: 8066
|
|
# name: docker
|
|
|
|
mainConf: |
|
|
# Main Nginx configuration file
|
|
worker_processes 4;
|
|
|
|
{{ if .Values.nginx.logs.stderr }}
|
|
error_log stderr {{ .Values.nginx.logs.level }};
|
|
{{- else -}}
|
|
error_log {{ .Values.nginx.persistence.mountPath }}/logs/error.log {{ .Values.nginx.logs.level }};
|
|
{{- end }}
|
|
pid /tmp/nginx.pid;
|
|
|
|
{{- if .Values.artifactory.ssh.enabled }}
|
|
## SSH Server Configuration
|
|
stream {
|
|
server {
|
|
listen {{ .Values.nginx.ssh.internalPort }};
|
|
proxy_pass {{ include "artifactory.fullname" . }}:{{ .Values.artifactory.ssh.externalPort }};
|
|
}
|
|
}
|
|
{{- end }}
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
variables_hash_max_size 1024;
|
|
variables_hash_bucket_size 64;
|
|
server_names_hash_max_size 4096;
|
|
server_names_hash_bucket_size 128;
|
|
types_hash_max_size 2048;
|
|
types_hash_bucket_size 64;
|
|
proxy_read_timeout 2400s;
|
|
client_header_timeout 2400s;
|
|
client_body_timeout 2400s;
|
|
proxy_connect_timeout 75s;
|
|
proxy_send_timeout 2400s;
|
|
proxy_buffer_size 128k;
|
|
proxy_buffers 40 128k;
|
|
proxy_busy_buffers_size 128k;
|
|
proxy_temp_file_write_size 250m;
|
|
proxy_http_version 1.1;
|
|
client_body_buffer_size 128k;
|
|
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
|
|
log_format timing 'ip = $remote_addr '
|
|
'user = \"$remote_user\" '
|
|
'local_time = \"$time_local\" '
|
|
'host = $host '
|
|
'request = \"$request\" '
|
|
'status = $status '
|
|
'bytes = $body_bytes_sent '
|
|
'upstream = \"$upstream_addr\" '
|
|
'upstream_time = $upstream_response_time '
|
|
'request_time = $request_time '
|
|
'referer = \"$http_referer\" '
|
|
'UA = \"$http_user_agent\"';
|
|
|
|
access_log {{ .Values.nginx.persistence.mountPath }}/logs/access.log timing;
|
|
|
|
sendfile on;
|
|
#tcp_nopush on;
|
|
|
|
keepalive_timeout 65;
|
|
|
|
#gzip on;
|
|
|
|
include /etc/nginx/conf.d/*.conf;
|
|
|
|
}
|
|
artifactoryConf: |
|
|
{{- if .Values.nginx.https.enabled }}
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
|
|
ssl_certificate {{ .Values.nginx.persistence.mountPath }}/ssl/tls.crt;
|
|
ssl_certificate_key {{ .Values.nginx.persistence.mountPath }}/ssl/tls.key;
|
|
ssl_session_cache shared:SSL:1m;
|
|
ssl_prefer_server_ciphers on;
|
|
{{- end }}
|
|
## server configuration
|
|
server {
|
|
{{- if .Values.nginx.internalPortHttps }}
|
|
listen {{ .Values.nginx.internalPortHttps }} ssl;
|
|
{{- else -}}
|
|
{{- if .Values.nginx.https.enabled }}
|
|
listen {{ .Values.nginx.https.internalPort }} ssl;
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.nginx.internalPortHttp }}
|
|
listen {{ .Values.nginx.internalPortHttp }};
|
|
{{- else -}}
|
|
{{- if .Values.nginx.http.enabled }}
|
|
listen {{ .Values.nginx.http.internalPort }};
|
|
{{- end }}
|
|
{{- end }}
|
|
server_name ~(?<repo>.+)\.{{ include "artifactory.fullname" . }} {{ include "artifactory.fullname" . }}
|
|
{{- range .Values.ingress.hosts -}}
|
|
{{- if contains "." . -}}
|
|
{{ "" | indent 0 }} ~(?<repo>.+)\.{{ . }}
|
|
{{- end -}}
|
|
{{- end -}};
|
|
|
|
if ($http_x_forwarded_proto = '') {
|
|
set $http_x_forwarded_proto $scheme;
|
|
}
|
|
## Application specific logs
|
|
## access_log /var/log/nginx/artifactory-access.log timing;
|
|
## error_log /var/log/nginx/artifactory-error.log;
|
|
rewrite ^/artifactory/?$ / redirect;
|
|
if ( $repo != "" ) {
|
|
rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/$repo/$1/$2 break;
|
|
}
|
|
chunked_transfer_encoding on;
|
|
client_max_body_size 0;
|
|
|
|
location / {
|
|
proxy_read_timeout 900;
|
|
proxy_pass_header Server;
|
|
proxy_cookie_path ~*^/.* /;
|
|
proxy_pass {{ include "artifactory.scheme" . }}://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalPort }}/;
|
|
{{- if .Values.nginx.service.ssloffload}}
|
|
proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host;
|
|
{{- else }}
|
|
proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$server_port;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
{{- end }}
|
|
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
{{- if .Values.nginx.disableProxyBuffering}}
|
|
proxy_http_version 1.1;
|
|
proxy_request_buffering off;
|
|
proxy_buffering off;
|
|
{{- end }}
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
location /artifactory/ {
|
|
if ( $request_uri ~ ^/artifactory/(.*)$ ) {
|
|
proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/$1;
|
|
}
|
|
proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/;
|
|
}
|
|
location /pipelines/ {
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $http_host;
|
|
{{- if .Values.router.tlsEnabled }}
|
|
proxy_pass https://{{ include "artifactory.fullname" . }}:{{ .Values.router.internalPort }};
|
|
{{- else }}
|
|
proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.router.internalPort }};
|
|
{{- end }}
|
|
}
|
|
}
|
|
}
|
|
customInitContainers: ""
|
|
customSidecarContainers: ""
|
|
customVolumes: ""
|
|
customVolumeMounts: ""
|
|
customCommand:
|
|
## allows overwriting the command for the nginx container.
|
|
## defaults to [ 'nginx', '-g', 'daemon off;' ]
|
|
|
|
service:
|
|
## For minikube, set this to NodePort, elsewhere use LoadBalancer
|
|
type: LoadBalancer
|
|
ssloffload: false
|
|
## For supporting whitelist on the Nginx LoadBalancer service
|
|
## Set this to a list of IP CIDR ranges
|
|
## Example: loadBalancerSourceRanges: ['10.10.10.5/32', '10.11.10.5/32']
|
|
## or pass from helm command line
|
|
## Example: helm install ... --set nginx.service.loadBalancerSourceRanges='{10.10.10.5/32,10.11.10.5/32}'
|
|
loadBalancerSourceRanges: []
|
|
annotations: {}
|
|
## Provide static ip address
|
|
loadBalancerIP:
|
|
## There are two available options: “Cluster” (default) and “Local”.
|
|
externalTrafficPolicy: Cluster
|
|
## If the type is NodePort you can set a fixed port
|
|
# nodePort: 32082
|
|
## A list of custom ports to be exposed on nginx service. Follows the conventional Kubernetes yaml syntax for service ports.
|
|
customPorts: []
|
|
# - port: 8066
|
|
# targetPort: 8066
|
|
# protocol: TCP
|
|
# name: docker
|
|
http:
|
|
enabled: true
|
|
externalPort: 80
|
|
internalPort: 80
|
|
https:
|
|
enabled: true
|
|
externalPort: 443
|
|
internalPort: 443
|
|
ssh:
|
|
internalPort: 1339
|
|
externalPort: 1339
|
|
# DEPRECATED: The following will be removed in a future release
|
|
# externalPortHttp: 80
|
|
# internalPortHttp: 80
|
|
# externalPortHttps: 443
|
|
# internalPortHttps: 443
|
|
|
|
## The following settings are to configure the frequency of the liveness and readiness probes.
|
|
livenessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} {{ include "nginx.scheme" . }}://localhost:{{ include "nginx.port" . }}/
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}180{{ else }}0{{ end }}
|
|
periodSeconds: 10
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
failureThreshold: 5
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} {{ include "nginx.scheme" . }}://localhost:{{ include "nginx.port" . }}/router/api/v1/system/readiness
|
|
initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}90{{ else }}0{{ end }}
|
|
periodSeconds: 10
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
failureThreshold: 5
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: true
|
|
config: |
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} {{ include "nginx.scheme" . }}://localhost:{{ include "nginx.port" . }}/router/api/v1/system/readiness
|
|
initialDelaySeconds: 30
|
|
failureThreshold: 90
|
|
periodSeconds: 5
|
|
timeoutSeconds: {{ .Values.probes.timeoutSeconds }}
|
|
## The SSL secret that will be used by the Nginx pod
|
|
# tlsSecretName: chart-example-tls
|
|
## Custom ConfigMap for nginx.conf
|
|
customConfigMap:
|
|
## Custom ConfigMap for artifactory-ha.conf
|
|
customArtifactoryConfigMap:
|
|
persistence:
|
|
mountPath: "/var/opt/jfrog/nginx"
|
|
enabled: false
|
|
## A manually managed Persistent Volume and Claim
|
|
## Requires persistence.enabled: true
|
|
## If defined, PVC must be created manually before volume will be bound
|
|
# existingClaim:
|
|
|
|
accessMode: ReadWriteOnce
|
|
size: 5Gi
|
|
## nginx data Persistent Volume Storage Class
|
|
## If defined, storageClassName: <storageClass>
|
|
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
|
## If undefined (the default) or set to null, no storageClassName spec is
|
|
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
|
## GKE, AWS & OpenStack)
|
|
##
|
|
# storageClassName: "-"
|
|
resources: {}
|
|
# requests:
|
|
# memory: "250Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "250Mi"
|
|
# cpu: "500m"
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
## Database configurations
|
|
## Use the wait-for-db init container. Set to false to skip
|
|
waitForDatabase: true
|
|
## Configuration values for the PostgreSQL dependency sub-chart
|
|
## ref: https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md
|
|
postgresql:
|
|
enabled: true
|
|
image:
|
|
registry: releases-docker.jfrog.io
|
|
repository: bitnami/postgresql
|
|
tag: 13.10.0-debian-11-r14
|
|
postgresqlUsername: artifactory
|
|
postgresqlPassword: ""
|
|
postgresqlDatabase: artifactory
|
|
postgresqlExtendedConf:
|
|
listenAddresses: "*"
|
|
maxConnections: "1500"
|
|
persistence:
|
|
enabled: true
|
|
size: 200Gi
|
|
# existingClaim:
|
|
service:
|
|
port: 5432
|
|
primary:
|
|
nodeSelector: {}
|
|
affinity: {}
|
|
tolerations: []
|
|
readReplicas:
|
|
nodeSelector: {}
|
|
affinity: {}
|
|
tolerations: []
|
|
resources: {}
|
|
securityContext:
|
|
enabled: true
|
|
containerSecurityContext:
|
|
enabled: true
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
# requests:
|
|
# memory: "512Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "1Gi"
|
|
# cpu: "500m"
|
|
## If NOT using the PostgreSQL in this chart (postgresql.enabled=false),
|
|
## specify custom database details here or leave empty and Artifactory will use embedded derby
|
|
database:
|
|
type:
|
|
driver:
|
|
## If you set the url, leave host and port empty
|
|
url:
|
|
## If you would like this chart to create the secret containing the db
|
|
## password, use these values
|
|
user:
|
|
password:
|
|
## If you have existing Kubernetes secrets containing db credentials, use
|
|
## these values
|
|
secrets: {}
|
|
# user:
|
|
# name: "rds-artifactory"
|
|
# key: "db-user"
|
|
# password:
|
|
# name: "rds-artifactory"
|
|
# key: "db-password"
|
|
# url:
|
|
# name: "rds-artifactory"
|
|
# key: "db-url"
|
|
# Filebeat Sidecar container
|
|
## The provided filebeat configuration is for Artifactory logs. It assumes you have a logstash installed and configured properly.
|
|
filebeat:
|
|
enabled: false
|
|
name: artifactory-filebeat
|
|
image:
|
|
repository: "docker.elastic.co/beats/filebeat"
|
|
version: 7.16.2
|
|
logstashUrl: "logstash:5044"
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
#!/usr/bin/env bash -e
|
|
curl --fail 127.0.0.1:5066
|
|
failureThreshold: 3
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
#!/usr/bin/env bash -e
|
|
filebeat test output
|
|
failureThreshold: 3
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
resources: {}
|
|
# requests:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
# limits:
|
|
# memory: "100Mi"
|
|
# cpu: "100m"
|
|
|
|
filebeatYml: |
|
|
logging.level: info
|
|
path.data: {{ .Values.artifactory.persistence.mountPath }}/log/filebeat
|
|
name: artifactory-filebeat
|
|
queue.spool:
|
|
file:
|
|
permissions: 0760
|
|
filebeat.inputs:
|
|
- type: log
|
|
enabled: true
|
|
close_eof: ${CLOSE:false}
|
|
paths:
|
|
- {{ .Values.artifactory.persistence.mountPath }}/log/*.log
|
|
fields:
|
|
service: "jfrt"
|
|
log_type: "artifactory"
|
|
output:
|
|
logstash:
|
|
hosts: ["{{ .Values.filebeat.logstashUrl }}"]
|
|
## Allows to add additional kubernetes resources
|
|
## Use --- as a separator between multiple resources
|
|
## For an example, refer - https://github.com/jfrog/log-analytics-prometheus/blob/master/artifactory-values.yaml
|
|
additionalResources: ""
|
|
# Adding entries to a Pod's /etc/hosts file
|
|
# For an example, refer - https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases
|
|
hostAliases: []
|
|
# - ip: "127.0.0.1"
|
|
# hostnames:
|
|
# - "foo.local"
|
|
# - "bar.local"
|
|
# - ip: "10.1.2.3"
|
|
# hostnames:
|
|
# - "foo.remote"
|
|
# - "bar.remote"
|
|
|
|
## Toggling this feature is seamless and requires helm upgrade
|
|
## will enable all microservices to run in different containers in a single pod (by default it is true)
|
|
splitServicesToContainers: true
|
|
## Specify common probes parameters
|
|
probes:
|
|
timeoutSeconds: 5
|