Configuring Helm charts

##---------------------------------------------
## Common images configurations section
##---------------------------------------------
images:
  # Image registry to pull the images from.
  # E.g., registry: "123456789012.dkr.ecr.us-east-1.amazonaws.com"
  registry: "docker.io/cloudbees"

  # Image tag of the image to pull
  tag: "<refer_to_latest_release>"

  # The image pull policy to use
  pullPolicy: IfNotPresent

  # Image pull secrets
  # Enable this option when using a private registry.
  # Secrets must be manually created in the namespace.
  # imagePullSecrets: <secret-name>

  # (Optional) Array of `imagePullSecrets` containing private registry credentials.
  # Reference to one or more secrets to use when pulling images.
  # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  # imagePullSecrets:
  # - name: "docker-registry"

  imagePullSecrets:

# The name of the Flow server, usually its fully-qualified domain name, from
# which the server will be available for all agents (resources) and other
# components.
# By default, it is the internal cluster hostname for the K8S Flow server
# service. Flow server will not be fully accessible to non-cluster components
# if this is the default.
serverName: flow-server
▼

#---------------------------------------------
# Ingress configuration section
#---------------------------------------------

ingress:

  enabled: true

  host:

# Flow web ingress annotations, here we use nginx but any other ingress
# supporting sticky sessions will suffice.
  annotations:
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/affinity-mode: "persistent"
    nginx.ingress.kubernetes.io/session-cookie-name: "route"
    nginx.ingress.kubernetes.io/session-cookie-hash: "sha1"
    nginx.ingress.kubernetes.io/proxy-body-size: "10G"
    nginx.ingress.kubernetes.io/secure-backends: "false"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "4000"
    nginx.ingress.kubernetes.io/proxy-stream-timeout: "4000"



# Add below annotations if you are using EKS + ALB
#  alb.ingress.kubernetes.io/scheme: internet-facing
#  alb.ingress.kubernetes.io/certificate-arn: "<acm certificate arn>"


# Should be set to the same value as nginx-ingress.controller.ingressClass if enabled.
# Should be set to the same value as ingress-nginx.controller.ingressClassResource.name if enabled.
# Set to alb if using EKS and need to deploy ALB load balancer with alb controller enabled.
#  class: alb
  class: flow-ingress

# Certificate for WEB ingress.
#
# Normally should be set when helm install executes using `--set-file
# ingress.certificate.key=path/to/key` `--set-file
# ingress.certificate.crt=path/to/certificate`.
#
# This section is just an example that ingress can be configured with
# certificate for TLS.
  certificate:
    existingSecret:
    key:
    crt:

# Whether to create an OpenShift Route rather than a generic Ingress.
  route: false

# Enables specific settings depending on the platform.
# Platform specific values are: `eks`, `aws`, `gke`, `aks`, `openshift`
# Note: `openshift` maps to OpenShift 4.x
platform: standard
▼

#---------------------------------------------
# Flow server configuration section
#---------------------------------------------

server:

# Flag that dictates whether this workload and its accompanying services are
# to be installed.
  enabled: true
  imageRepository: cbflow-server
  replicas: 1

# `expose` as flow requires the repository to be exposed as an externally available
# service and requires (by default) ports 8443 and 61613 to be public.
  expose: true

# Master loglevel for com.electriccloud package.
  logLevel: DEBUG

  zk:
    host: zookeeper
    port: 2181

# This line is interpreted as if passed to the CloudBees ecconfigure
# utility within the container.
  ecconfigure: "--serverInitMemoryMB=4096 --serverMaxMemoryMB=4096"

  resources:
    limits:
      cpu: 4
      memory: 6Gi
    requests:
      cpu: 2
      memory: 6Gi

  nodeSelector: {}
  tolerations: []
  affinity: {}

# Kubernetes Liveness and Readiness Probes.
  livenessProbe:
    initialDelaySeconds: 90
    periodSeconds: 60
    failureThreshold: 10
    timeoutSeconds: 10

  readinessProbe:
    initialDelaySeconds: 60
    periodSeconds: 10
    failureThreshold: 10
    timeoutSeconds: 10

  ## Specify additional volumes to mount in the server container.
  additionalVolumes: []

  ## Specify where the additional volumes are mounted in the server container.
  additionalVolumeMounts: []

  additionalContainers:
  #   - name: container-name
  #     image: image:version
  #     command:
  #       - "/container-command"

# Additional environment variables to set for flow-server.
  extraEnvs: []
  # extraEnvs:
  #   - name: FOO
  #     value: "BAR"
  #   - name: FOO
  #     valueFrom:
  #       secretKeyRef:
  #         key: FOO
  #         name: secret-resource

# Enable or disable sending telemetry data to CloudBees
# Note: This option only works for the very first installation during server initialization.
# For an already initialized server, this can be configured in its settings.
  telemetryData:
    enabled: true

# Creates extra Kubernetes service with type `LoadBalancer`.
# The server requires (by default) ports 8443 and 61613 to be public.
  externalService:
    enabled: false

# Enable or disable creating init container for volume permissions for server.
  volumesPermissionsInitContainer:
    enabled: true
# Horizontal Pod Autoscaling configuration for server.
# This is only supported when clusteredMode=true.
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80
    templates: []
    # Custom or additional autoscaling metrics:
    # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
    # - type: Pods
    #   pods:
    #     metric:
    #       name: server_process_requests_total
    #     target:
    #       type: AverageValue
    #       averageValue: 10000m


jobInit:
  annotations:
    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
  nodeSelector: {}
  tolerations: []
  affinity: {}
▼

#---------------------------------------------
# Flow web server configuration section
#---------------------------------------------

web:

# Flag that dictates whether this workload and its accompanying services are
# to be installed.
  enabled: true
  imageRepository: cbflow-web
  replicas: 1

  service:
    type: ClusterIP

# This line is interpreted as if passed to the CloudBees ecconfigure
# utility within the container.
  ecconfigure: ""

  resources:
    limits:
      cpu: 1
      memory: 512Mi
    requests:
      cpu: 0.25
      memory: 256Mi

  nodeSelector: {}
  tolerations: []
  affinity: {}

# Additional environment variables to set for flow-web.
  extraEnvs: []
  # extraEnvs:
  #   - name: FOO
  #     valueFrom:
  #       secretKeyRef:
  #         key: FOO
  #         name: secret-resource
  #   - name: FOO
  #     value: BAR

  # Enable shared plugin volume mount (PVC) on flow-web pods.
  # Mounts empty dir instead if `sharedPluginsEnabled: false.
  sharedPluginsEnabled: true

  ## Specify additional volumes to mount in the web container.
  additionalVolumes: []

  ## Specify where the additional volumes are mounted in the web container.
  additionalVolumeMounts: []

  additionalContainers:
  #   - name: container-name
  #     image: image:version
  #     command:
  #       - "/container-command"

# Horizontal Pod Autoscaling configuration for web.
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80
    templates: []
    # Custom or additional autoscaling metrics
    # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
    # - type: Pods
    #   pods:
    #     metric:
    #       name: server_process_requests_total
    #     target:
    #       type: AverageValue
    #       averageValue: 10000m
▼

#---------------------------------------------
# Flow repository configuration section
#---------------------------------------------

repository:

# Flag that dictates whether this workload and its accompanying services are
# to be installed.
  enabled: true
  imageRepository: cbflow-repository
  replicas: 1

# `expose` as flow requires the repository to be exposed as an externally available
# service and requires (by default) port 8200 to be public.
  expose: true

# The zone assigned to the repository instance created in the Flow server
# to represent this repository instance.
# NOTE: The zone must already exist in CloudBees Flow server instance.
  zoneName:

# The endpoint for Flow repository service.
#
# This setting is ignored if Flow server is `enabled`. In this case,
# the service name will be determined automatically based on `.serverName` value.
#
# If Flow server is disabled and the repository should connect to
# a Flow server outside of this deployment, this setting is REQUIRED.
#
# Helm templates are acceptable for this setting.
  serviceEndpoint:

# Master loglevel for com.electriccloud package
  logLevel: DEBUG

# This line is interpreted as if passed to the CloudBees ecconfigure
# utility within the container.
  ecconfigure: "--repositoryInitMemoryMB=256 --repositoryMaxMemoryMB=512"

  resources:
    requests:
      cpu: 0.25
      memory: 1024Mi
    limits:
      cpu: 0.25
      memory: 1024Mi

  nodeSelector: {}
  tolerations: []
  affinity: {}

# Additional environment variables to set for flow-repository.
  extraEnvs: []
  # extraEnvs:
  #   - name: FOO
  #     valueFrom:
  #       secretKeyRef:
  #         key: FOO
  #         name: secret-resource
  #   - name: FOO
  #     value: BAR

# Creates extra Kubernetes service with type `LoadBalancer`.
# The repository requires (by default) port 8200 to be public.
  externalService:
    enabled: false

# Enable or disable creating init container for volume permissions for repository.
  volumesPermissionsInitContainer:
    enabled: true

  ## Specify additional volumes to mount in the repository container.
  additionalVolumes: []

  ## Specify where the additional volumes are mounted in the repository container.
  additionalVolumeMounts: []

  additionalContainers:
  #   - name: container-name
  #     image: image:version
  #     command:
  #       - "/container-command"

# Horizontal Pod Autoscaling configuration for server.
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80
    templates: []
    # Custom or additional autoscaling metrics:
    # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
    # - type: Pods
    #   pods:
    #     metric:
    #       name: repository_process_requests_total
    #     target:
    #       type: AverageValue
    #       averageValue: 10000m
▼

#---------------------------------------------
# Flow DevOps Insight configuration section
#---------------------------------------------

dois:

# Flag that dictates whether this workload and its accompanying services are
# to be installed.
  enabled: true
  imageRepository: cbflow-dois
# Number or Elasticsearch nodes
  replicas: 1

# `expose` as flow requires devopsinsight to be exposed as an externally available
# service and requires (by default) ports 9200 and 9500 to be public.
  expose: true

# The DOIS service endpoint to configure on the remote
# CloudBees Flow server.
# Here, we assume the remote CloudBees Flow server is located in the same
# Kubernetes cluster.
  serviceEndpoint: "flow-devopsinsight.{{ .Release.Namespace }}"

# The name of the Elasticsearch cluster.
  esClusterName:
# Minimum number of master-eligible nodes that must be visible in order to
# form an Elasticsearch cluster.
  esMinMasterNodes: 1
# The number of primary shards that an index should have.
  esNumberOfShards:

  credentials:
# Either specify the secret where the report user password and the admin user
# password will be stored (recommended for production) or specify
# the reportUserPassword and adminPassword values.
# When using the secret, store the 'reportUser' password under
# the 'CBF_DOIS_PASSWORD' key and the 'admin' password under
# the 'CBF_DOIS_ADMIN_PASSWORD' key.
# If the password is an empty string, then user 'admin' will not be created
# and administrative access will not be granted.
# If reportUserPassword is an empty string, a random 20 characters password will be used

    existingSecret:
    adminPassword:
    reportUserPassword:

# The heap size in MB for Elasticsearch and Logstash services.
  esRam: 1024

  resources:
    limits:
      cpu: 1
      memory: 3Gi
    requests:
      cpu: 0.1
      memory: 2Gi

  nodeSelector: {}
  tolerations: []
  affinity: {}
  # Adds Openshift Node Tuning label to DOIS Pods to configure `vm.max_map_count` value required to run Elasticsearch.
  # refer https://developers.redhat.com/blog/2019/11/12/using-the-red-hat-openshift-tuned-operator-for-elasticsearch/
  openshiftNodeTuning: false
# Additional environment variables to set for DevOps Insight.
  extraEnvs: []
  # extraEnvs:
  #   - name: FOO
  #     valueFrom:
  #       secretKeyRef:
  #         key: FOO
  #         name: secret-resource
  #   - name: FOO
  #     value: BAR

#  DOIS Liveness and Readiness Probes variables
  healthProbeReadinessPeriodSeconds: 5
  healthProbeReadinessFailureThreshold: 3
  healthProbeReadinessInitialDelaySeconds: 60
  healthProbeLivenessPeriodSeconds: 20
  healthProbeLivenessFailureThreshold: 3
  healthProbeLivenessInitialDelaySeconds: 60

# Enable or disable the privileged `sysctlInitContainer` if the `sysctl vm.max_map_count` setting is set by another method.
  sysctlInitContainer:
    enabled: true

# Enable or disable creating init container for volume permissions for dois.
  volumesPermissionsInitContainer:
    enabled: true

# Enable or disable creating init container for volume permissions for dois.
  backup:
    # Note: Changing `enabled` on a previous installation requires the deletion of the statefulset prior to upgrading.
    # e.g. kubectl delete statefulset flow-devopsinsight
    enabled: false
    schedule_cron: "0 */12 * * *"
    retentionDays: 15
    location: "/es-backups"
    imageRepository: cbflow-tools
    cleanupImageRepository: "python"
    cleanupImageTag: "3.7.7"
    restoreSnapshot: false
    restoreSnapshotName:
    externalRepo:
      # Enable in case need to take backup in s3 or gcs.
      enabled: false
      # Type can be s3 or gcs.
      type: s3
      # Name of Bucket in s3 or gcs.
      bucketName:
      # Either specify the secret where the AWS or GCS credentials stored as per below keys or provide in values file with secret.
      # For AWS, create secret for AWS S3 with permission to read/write to bucket policy with Keys AWS_ACCESS_KEY and AWS_SECRET_KEY.
      # E.g. kubectl create secret generic s3awssecret --from-literal=AWS_ACCESS_KEY="XXXXX" --from-literal=AWS_SECRET_KEY="XXXXX"
      # Create secret for GCS with permission to read/write to bucket policy with service account key file with KEY GCS_SA_KEY
      # E.g. kubectl create secret generic gcssasecret --from-file=GCS_SA_KEY=/tmp/gke-credentials.json
      existingSecret:
      secret:
        # provide only if type s3
        awsAccessKey:
        awsSecretKey:
        # provide only if type gcs
        gcsSaKey:

      # Region of s3 or gcs bucket e.g. us-east-1.
      region:


# Creates extra Kubernetes service with type `LoadBalancer`.
# DOIS requires (by default) ports 9200 and 9500 to be public.
  externalService:
    enabled: false
# Flow DOIS LoadBalancer service annotations for creating internal LoadBalancer
# on GCP, AWS.
    annotations:
#      networking.gke.io/load-balancer-type: "Internal"
#      service.beta.kubernetes.io/aws-load-balancer-internal: "0.0.0.0/0"

# DOIS Supported Certificates.
  certificates:
    ca:
      crt:
      key:
    sign:
      crt:
      key:
    node:
      crt:
      key:
    admin:
      crt:
      key:
      dname:
    bundle:
# Either specify the secret where the certificates ca, sign, node, and
# admin bundle will be stored (recommended for production) or specify above.
    existingSecret:
# When using the `existingSecret` secret, use the keys:
#     store the 'ca.crt' value under CBF_DOIS_CA_CRT key
#     store the 'ca.key' value under CBF_DOIS_CA_KEY key
#     store the 'sign.crt' value under CBF_DOIS_SIGN_CRT key
#     store the 'sign.key' value under CBF_DOIS_SIGN_KEY key
#     store the 'node.crt' value under CBF_DOIS_NODE_CRT key
#     store the 'node.key' value under CBF_DOIS_NODE_KEY key
#     store the 'admin.crt' value under CBF_DOIS_ADMIN_CRT key
#     store the 'admin.key' value under CBF_DOIS_ADMIN_KEY key
#     store the 'bundle' value under CBF_DOIS_CRT_BUNDLE key
### DO NOT STORE `admin.dname` IN SECRET, instead pass it as value.###

# For multiple dois replicas, use the following option that best
# supports your certificates:
#      * Define certificates.bundle.
#      * Define certificates.ca.crt and certificates.ca.key.
#      * Define certificates.ca.crt, certificates.sign.crt, and
#         certificates.sign.key.
#      * Define certificates.ca.crt, certificates.sign.crt, certificates.node.crt,
#         certificates.node.key, certificates.admin.crt, and
#         certificates.admin.key are defined.
#

  additionalContainers:
  #   - name: container-name
  #     image: image:version
  #     command:
  #       - "/container-command"
▼

#---------------------------------------------
# Flow bound agent configuration section
#---------------------------------------------

# This is an internal component that serves the web server and the repository
# connections to Flow server. It is automatically enabled or disabled if
# deployment of these components is enabled.

boundAgent:

  imageRepository: cbflow-agent
  replicas: 1

# Master loglevel for com.electriccloud package.
  logLevel: DEBUG

# This line is interpreted as if passed to the CloudBees ecconfigure
# utility within the container.
  ecconfigure: "--agentInitMemoryMB=256 --agentMaxMemoryMB=256"

  resources:
    limits:
      cpu: 0.25
      memory: 1024Mi
    requests:
      cpu: 0.25
      memory: 512Mi

  nodeSelector: {}
  tolerations: []
  affinity: {}


# Additional environment variables to set for bound agent.
  extraEnvs: []
  # extraEnvs:
  #   - name: FOO
  #     valueFrom:
  #       secretKeyRef:
  #         key: FOO
  #         name: secret-resource
  #   - name: FOO
  #     value: BAR

# Enable or disable creating init container for volume permissions for `boundagent`.
  volumesPermissionsInitContainer:
    enabled: true

  ## Specify additional volumes to mount in the bound agent container.
  additionalVolumes: []

  ## Specify where the additional volumes are mounted in the bound agent container.
  additionalVolumeMounts: []

  additionalContainers:
  #   - name: container-name
  #     image: image:version
  #     command:
  #       - "/container-command"
▼

#---------------------------------------------
# Flow storage configuration section
#---------------------------------------------

storage:

  volumes:

    serverPlugins:
      name: flow-server-shared
      accessMode: ReadWriteMany
# Storage class for plugins directory. Currently, it has to be shared across all
# server and web replicas, and it must be `ReadWriteMany` accessible.
      storageClass:
      storage: 5Gi
# To use any existing PVC, set the `existingClaim` flag to `true`, and
# set `storage.volumes.serverPlugins.name` to PVC name.
      existingClaim: false

    repositoryStorage:
      name: flow-repo-artifacts
      accessMode: ReadWriteOnce
      storage: 20Gi
# To use any non-"platform-default" or custom storage class,
# state the required `storageClass` name.
      storageClass:
# To use any existing PVC, set the `existingClaim` flag to `true`, and
# set `storage.volumes.repositoryStorage.name` to PVC name.
      existingClaim: false

    doisStorage:
      name: elasticsearch-data
      accessMode: ReadWriteOnce
      storage: 10Gi
# To use any non-"platform-default" or custom storage class,
# state the required `storageClass` name.
      storageClass:

    boundAgentStorage:
# Set `enable: true` to use Persistent Volume for bound agent workspace.
      enabled: false
      name: flow-bound-agent-workspace
      accessMode: ReadWriteOnce
      storage: 5Gi
# To use any non-"platform-default" or custom storage class,
# state the required `storageClass` name.
      storageClass:
# To use any existing PVC, set the `existingClaim` flag to `true`, and
# set `storage.volumes.boundAgentStorage.name` to PVC name.
      existingClaim: false
▼

#---------------------------------------------
# Flow server database configuration section
#---------------------------------------------

# Db endpoint, `database` or `schema`, principal that has full privileges on
# that schema (rw access) - dbUser, dbPassword.

database:

#  externalEndpoint: "my.db.somewhere.com"

# Use this option if your database is residing in the same Kubernetes cluster
# as flow. Notation is `<db-service>.<namespace>`. If deploying into the same
# namespace, `.<namespace>` part can be omitted.

#  clusterEndpoint: "<db-service>.<namespace>"

# Use this option if you have or are planning to deploy credentials
# secret yourself. The layout has to be the same as that of
# server-secrets.yaml::dbSecret.

#  existingSecret: <my-existing-secret>
# If dbPassword is an empty string, a random 20 characters password will be used.

  dbName:
  dbUser:
  dbPassword:

# Remote database port to connect to.
  dbPort:

# Database type for flow persistence to work with.
# One of: `mysql` - MYSQL, `mariadb` - MariaDB, `sqlserver` - MSSQLServer,
# `oracle` - Oracle, `postgresql` - PostgreSql.
  dbType:

# External Mysql Connector URL to download during CloudBees flow installation.
  mysqlConnector:
    enabled: true
    externalUrl:
▼

#---------------------------------------------
# Flow server credentials configuration section
#---------------------------------------------

flowCredentials:

# Either specify the secret where the admin user password is stored under
# the 'CBF_SERVER_ADMIN_PASSWORD' key (recommended for production), or specify
# the adminPassword.
# If adminPassword is an empty string, a random 20 characters password will be used.

  existingSecret:
  adminPassword:
▼

#---------------------------------------------
# Flow server license configuration optional section
#---------------------------------------------

# Automations of licence installations or upgrades
# should be made using the following API:
# https://docs.cloudbees.com/docs/cloudbees-cd-api/latest/flow-api/apiserver

# This optional section allows you to set up your license with the flow server during
# the first initialization only. Allows for either create a secret from this chart or
# supply your own pre-created one. Pre-created secrets must have a single field named
# `CBF_LICENSE` with value containing license file contents.

flowLicense:

# Pass existing secret name with license data.
  existingSecret:
  licenseData:
▼

#---------------------------------------------
# Pods security context
#---------------------------------------------

securityContext:
  enabled: false
  fsGroup: 1000
  allowPrivilegeEscalation: false
  runAsUser: 1000
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  capabilities:
    drop: ["ALL"]
  seccompProfile:
    type: "RuntimeDefault"

volumePermissions:
  enabled: true
▼

#---------------------------------------------
#  RBAC resources
#---------------------------------------------

rbac:
  ## Specifies whether RBAC resources should be created.
  ##
  create: false
  serviceAccountName:
  annotations: {}
  role:
    ## Rules to create.
    rules: []
▼

#---------------------------------------------
# Network isolation configuration
#---------------------------------------------

networkIsolation:

# `allowFromCidr` defines CIDR, which is allowed to make connection to all
# exposed flow endpoints.
  allowFromCidr: "0.0.0.0/0"
▼

#---------------------------------------------
# Zookeeper configuration section
#---------------------------------------------

# Bundled zookeeper installation. If you already have an available zookeeper
# installation or your security policy demands so, disable this one and
# enter your zookeeper endpoint address into `workloads.server.zk.host` and
# `workloads.server.zk.port`.
# Flow can not share zookeeper with any other applications as of now.
zookeeper:

  image:
    # Container image repository for zookeeper container.
    repository: docker.io/cloudbees/cbflow-tools
    # Container image tag for zookeeper container.
    tag: "<refer_to_latest_release>"

  fullnameOverride: zookeeper
  replicaCount: 3

  podLabels:
    ownerApp: "cloudbees-flow"
    role: "cluster-coordinator"
    mode: "private"

  resources:
    limits:
      cpu: "250m"
      memory: "1Gi"
    requests:
      memory: "512Mi"
      cpu: "250m"
▼

##---------------------------------------------
## Miscellaneous configuration section
##---------------------------------------------
clusteredMode: true

# Flag used to configure the cloudbees-sda chart.
# Should not be used from a standalone cloudbees-flow installation.
sda: false


mariadb:
  enabled:  false
  fullnameOverride: mariadb
  replication:
    enabled: false
  volumePermissions:
    enabled: true
  initdbScriptsConfigMap: mariadb-initdb-scripts
  existingSecret: mariadb-initdb-secret
  # Must provide same user name same as `database.dbUser` (default it "flow").
  db:
    user: ""
  rootUser:
    # MariaDB admin password
    # If password is an empty string, a random 10 characters password will be used
    # ref: https://github.com/bitnami/bitnami-docker-mariadb#setting-the-root-password-on-first-run
    #
    password: ""
  master:
    nodeSelector:
      kubernetes.io/os: linux

# cloudbees-flow-agent chart configurations used for creating the
# internal agent for the gateway.
internalGatewayAgent:
    enabled: false
    releaseNamePrefix: gateway-default-agent
    resourceName: gateway-default-agent
    replicas: 1
    trustedAgent: false
    flowCredentials:
      # Enable `serverSecretReference` to re-use flow-server secrets in agents chart.
      serverSecretReference: true
    autoscaling:
      enabled: false
      minReplicas: 1
      maxReplicas: 2
      targetCPUUtilizationPercentage: 80
      targetMemoryUtilizationPercentage: 80
    gateway:
      # considering this as internal gateway agent
      enabled: true

# cloudbees-flow-agent chart configurations used for creating the
# external agent for the gateway.
externalGatewayAgent:
    enabled: false
    releaseNamePrefix: gateway-external-agent
    resourceName: gateway-external-agent
    replicas: 1
    trustedAgent: false
    zoneName: external
    service:
      # External DNS hostname that the external agents will communicate
      # with the external gateway agent.
      publicHostName:

    # Configure gateway using external gateway agent:
    gateway:
      # Configure gateway using this agent:
      enabled: true
      # Name of the gateway to create:
      name: external
      # Name of gateway agent to pair with as gateway resource 2:
      pairedResourceName: gateway-default-agent

    flowCredentials:
      # Enable `serverSecretReference` to re-use flow-server secrets in agents chart.
      serverSecretReference: true
    autoscaling:
      enabled: false
      minReplicas: 1
      maxReplicas: 2
      targetCPUUtilizationPercentage: 80
      targetMemoryUtilizationPercentage: 80

gitops:
  enabled: false
  repo:
# Either specify the secret where the gitToken is stored under
# the 'CBF_GIT_TOKEN' key (recommended for production), or specify:
  gitToken:
  existingSecret:

# CD Sidecar injector (optional)
# Useful when running infrastructure (GitHub Enterprise, Nexus, etc.) using a self-signed certificate.
# This allows you to inject certificate bundles into pods running in CloudBees CD/RO
# so that they can trust provided certificates without having to build custom docker images.
# Label your namespace with `sidecar-injector-cd=enabled` to
# enable sidecar-injector to work
# `kubectl label namespace mynamespace sidecar-injector-cd=enabled`
# Use helm inspect readme cloudbees/cloudbees-sidecar-injector to read more on this optional components.
# Note: If you are using SDA and CI with `sidecarinjector: enabled`,
# you can`t enable cdsidecarinjector because the same charts are referenced,
# and contains conflicting  names.
cdsidecarinjector:
  # Use `cdsidecarinjector.enabled` to enable installation of sidecar injector.
  enabled: false
  caBundleName: ca-bundles
  injectionCaCertificates:
    - /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

  injectionJavaKeystore:
    - /opt/cbflow/jre/lib/security/cacerts # Alpine/Debian/Ubuntu/Gentoo etc.

  namespaceLabel: sidecar-injector
  annotationPrefix: com.cloudbees.sidecar-injector
  batchApiVersion: batch/v1 # Use batch/v1beta1 if using Kubernetes < 1.22
▼

# Default values for cloudbees-flow-agent chart.
#
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

images:
  registry: "docker.io/cloudbees"
  imageRepository: "cbflow-agent"
  tag: "<refer_to_latest_release>"
  pullPolicy: IfNotPresent

  # Image pull secrets
  # Enable `imagePullSecrets` when using a private registry.
  # Secrets must be manually created in the namespace.
  # imagePullSecrets: <secret-name>

  # (Optional) Array of `imagePullSecrets` containing private registry credentials.
  # Reference to one or more secrets used when pulling images.
  # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  # imagePullSecrets:
  # - name: "docker-registry"

  imagePullSecrets:

# Provide the flow-server endpoint here. If installing in different namespace than server,
# the service name must be stated in the notation `service-name.namespace`.
# Here, we assume the same namespace.
serverEndpoint: flow-server
▼

#---------------------------------------------
# Flow agent configuration section
#---------------------------------------------

# List of resource pools agents will try to register with when initializing and registering with server.
resourcePools:

# Flow resource name that agents of this deployment will be assigned to (defaults to hostname).
#
# Ordinary Helm template values are allowed here. For example: {{ .Release.Name }},
# {{ .Release.Namespace }} etc. Also, 2 special templates are allowed here:
#
#     {{ hostname }} - is replaced by the actual resource hostname.
#     {{ ordinalIndex }} - is replaced by a serial replica index in StatefulSet.
#
# Sample:
#
#     resourceName: "myResource - {{ .Release.Name }} - {{ ordinalIndex }}"
#
resourceName:

# Release name prefix added to support this chart to launch as
# multiple sub-charts in CloudBees CD/RO deployment.
# Keep this empty for standalone deployments
releaseNamePrefix:

# Number of replicas.
replicas: 1

# The default is to deploy all pods serially. By setting this to parallel,
# all pods are started at the same time.
podManagementPolicy: "Parallel"

# The zone (must exist in CloudBees Flow server instance) for
# the resources created in the Flow server for the agent(s).
zoneName:

# The default workspace (must exist in CloudBees Flow server instance) for
# the resources created in the Flow server for the agent(s).
workspaceName:

# Set to `true` to configure the agent as a trusted agent, which
# restricts the agent to one CloudBees Flow server deployment
trustedAgent: false

# Type of resource to create on the remote CloudBees
# Flow server. This argument is relevant only when the
# CloudBees Flow server is using a mixed-mode license
# (concurrent resources and registered hosts).
# Valid options for this argument are 'concurrent'
# or 'registered'.
resourceType:
▼

#---------------------------------------------
# Flow agent storage and resources configuration section
#---------------------------------------------

# Agent workspace volume related settings: volume-name,
# access-mode (either nfs(aka ReadWriteMany), or traditional volume mount(aka ReadWriteOnce)).
# and storage amount
storage:
  volumes:
    agentWorkspace:
      name: flow-agent-workspace
      accessMode: ReadWriteOnce
      storage: 5Gi
# To use any non-"platform-default" or custom storage class uncomment
# `storageClass: my-class` line and provide the required `storageClass` name.
#     storageClass: my-class
#
# Defined as `true` if any agent is already deployed with shared workspace
# and PVC already exist.
      existingClaim: false


resources:
  limits:
    cpu: 1
    memory: 1024Mi
  requests:
    cpu: 0.25
    memory: 512Mi
▼

#---------------------------------------------
# Flow server credentials configuration section
#---------------------------------------------

# Flow server credentials to use to register with agent as a resource on the Flow server.
# 'admin' user is used by default. You may use a different user if desired. The user must have:
# `modify` permissions on `resources` on the Flow server.
# `serverSecretReference` is added to support instances where agents need to refer to flow servers existing admin credentials.
flowCredentials:
  ## In case of Existing Secret Name of the secret containing the Flow user credentials to use.
  ## The data field must contain base64 encoded value for keys 'CBF_SERVER_USER' and 'CBF_SERVER_PASSWORD'.
  ## E.g., kubectl create secret generic your-flow-user-secret --from-literal=CBF_SERVER_USER='admin' --from-literal=CBF_SERVER_ADMIN_PASSWORD='XXXXXXX' -n your-release-namespace
  ##
  existingSecret:
  serverSecretReference: false
  user: admin
  password:
▼

#---------------------------------------------
# Pod scheduling settings
#---------------------------------------------

nodeSelector: {}
tolerations: []
affinity: {}

# This line is interpreted as if passed to the CloudBees ecconfigure
# utility within the container.
ecconfigure: "--agentInitMemoryMB=16 --agentMaxMemoryMB=64"

# Master loglevel for com.electriccloud package.
logLevel: DEBUG


service:
  type: ClusterIP
  clusterIP: "None"
# For Gateway Agent configuration.
# External DNS hostname to set to as agent service name.
  publicHostName: null

# Creates extra Kubernetes service with type `LoadBalancer`.
# Gateway Agents require (by default) port 7800 to be public
# to communicate with external agents.
externalService:
  enabled: false

#---------------------------------------------
# Pods security context
#---------------------------------------------

securityContext:
  enabled: false
  fsGroup: 1000
  runAsUser: 1000

rbac:
  ## Specifies whether RBAC resources should be created.
  ##
  create: false
  serviceAccountName:
  role:
    ## Rules to create.
    rules: []


volumePermissions:
  enabled: true

gateway:
  # Install this agent as gateway agent:
  enabled: false
  # Name of the gateway to create
  name: external
  # Name of gateway agent to pair with as gateway resource 2
  pairedResourceName:

additionalContainers:
  #   - name: container-name
  #     image: image:version
  #     command:
  #       - "/container-command"

# Horizontal Pod Autoscaling configuration for agent.
autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 3
  targetCPUUtilizationPercentage: 80
  targetMemoryUtilizationPercentage: 80
  templates: []
  # Custom or additional autoscaling metrics:
  # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
  # - type: Pods
  #   pods:
  #     metric:
  #       name: server_process_requests_total
  #     target:
  #       type: AverageValue
  #       averageValue: 10000m

## Specify additional volumes to mount in the agent container.
additionalVolumes: []

## Specify where the additional volumes are mounted in the agent container.
additionalVolumeMounts: []
▼