values.yaml

## Docker image configuration
##
image:
  ## Operator container pull policy
  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
  ##
  pullPolicy: IfNotPresent
  repository: cr.yandex/yc/ydb-kubernetes-operator
  tag: "REPLACED_BY_CHART_APP_VERSION_IF_UNSPECIFIED"

## Secrets to use for Docker registry access
## Secrets must be provided manually.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
## Example:
## pullSecrets:
##   - myRegistryKeySecretName
##
imagePullSecrets: []

nodeSelector: {}

nameOverride: ""
fullnameOverride: ""

## Resource quotas
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
resources:
  ## The resource limits for Operator container
  ## Example:
  ## limits:
  ##    cpu: 250m
  ##    memory: 512Mi
  limits: {}
  ## The requested resources for Operator container
  ## Example:
  ## requests:
  ##    cpu: 250m
  ##    memory: 256Mi
  requests: {}

service:
  port: 8080
  type: ClusterIP

metrics:
  ## Create ServiceMonitor resources
  ##
  enabled: false

webhook:
  enabled: true

  service:
    type: ClusterIP
    port: 9443
    ## If type is NodePort:
    #  nodePort: 9443
    #
    ## Arbitrary fqdn for WebhookConfiguration instead of a default Service cluster fqdn:
    #  fqdn: example.org

  ## If enabled, generate a self-signed certificate, then patch the webhook configurations with the generated data.
  ## On chart upgrades (or if the secret exists) the cert will not be re-generated. You can use this to provide your own
  ## certs ahead of time if you wish.
  ##
  patch:
    enabled: true
    image:
      repository: k8s.gcr.io/ingress-nginx/kube-webhook-certgen
      tag: v1.0
      sha: "f3b6b39a6062328c095337b4cadcefd1612348fdd5190b1dcbcb9b9e90bd8068"
      pullPolicy: IfNotPresent
    resources: {}
    ## Provide a priority class name to the webhook patching job
    ##
    priorityClassName: ""
    podAnnotations: {}
    nodeSelector: {}
    affinity: {}
    tolerations: []

    ## SecurityContext holds pod-level security attributes and common container settings.
    ## This defaults to non-root user with uid 2000 and gid 2000. *v1.PodSecurityContext  false
    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    ##
    securityContext:
      runAsGroup: 2000
      runAsNonRoot: true
      runAsUser: 2000

  # Use cert-manager to generate webhook certs
  certManager:
    enabled: false
    # self-signed root certificate
    rootCert:
      duration: ""  # default to be 5y
    admissionCert:
      duration: ""  # default to be 1y
    # issuerRef:
    #   name: "issuer"
    #   kind: "ClusterIssuer"