Big Bang values.yaml¶
domain¶
Type: string
"dev.bigbang.mil"
Description: Domain used for BigBang created exposed services, can be overridden by individual packages.
istio¶
Type: object
ambient:
enabled: false
egressGateway:
enabled: false
Description: Global Istio settings
istio.ambient¶
Type: object
enabled: false
Description: Ambient mesh mode configuration
istio.ambient.enabled¶
Type: bool
false
Description: Enable Istio ambient mesh mode. When true, uses ztunnel for mTLS instead of sidecars. This automatically enables istioCNI, ztunnel, and gatewayAPI packages. NOTE: Ambient mode is generally available as of Big Bang 3.32. It remains opt-in in 3.x and becomes the default in 4.0.
istio.egressGateway¶
Type: object
enabled: false
Description: Egress gateway configuration
istio.egressGateway.enabled¶
Type: bool
false
Description: Enable the shared egress waypoint gateway (requires ambient mode). This automatically enables the istioEgressGateway package. NOTE: The egress gateway is an alpha feature.
offline¶
Type: bool
false
Description: Prevent Big Bang from creating GitRepository resources. HelmReleases configured with Git sources will continue to reference those resources, so they must already exist in the expected namespaces. This applies to integrated packages, additional packages, and the package wrapper.
helmRepositories¶
Type: list
[]
Description: List of Helm repositories/credentials to pull helm charts from. OCI Type: Must specify username/password or existingSecret if repository requires auth. Using “private-registry” for existingSecret will reuse credentials from registryCredentials above. Default Type: Must specify existingSecret with auth - see https://fluxcd.io/flux/components/source/helmrepositories/#secret-reference for details on secret data required.
registryCredentials¶
Type: object, list, or null
nil
Description: Registry credentials used to pull all images deployed by Big Bang. Set to null (or omit) if your environment provides ambient image pull access, e.g. AWS EKS nodes with an IAM role granting ECR access, or GKE Workload Identity for GCR. When null, no private-registry Secret or imagePullSecrets stanzas are created. registryCredentials.username is required to be non-null if registryCredentials is defined registryCredentials.password is required to be non-null if registryCredentials is defined registryCredentials.registry will default to registry1.dso.mil registryCredentials.email will default to “”
openshift¶
Type: bool
false
Description: OpenShift Container Platform feature toggle.
git¶
Type: object
credentials:
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
existingSecret: ''
Description: Git credential settings for accessing private repositories Order of precedence is: 1. existingSecret 2. http credentials (username/password/caFile) 3. ssh credentials (privateKey/publicKey/knownHosts)
git.existingSecret¶
Type: string
""
Description: Existing secret to use for git credentials, must be in the appropriate format: https://toolkit.fluxcd.io/components/source/gitrepositories/#https-authentication
git.credentials¶
Type: object
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
Description: Chart created secrets with user defined values
git.credentials.username¶
Type: string
""
Description: HTTP git credentials, both username and password must be provided
git.credentials.caFile¶
Type: string
""
Description: HTTPS certificate authority file. Required for any repo with a self signed certificate
git.credentials.privateKey¶
Type: string
""
Description: SSH git credentials, privateKey, publicKey, and knownHosts must be provided
sso¶
Type: object
certificateAuthority:
cert: ''
secretName: tls-ca-sso
name: SSO
oidc:
authorization: '{{ .Values.sso.url }}/protocol/openid-connect/auth'
claims:
email: email
groups: groups
name: name
username: preferred_username
discoveryUrl: '{{ .Values.sso.url }}/.well-known/openid-configuration'
endSession: '{{ .Values.sso.url }}/protocol/openid-connect/logout'
jwks: ''
jwksUri: '{{ .Values.sso.url }}/protocol/openid-connect/certs'
token: '{{ .Values.sso.url }}/protocol/openid-connect/token'
userinfo: '{{ .Values.sso.url }}/protocol/openid-connect/userinfo'
saml:
entityDescriptor: '{{ .Values.sso.url }}/protocol/saml/descriptor'
metadata: ''
service: '{{ .Values.sso.url }}/protocol/saml'
url: https://login.dso.mil/auth/realms/baby-yoda
Description: Global SSO values used for BigBang deployments when sso is enabled
sso.name¶
Type: string
"SSO"
Description: Name of the identity provider. This is used by some packages as the SSO login label.
sso.url¶
Type: string
"https://login.dso.mil/auth/realms/baby-yoda"
Description: Base URL for the identity provider. For OIDC, this is the issuer. For SAML this is the entityID.
sso.certificateAuthority¶
Type: object
cert: ''
secretName: tls-ca-sso
Description: Certificate authority for the identity provider’s certificates
sso.certificateAuthority.cert¶
Type: string
""
Description: The certificate authority public certificate in .pem format. Populating this will create a secret in each namespace that enables SSO.
sso.certificateAuthority.secretName¶
Type: string
"tls-ca-sso"
Description: The secret name to use for the certificate authority. Can be manually populated if cert is blank.
sso.saml.entityDescriptor¶
Type: string
"{{ .Values.sso.url }}/protocol/saml/descriptor"
Description: SAML entityDescriptor (metadata) path
sso.saml.service¶
Type: string
"{{ .Values.sso.url }}/protocol/saml"
Description: SAML SSO Service path
sso.saml.metadata¶
Type: string
""
Description: Literal SAML XML metadata retrieved from {{ .Values.sso.saml.entityDescriptor }}. Required for SSO in Twistlock or Sonarqube. Optional for Anchore Enterprise.
sso.oidc¶
Type: object
authorization: '{{ .Values.sso.url }}/protocol/openid-connect/auth'
claims:
email: email
groups: groups
name: name
username: preferred_username
discoveryUrl: '{{ .Values.sso.url }}/.well-known/openid-configuration'
endSession: '{{ .Values.sso.url }}/protocol/openid-connect/logout'
jwks: ''
jwksUri: '{{ .Values.sso.url }}/protocol/openid-connect/certs'
token: '{{ .Values.sso.url }}/protocol/openid-connect/token'
userinfo: '{{ .Values.sso.url }}/protocol/openid-connect/userinfo'
Description: OIDC endpoints can be retrieved from {{ .Values.sso.url }}/.well-known/openid-configuration
sso.oidc.discoveryUrl¶
Type: string
"{{ .Values.sso.url }}/.well-known/openid-configuration"
Description: OIDC discovery URL
sso.oidc.authorization¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/auth"
Description: OIDC authorization path
sso.oidc.endSession¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/logout"
Description: OIDC logout / end session path
sso.oidc.jwksUri¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/certs"
Description: OIDC JSON Web Key Set (JWKS) path
sso.oidc.token¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/token"
Description: OIDC token path
sso.oidc.userinfo¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/userinfo"
Description: OIDC user information path
sso.oidc.jwks¶
Type: string
""
Description: Literal OIDC JWKS data retrieved from JWKS Uri. Only needed if jwksUri is not defined.
sso.oidc.claims¶
Type: object
email: email
groups: groups
name: name
username: preferred_username
Description: Identity provider claim names that store metadata about the authenticated user.
sso.oidc.claims.email¶
Type: string
"email"
Description: IdP’s claim name used for the user’s email address.
sso.oidc.claims.name¶
Type: string
"name"
Description: IdP’s claim name used for the user’s full name
sso.oidc.claims.username¶
Type: string
"preferred_username"
Description: IdP’s claim name used for the username
sso.oidc.claims.groups¶
Type: string
"groups"
Description: IdP’s claim name used for the user’s groups or roles
flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
mode: enabled
install:
remediation:
retries: -1
interval: 2m
rollback:
cleanupOnFail: true
timeout: 10m
test:
enable: false
timeout: 10m
upgrade:
cleanupOnFail: true
remediation:
remediateLastFailure: true
retries: 3
Description: Advanced Flux reconciliation parameters. The default values provided will be sufficient for the majority of workloads.
networkPolicies¶
Type: object
controlPlaneCidr: 0.0.0.0/0
egress:
definitions:
database-subnets:
ports:
- port: 5432
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
kafka-subnets:
ports:
- port: 9092
protocol: TCP
- port: 9093
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
redis-subnets:
ports:
- port: 6379
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
sso:
to:
- ipBlock:
cidr: 0.0.0.0/0
storage-subnets:
ports:
- port: 443
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
enabled: true
ingress:
definitions:
kubeAPI:
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
load-balancer-subnets:
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
nodeCidr: ''
vpcCidr: 0.0.0.0/0
Description: Global NetworkPolicies settings
networkPolicies.enabled¶
Type: bool
true
Description: Toggle all package NetworkPolicies. For integrated packages that consume bb-common as a subchart, use packages.<name>.values.bb-common.networkPolicies.enabled to override a specific package.
networkPolicies.controlPlaneCidr¶
Type: string
"0.0.0.0/0"
Description: Control Plane CIDR, defaults to 0.0.0.0/0, use kubectl get endpoints -n default kubernetes to get the CIDR range needed for your cluster Must be an IP CIDR range (x.x.x.x/x - ideally with /32 for the specific IP of a single endpoint, broader range for multiple masters/endpoints) Used by package NetworkPolicies to allow Kube API access
networkPolicies.nodeCidr¶
Type: string
""
Description: Node CIDR, defaults to allowing “10.0.0.0/8” “172.16.0.0/12” “192.168.0.0/16” “100.64.0.0/10” networks. use kubectl get nodes -owide and review the INTERNAL-IP column to derive CIDR range. Must be an IP CIDR range (x.x.x.x/x - ideally a /16 or /24 to include multiple IPs)
networkPolicies.vpcCidr¶
Type: string
"0.0.0.0/0"
Description: VPC CIDR, defaults to 0.0.0.0/0 In a production environment, it is recommended to setup a Private Endpoint for your AWS services like KMS or S3. Please review https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.html to setup routing to AWS services that never leave the AWS network. Once created update networkPolicies.vpcCidr to match the CIDR of your VPC so Vault will be able to reach your VPCs DNS and new KMS endpoint.
networkPolicies.egress.definitions¶
Type: object
database-subnets:
ports:
- port: 5432
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
kafka-subnets:
ports:
- port: 9092
protocol: TCP
- port: 9093
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
redis-subnets:
ports:
- port: 6379
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
sso:
to:
- ipBlock:
cidr: 0.0.0.0/0
storage-subnets:
ports:
- port: 443
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
Description: Egress definitions; create definitions here that you want to re-use globally across all packages
networkPolicies.egress.definitions.sso¶
Type: object
to:
- ipBlock:
cidr: 0.0.0.0/0
Description: Egress definition for SSO; Set this to the CIDRs your SSO implementation is being served on; Example: Okta maintains a list of their CIDRs for this purpose
networkPolicies.egress.definitions.storage-subnets¶
Type: object
ports:
- port: 443
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
Description: Egress definition for Storage subnets (i.e. S3, Azure blob storage, etc.)
networkPolicies.egress.definitions.redis-subnets¶
Type: object
ports:
- port: 6379
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
Description: Egress definition for Redis or Valkey subnets. Override these CIDRs and ports to match externally managed Redis, Valkey, or Sentinel endpoints.
networkPolicies.egress.definitions.kafka-subnets¶
Type: object
ports:
- port: 9092
protocol: TCP
- port: 9093
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
Description: Egress definition for Kafka broker subnets (i.e. Amazon MSK, Confluent Cloud, Azure Event Hubs, etc.)
networkPolicies.ingress.definitions¶
Type: object
kubeAPI:
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
load-balancer-subnets:
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
Description: Ingress definitions; create definitions here that you want to re-use globally across all packages
networkPolicies.ingress.definitions.load-balancer-subnets¶
Type: object
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
Description: Ingress definition for load balancer subnets; change these CIDRs to match the subnet CIDRs where your load balancers are deployed
networkPolicies.ingress.definitions.kubeAPI¶
Type: object
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
Description: Ingress definition for Kube API subnets; Used to build Network Policy for packages that need to allow incoming traffic from the Kube API (i.e. Gatekeeper, Kyverno, etc.)
authorizationPolicies¶
Type: object
enabled: false
Description: Global AuthorizationPolicy generation settings for integrated packages.
authorizationPolicies.enabled¶
Type: bool
false
Description: Enable bb-common AuthorizationPolicies. Ambient mode enables them regardless of this value.
routes.defaults.outbound.egressGateway¶
Type: string
"istio-egress/egress-waypoint"
Description: Default egress waypoint binding (‘
imagePullPolicy¶
Type: string
"IfNotPresent"
Description: Global ImagePullPolicy value for all packages Permitted values are: Never, Always, IfNotPresent
wrapper¶
Type: object
git:
path: chart
repo: https://repo1.dso.mil/big-bang/product/packages/wrapper.git
tag: 0.4.15
helmRepo:
chartName: wrapper
repoName: registry1
tag: 0.4.15
sourceType: git
Description: Wrapper chart for integrating Big Bang components alongside a package
wrapper.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
wrapper.helmRepo.repoName¶
Type: string
"registry1"
Description: Repository holding OCI chart, corresponding to helmRepositories name
wrapper.helmRepo.chartName¶
Type: string
"wrapper"
Description: Name of the OCI chart in repo
wrapper.helmRepo.tag¶
Type: string
"0.4.15"
Description: Tag of the OCI chart in repo
wrapper.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/wrapper.git"
Description: Git repo holding the wrapper helm chart, example: https://repo1.dso.mil/big-bang/product/packages/wrapper
wrapper.git.path¶
Type: string
"chart"
Description: Path inside of the git repo to find the helm chart, example: chart
wrapper.git.tag¶
Type: string
"0.4.15"
Description: Git tag to check out. Takes precedence over branch. More info, example: 0.0.2
packageConfiguration¶
Type: object
version: v1
Description: Unified package configuration contract.
packages¶
Type: object
alloy:
additionalDestinations: []
alloyClusterEvents:
enabled: true
alloyLogs:
enabled: true
alloyMetrics:
enabled: false
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/alloy.git
tag: 4.5.3-bb.1
helmRepo:
chartName: k8s-monitoring
repoName: registry1
tag: 4.5.3-bb.1
postRenderers: []
sourceType: git
values: {}
anchoreEnterprise:
adminPassword: ''
database:
database: ''
host: ''
password: ''
port: ''
username: ''
enabled: false
enterprise:
licenseYaml: 'FULL LICENSE
'
flux:
upgrade:
disableWait: true
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/anchore-enterprise.git
tag: 4.4.1-bb.0
helmRepo:
chartName: anchore-enterprise
repoName: registry1
tag: 4.4.1-bb.0
ingress:
gateway: ''
postRenderers: []
redis:
host: ''
password: ''
port: ''
username: ''
sourceType: git
sso:
client_id: ''
enabled: false
role_attribute: ''
values: {}
argocd:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/argocd.git
tag: 10.2.1-bb.3
helmRepo:
chartName: argocd
repoName: registry1
tag: 10.2.1-bb.3
ingress:
gateway: ''
postRenderers: []
redis:
host: ''
port: ''
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
groups: 'g, Impact Level 2 Authorized, role:admin
'
values: {}
authservice:
chains: {}
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/authservice.git
tag: 1.1.8-bb.5
helmRepo:
chartName: authservice
repoName: registry1
tag: 1.1.8-bb.5
postRenderers: []
sourceType: git
values: {}
certManager:
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/cert-manager.git
tag: v1.20.3-bb.2
helmRepo:
chartName: cert-manager
repoName: registry1
tag: v1.20.3-bb.2
namespace:
create: true
labels:
istio.io/dataplane-mode: none
name: cert-manager
postRenderers: []
sourceType: git
values:
issuers:
letsEncrypt:
enabled: false
selfSigned:
enabled: false
upstream:
crds:
enabled: true
eckOperator:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/eck-operator.git
tag: 3.5.0-bb.3
helmRepo:
chartName: eck-operator
repoName: registry1
tag: 3.5.0-bb.3
postRenderers: []
sourceType: git
values: {}
elasticsearchKibana:
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Kibana
- paths:
- ''
target:
kind: Elasticsearch
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
timeout: 20m
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/elasticsearch-kibana.git
tag: 1.44.0-bb.2
helmRepo:
chartName: elasticsearch-kibana
repoName: registry1
tag: 1.44.0-bb.2
ingress:
gateway: ''
license:
keyJSON: ''
trial: false
postRenderers: []
serviceAccountAnnotations:
elasticsearch: {}
kibana: {}
sourceType: git
sso:
claims_principal_pattern: ''
client_id: ''
client_secret: ''
enabled: false
signature_algorithm: ''
values: {}
externalSecrets:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/external-secrets.git
tag: 2.12.0-bb.0
helmRepo:
chartName: external-secrets
repoName: registry1
tag: 2.12.0-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
fluentbit:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/fluentbit.git
tag: 0.58.3-bb.2
helmRepo:
chartName: fluentbit
repoName: registry1
tag: 0.58.3-bb.2
postRenderers: []
sourceType: git
values: {}
fortify:
enabled: false
externalDatabase:
host: ''
port: 3306
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/fortify.git
tag: 26.2.0-bb.7
helmRepo:
chartName: fortify-ssc
repoName: registry1
tag: 26.2.0-bb.7
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
gatekeeper:
enabled: false
flux:
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
waitStrategy:
name: legacy
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/policy.git
tag: 3.23.1-bb.2
helmRepo:
chartName: gatekeeper
repoName: registry1
tag: 3.23.1-bb.2
postRenderers: []
sourceType: git
values: {}
gatewayAPI:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/gateway-api.git
tag: 1.6.3-bb.0
helmRepo:
chartName: gateway-api
repoName: registry1
tag: 1.6.3-bb.0
postRenderers: []
sourceType: git
values: {}
gitlab:
database:
database: ''
host: ''
password: ''
port: 5432
username: ''
dependsOn: null
dependsOnOverride: null
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/gitlab.git
tag: 10.4.2-bb.0
helmRepo:
chartName: gitlab
repoName: registry1
tag: 10.4.2-bb.0
hostnames:
gitlab: gitlab
registry: registry
ingress:
gateway: ''
objectStorage:
accessKey: ''
accessSecret: ''
bucketPrefix: ''
endpoint: ''
iamProfile: ''
region: ''
regionendpoint: ''
type: ''
postRenderers: []
railsSecret: ''
redis:
password: ''
smtp:
password: ''
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
groups: []
scopes:
- Gitlab
values: {}
gitlabRunner:
autoRegister:
enabled: true
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/gitlab-runner.git
tag: 0.91.2-bb.3
helmRepo:
chartName: gitlab-runner
repoName: registry1
tag: 0.91.2-bb.3
postRenderers: []
sourceType: git
values: {}
grafana:
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/grafana.git
tag: 13.2.4-bb.1
helmRepo:
chartName: grafana
repoName: registry1
tag: 13.2.4-bb.1
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
enabled: false
grafana:
allow_sign_up: true
client_id: ''
client_secret: ''
role_attribute_path: Viewer
scopes: ''
values: {}
harbor:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/harbor.git
tag: 1.19.2-bb.4
helmRepo:
chartName: harbor
repoName: registry1
tag: 1.19.2-bb.4
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
headlamp:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/headlamp.git
tag: 0.46.0-bb.0
helmRepo:
chartName: headlamp
repoName: registry1
tag: 0.46.0-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
istioCNI:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/istio-cni.git
tag: 1.31.1-bb.0
helmRepo:
chartName: istio-cni
repoName: registry1
tag: 1.31.1-bb.0
postRenderers: []
sourceType: git
values: {}
istioCRDs:
enabled: true
flux:
driftDetection:
ignore:
- paths:
- /webhooks/0/failurePolicy
target:
kind: ValidatingWebhookConfiguration
name: istiod-default-validator
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
mode: warn
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/istio-crds.git
tag: 1.31.1-bb.0
helmRepo:
chartName: istio-crds
repoName: registry1
tag: 1.31.1-bb.0
postRenderers: []
sourceType: git
values: {}
istioEgressGateway:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/istio-egress-gateway.git
tag: 0.1.5-bb.0
helmRepo:
chartName: istio-egress-gateway
repoName: registry1
tag: 0.1.5-bb.0
postRenderers: []
sourceType: git
values: {}
istioGateway:
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: PeerAuthentication
namespace: istio-gateway
- paths:
- ''
target:
kind: AuthorizationPolicy
namespace: istio-gateway
- paths:
- ''
target:
kind: NetworkPolicy
namespace: istio-gateway
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/istio-gateway.git
tag: 1.31.1-bb.1
helmRepo:
chartName: gateway
repoName: registry1
tag: 1.31.1-bb.1
postRenderers: []
sourceType: git
values: {}
istiod:
enabled: true
flux:
driftDetection:
ignore:
- paths:
- /webhooks/0/failurePolicy
target:
kind: ValidatingWebhookConfiguration
name: istio-validator-istio-system
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
mode: warn
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/istiod.git
tag: 1.31.1-bb.1
helmRepo:
chartName: istiod
repoName: registry1
tag: 1.31.1-bb.1
postRenderers: []
sourceType: git
values: {}
keycloak:
database:
database: ''
host: ''
password: ''
port: 5432
type: postgres
username: ''
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/keycloak.git
tag: 7.3.2-bb.2
helmRepo:
chartName: keycloak
repoName: registry1
tag: 7.3.2-bb.2
ingress:
cert: ''
gateway: ''
key: ''
postRenderers: []
sourceType: git
values: {}
kiali:
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Kiali
timeout: 20m
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/kiali.git
tag: 2.33.0-bb.1
helmRepo:
chartName: kiali
repoName: registry1
tag: 2.33.0-bb.1
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
kyverno:
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: CustomResourceDefinition
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/kyverno.git
tag: 3.9.1-bb.3
helmRepo:
chartName: kyverno
repoName: registry1
tag: 3.9.1-bb.3
postRenderers: []
sourceType: git
values: {}
kyvernoPolicies:
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: ClusterPolicy
- paths:
- ''
target:
kind: ValidatingPolicy
- paths:
- ''
target:
kind: MutatingPolicy
- paths:
- ''
target:
kind: ImageValidatingPolicy
- paths:
- ''
target:
kind: GeneratingPolicy
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/kyverno-policies.git
tag: 3.3.4-bb.90
helmRepo:
chartName: kyverno-policies
repoName: registry1
tag: 3.3.4-bb.90
postRenderers: []
sourceType: git
values: {}
kyvernoReporter:
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/kyverno-reporter.git
tag: 3.11.1-bb.0
helmRepo:
chartName: kyverno-reporter
repoName: registry1
tag: 3.11.1-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
loki:
clusterName: ''
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Sidecar
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/loki.git
tag: 6.55.0-bb.10
helmRepo:
chartName: loki
repoName: registry1
tag: 6.55.0-bb.10
objectStorage:
accessKey: ''
accessSecret: ''
bucketNames: {}
endpoint: ''
region: ''
postRenderers: []
sourceType: git
strategy: monolith
values: {}
mattermost:
database:
database: ''
host: ''
password: ''
port: ''
ssl_mode: ''
username: ''
elasticsearch:
enabled: false
enabled: false
enterprise:
enabled: false
existingSecret: ''
license: ''
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Mattermost
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/mattermost.git
tag: 11.11.1-bb.0
helmRepo:
chartName: mattermost
repoName: registry1
tag: 11.11.1-bb.0
ingress:
gateway: ''
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
mattermostOperator:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/mattermost-operator.git
tag: 1.25.9-bb.2
helmRepo:
chartName: mattermost-operator
repoName: registry1
tag: 1.25.9-bb.2
postRenderers: []
sourceType: git
values: {}
metricsServer:
automountServiceAccountToken: true
enabled: auto
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/metrics-server.git
tag: 3.14.0-bb.1
helmRepo:
chartName: metrics-server
repoName: registry1
tag: 3.14.0-bb.1
namespace:
annotations: {}
create: false
labels: {}
name: kube-system
postRenderers: []
sourceType: git
values: {}
mimir:
dependsOn: null
dependsOnOverride: null
enabled: false
enterprise:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/mimir.git
tag: 6.2.1-bb.1
helmRepo:
chartName: mimir
repoName: registry1
tag: 6.2.1-bb.1
kafkaIngestStorage:
brokerClusterDomain: ''
brokerHost: ''
brokerNetworkCIDR: ''
brokerPort: 9092
enabled: false
topic: mimir-ingest
postRenderers: []
s3ObjectStorage:
accessKey: ''
accessSecret: ''
bucketName: ''
enabled: false
endpoint: ''
insecure: false
region: ''
serviceAccountAnnotations: {}
sourceType: git
values: {}
minio:
accesskey: ''
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/minio.git
tag: 7.1.1-bb.26
helmRepo:
chartName: minio-instance
repoName: registry1
tag: 7.1.1-bb.26
ingress:
gateway: ''
postRenderers: []
secretkey: ''
sourceType: git
values: {}
minioOperator:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/minio-operator.git
tag: 7.1.1-bb.13
helmRepo:
chartName: minio-operator
repoName: registry1
tag: 7.1.1-bb.13
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
monitoring:
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Alertmanager
- paths:
- ''
target:
kind: Prometheus
- paths:
- ''
target:
kind: PrometheusRule
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/monitoring.git
tag: 92.10.1-bb.0
helmRepo:
chartName: monitoring
repoName: registry1
tag: 92.10.1-bb.0
ingress:
gateway: ''
postRenderers: []
prometheusMetrics:
enabled: true
sourceType: git
sso:
alertmanager:
client_id: ''
client_secret: ''
enabled: false
prometheus:
client_id: ''
client_secret: ''
values: {}
neuvector:
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: CronJob
- paths:
- ''
target:
kind: Lease
- paths:
- ''
target:
kind: Secret
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/neuvector.git
tag: 2.11.2-bb.2
helmRepo:
chartName: neuvector
repoName: registry1
tag: 2.11.2-bb.2
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
default_role: ''
enabled: false
group_claim: ''
group_mapped_roles: []
values: {}
prometheusOperatorCRDs:
enabled: true
flux:
driftDetection:
mode: warn
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/prometheus-operator-crds.git
tag: 32.0.1-bb.0
helmRepo:
chartName: prometheus-operator-crds
repoName: registry1
tag: 32.0.1-bb.0
postRenderers: []
sourceType: git
values: {}
renovate:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/renovate.git
tag: 46.369.5-bb.1
helmRepo:
chartName: renovate
repoName: registry1
tag: 46.369.5-bb.1
postRenderers: []
sourceType: git
values: {}
sample:
bbCommonValues: true
configMaps: {}
dependsOn: null
dependsOnOverride: null
enabled: false
flux: {}
git:
branch: null
commit: null
credentials:
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
existingSecret: ''
path: null
repo: null
semver: null
tag: null
helmRepo:
chartName: null
repoName: null
tag: null
includeDefaultDependsOn: true
istio: {}
kustomize: false
monitor: {}
namespace: {}
network: {}
passBigBangValues: false
postRenderers: []
secrets: {}
sourceType: git
values: {}
wrapper:
enabled: false
postRenderers: []
sonarqube:
database:
database: ''
host: ''
password: ''
port: 5432
username: ''
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/sonarqube.git
tag: 2026.5.1002-bb.1
helmRepo:
chartName: sonarqube
repoName: registry1
tag: 2026.5.1002-bb.1
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
email: email
enabled: false
group: group
login: login
name: name
values: {}
tempo:
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/tempo.git
tag: 2.1.0-bb.3
helmRepo:
chartName: tempo
repoName: registry1
tag: 2.1.0-bb.3
metricsGenerator:
enabled: false
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
insecure: false
region: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
thanos:
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/thanos.git
tag: 17.6.0-bb.4
helmRepo:
chartName: thanos
repoName: registry1
tag: 17.6.0-bb.4
ingress:
gateway: ''
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
insecure: false
region: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
twistlock:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/twistlock.git
tag: 0.31.0-bb.1
helmRepo:
chartName: twistlock
repoName: registry1
tag: 0.31.0-bb.1
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
enabled: false
groups: ''
provider_type: shibboleth
values: {}
vault:
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: MutatingWebhookConfiguration
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/vault.git
tag: 0.34.1-bb.5
helmRepo:
chartName: vault
repoName: registry1
tag: 0.34.1-bb.5
ingress:
cert: ''
gateway: ''
key: ''
postRenderers: []
sourceType: git
values: {}
velero:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/velero.git
tag: 12.2.1-bb.2
helmRepo:
chartName: velero
repoName: registry1
tag: 12.2.1-bb.2
postRenderers: []
sourceType: git
values: {}
ztunnel:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/ztunnel.git
tag: 1.31.1-bb.0
helmRepo:
chartName: ztunnel
repoName: registry1
tag: 1.31.1-bb.0
postRenderers: []
sourceType: git
values: {}
Description: Packages to deploy with Big Bang. Built-in package defaults and custom packages share this map. Unknown names deploy through the custom-package contract below.
packages.istioCNI¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/istio-cni.git
tag: 1.31.1-bb.0
helmRepo:
chartName: istio-cni
repoName: registry1
tag: 1.31.1-bb.0
postRenderers: []
sourceType: git
values: {}
Description: Istio CNI package configuration.
packages.istioCNI.enabled¶
Type: bool
false
Description: Toggle deployment of Istio CNI
packages.istioCNI.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.istioCNI.values¶
Type: object
{}
Description: Values to passthrough to the Istio CNI chart
packages.istioCNI.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Istio CNI Package
packages.istioCNI.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.istioCRDs.enabled¶
Type: bool
true
Description: Toggle deployment of Istio CRDs
packages.istioCRDs.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.istioCRDs.values¶
Type: object
{}
Description: Values to passthrough to the Istio CRDs chart
packages.istioCRDs.flux¶
Type: object
driftDetection:
ignore:
- paths:
- /webhooks/0/failurePolicy
target:
kind: ValidatingWebhookConfiguration
name: istiod-default-validator
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
mode: warn
Description: Flux reconciliation overrides specifically for the Istio CRDs Package
packages.istioCRDs.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.gatewayAPI.enabled¶
Type: bool
false
Description: Toggle deployment of Gateway API CRDs
packages.gatewayAPI.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.gatewayAPI.values¶
Type: object
{}
Description: Values to passthrough to the Gateway API chart
packages.gatewayAPI.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Gateway API Package
packages.gatewayAPI.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.istiod.enabled¶
Type: bool
true
Description: Toggle deployment of istiod
packages.istiod.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.istiod.values¶
Type: object
{}
Description: Values to passthrough to the istiod chart
packages.istiod.flux¶
Type: object
driftDetection:
ignore:
- paths:
- /webhooks/0/failurePolicy
target:
kind: ValidatingWebhookConfiguration
name: istio-validator-istio-system
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
mode: warn
Description: Flux reconciliation overrides specifically for the Istio Core Package
packages.istiod.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.istioGateway.enabled¶
Type: bool
true
Description: Toggle deployment of Istio Gateway(s)
packages.istioGateway.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.istioGateway.values¶
Type: object
{}
Description: Gateway chart values. Values under shared apply to every gateway; values under gateways.
packages.istioGateway.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: PeerAuthentication
namespace: istio-gateway
- paths:
- ''
target:
kind: AuthorizationPolicy
namespace: istio-gateway
- paths:
- ''
target:
kind: NetworkPolicy
namespace: istio-gateway
Description: Flux reconciliation overrides specifically for the Istio Gateway Package
packages.istioGateway.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md The istioGateway package supports advanced postRenderer definitions. If an array of postRenderers is provided, the postRenderers will be applied to all gateways. If a map of postRenderers is provided, the postRenderers will be applied only to their respective gateways. The map key must match the gateway name for the postRenderers to be applied to that gateway. You cannot mix array and map postRenderers.
packages.istioEgressGateway.enabled¶
Type: bool
false
Description: Toggle deployment of the shared egress waypoint gateway (requires ambient mode)
packages.istioEgressGateway.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.istioEgressGateway.values¶
Type: object
{}
Description: Values to passthrough to the istio-egress-gateway chart
packages.istioEgressGateway.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Istio Egress Gateway Package
packages.istioEgressGateway.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.ztunnel.enabled¶
Type: bool
false
Description: Toggle deployment of ztunnel (required for Istio ambient mode)
packages.ztunnel.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.ztunnel.values¶
Type: object
{}
Description: Values to passthrough to the ztunnel chart
packages.ztunnel.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the ztunnel Package
packages.ztunnel.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.kiali.enabled¶
Type: bool
true
Description: Toggle deployment of Kiali.
packages.kiali.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.kiali.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Kiali
timeout: 20m
Description: Flux reconciliation overrides specifically for the Kiali Package
packages.kiali.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.kiali.sso.enabled¶
Type: bool
false
Description: Toggle SSO for Kiali on and off
packages.kiali.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for Kiali
packages.kiali.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for Kiali
packages.kiali.values¶
Type: object
{}
Description: Values to pass through to Kiali chart: https://repo1.dso.mil/big-bang/product/packages/kiali
packages.kiali.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.gatekeeper¶
Type: object
enabled: false
flux:
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
waitStrategy:
name: legacy
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/policy.git
tag: 3.23.1-bb.2
helmRepo:
chartName: gatekeeper
repoName: registry1
tag: 3.23.1-bb.2
postRenderers: []
sourceType: git
values: {}
Description: OPA Gatekeeper package configuration.
packages.gatekeeper.enabled¶
Type: bool
false
Description: Toggle deployment of OPA Gatekeeper.
packages.gatekeeper.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.gatekeeper.flux¶
Type: object
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
waitStrategy:
name: legacy
Description: Flux reconciliation overrides specifically for the OPA Gatekeeper Package
packages.gatekeeper.values¶
Type: object
{}
Description: Values to passthrough to the gatekeeper chart: https://repo1.dso.mil/big-bang/product/packages/policy.git
packages.gatekeeper.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.kyverno¶
Type: object
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: CustomResourceDefinition
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/kyverno.git
tag: 3.9.1-bb.3
helmRepo:
chartName: kyverno
repoName: registry1
tag: 3.9.1-bb.3
postRenderers: []
sourceType: git
values: {}
Description: Kyverno package configuration.
packages.kyverno.enabled¶
Type: bool
true
Description: Toggle deployment of Kyverno.
packages.kyverno.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.kyverno.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: CustomResourceDefinition
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
Description: Flux reconciliation overrides specifically for the Kyverno Package
packages.kyverno.values¶
Type: object
{}
Description: Values to passthrough to the kyverno chart: https://repo1.dso.mil/big-bang/product/packages/kyverno.git
packages.kyverno.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.kyvernoPolicies.enabled¶
Type: bool
true
Description: Toggle deployment of Kyverno policies
packages.kyvernoPolicies.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.kyvernoPolicies.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: ClusterPolicy
- paths:
- ''
target:
kind: ValidatingPolicy
- paths:
- ''
target:
kind: MutatingPolicy
- paths:
- ''
target:
kind: ImageValidatingPolicy
- paths:
- ''
target:
kind: GeneratingPolicy
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Kyverno Policies Package
packages.kyvernoPolicies.values¶
Type: object
{}
Description: Values to passthrough to the kyverno policies chart: https://repo1.dso.mil/big-bang/product/packages/kyverno-policies.git
packages.kyvernoPolicies.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.kyvernoReporter.enabled¶
Type: bool
true
Description: Toggle deployment of Kyverno Reporter
packages.kyvernoReporter.sso.enabled¶
Type: bool
false
Description: Toggle SSO for kyvernoReporter virtualservice on and off
packages.kyvernoReporter.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for kyvernoReporter
packages.kyvernoReporter.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for kyvernoReporter
packages.kyvernoReporter.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.kyvernoReporter.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Kyverno Reporter Package
packages.kyvernoReporter.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.kyvernoReporter.values¶
Type: object
{}
Description: Values to passthrough to the kyverno reporter chart: https://repo1.dso.mil/big-bang/product/packages/kyverno-reporter.git
packages.kyvernoReporter.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.elasticsearchKibana¶
Type: object
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Kibana
- paths:
- ''
target:
kind: Elasticsearch
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
timeout: 20m
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/elasticsearch-kibana.git
tag: 1.44.0-bb.2
helmRepo:
chartName: elasticsearch-kibana
repoName: registry1
tag: 1.44.0-bb.2
ingress:
gateway: ''
license:
keyJSON: ''
trial: false
postRenderers: []
serviceAccountAnnotations:
elasticsearch: {}
kibana: {}
sourceType: git
sso:
claims_principal_pattern: ''
client_id: ''
client_secret: ''
enabled: false
signature_algorithm: ''
values: {}
Description: Elasticsearch and Kibana package configuration.
packages.elasticsearchKibana.enabled¶
Type: bool
false
Description: Toggle deployment of Logging (EFK).
packages.elasticsearchKibana.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.elasticsearchKibana.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Kibana
- paths:
- ''
target:
kind: Elasticsearch
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
timeout: 20m
Description: Flux reconciliation overrides specifically for the Logging (EFK) Package
packages.elasticsearchKibana.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.elasticsearchKibana.sso.enabled¶
Type: bool
false
Description: Toggle OIDC SSO for Kibana/Elasticsearch on and off. Enabling this option will auto-create any required secrets.
packages.elasticsearchKibana.sso.client_id¶
Type: string
""
Description: Elasticsearch/Kibana OIDC client ID
packages.elasticsearchKibana.sso.client_secret¶
Type: string
""
Description: Elasticsearch/Kibana OIDC client secret
packages.elasticsearchKibana.sso.claims_principal_pattern¶
Type: string
""
Description: Optional OIDC claim pattern for the authenticated principal
packages.elasticsearchKibana.sso.signature_algorithm¶
Type: string
""
Description: Optional OIDC signature algorithm
packages.elasticsearchKibana.serviceAccountAnnotations¶
Type: object
elasticsearch: {}
kibana: {}
Description: Elasticsearch/Kibana Service Account Annotations
packages.elasticsearchKibana.license.trial¶
Type: bool
false
Description: Toggle trial license installation of elasticsearch. Note that enterprise (non trial) is required for SSO to work.
packages.elasticsearchKibana.license.keyJSON¶
Type: string
""
Description: Elasticsearch license in json format seen here: https://repo1.dso.mil/big-bang/product/packages/elasticsearch-kibana#enterprise-license
packages.elasticsearchKibana.values¶
Type: object
{}
Description: Values to passthrough to the elasticsearch-kibana chart: https://repo1.dso.mil/big-bang/product/packages/elasticsearch-kibana.git
packages.elasticsearchKibana.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.eckOperator.enabled¶
Type: bool
false
Description: Toggle deployment of ECK Operator.
packages.eckOperator.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.eckOperator.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the ECK Operator Package
packages.eckOperator.values¶
Type: object
{}
Description: Values to passthrough to the eck-operator chart: https://repo1.dso.mil/big-bang/product/packages/eck-operator.git
packages.eckOperator.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.fluentbit.enabled¶
Type: bool
false
Description: Toggle deployment of Fluent-Bit.
packages.fluentbit.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.fluentbit.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Fluent-Bit Package
packages.fluentbit.values¶
Type: object
{}
Description: Values to passthrough to the fluentbit chart: https://repo1.dso.mil/big-bang/product/packages/fluentbit.git
packages.fluentbit.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.alloy¶
Type: object
additionalDestinations: []
alloyClusterEvents:
enabled: true
alloyLogs:
enabled: true
alloyMetrics:
enabled: false
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/alloy.git
tag: 4.5.3-bb.1
helmRepo:
chartName: k8s-monitoring
repoName: registry1
tag: 4.5.3-bb.1
postRenderers: []
sourceType: git
values: {}
Description: Grafana Alloy package configuration.
packages.alloy.enabled¶
Type: bool
true
Description: Toggle deployment of grafana alloy
packages.alloy.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.alloy.alloyLogs¶
Type: object
enabled: true
Description: Toggle Alloy to collect logs
packages.alloy.alloyMetrics¶
Type: object
enabled: false
Description: Toggle Alloy to scrape metrics
packages.alloy.alloyClusterEvents¶
Type: object
enabled: true
Description: Toggle Alloy to collect cluster events
packages.alloy.additionalDestinations¶
Type: list
[]
Description: Additional Alloy destinations not included in Big Bang
packages.alloy.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the alloy package
packages.loki.enabled¶
Type: bool
true
Description: Toggle deployment of Loki.
packages.loki.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.loki.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Sidecar
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Loki Package
packages.loki.strategy¶
Type: string
"monolith"
Description: Loki architecture. Options are monolith, scalable, and distributed (unsupported).
packages.loki.clusterName¶
Type: string
""
Description: Loki clusterName identifier
packages.loki.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. examples: “https://s3.amazonaws.com” “https://s3.us-gov-west-1.amazonaws.com” “http://minio.minio.svc.cluster.local:9000”
packages.loki.objectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
packages.loki.objectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint.
packages.loki.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
packages.loki.objectStorage.bucketNames¶
Type: object
{}
Description: Bucket Names for the Loki buckets as YAML chunks: loki-logs ruler: loki-ruler admin: loki-admin
packages.loki.values¶
Type: object
{}
Description: Values to passthrough to the Loki chart: https://repo1.dso.mil/big-bang/product/packages/loki.git
packages.loki.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.neuvector¶
Type: object
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: CronJob
- paths:
- ''
target:
kind: Lease
- paths:
- ''
target:
kind: Secret
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/neuvector.git
tag: 2.11.2-bb.2
helmRepo:
chartName: neuvector
repoName: registry1
tag: 2.11.2-bb.2
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
default_role: ''
enabled: false
group_claim: ''
group_mapped_roles: []
values: {}
Description: NeuVector package configuration.
packages.neuvector.enabled¶
Type: bool
true
Description: Toggle deployment of Neuvector.
packages.neuvector.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.neuvector.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.neuvector.sso.enabled¶
Type: bool
false
Description: Toggle SSO for Neuvector on and off
packages.neuvector.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for Neuvector
packages.neuvector.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for Neuvector
packages.neuvector.sso.default_role¶
Type: string
""
Description: Default role to use for Neuvector OIDC users. Supports admin, reader, or no default
packages.neuvector.sso.group_claim¶
Type: string
""
Description: OIDC claim used to identify Neuvector groups.
packages.neuvector.sso.group_mapped_roles¶
Type: list
[]
Description: Mapping of OIDC groups to Neuvector global roles.
packages.neuvector.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: CronJob
- paths:
- ''
target:
kind: Lease
- paths:
- ''
target:
kind: Secret
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Neuvector Package
packages.neuvector.values¶
Type: object
{}
Description: Values to passthrough to the Neuvector chart: https://repo1.dso.mil/big-bang/product/packages/neuvector.git
packages.neuvector.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.tempo¶
Type: object
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/tempo.git
tag: 2.1.0-bb.3
helmRepo:
chartName: tempo
repoName: registry1
tag: 2.1.0-bb.3
metricsGenerator:
enabled: false
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
insecure: false
region: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
Description: Tempo package configuration.
packages.tempo.enabled¶
Type: bool
true
Description: Toggle deployment of Tempo.
packages.tempo.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.tempo.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Tempo Package
packages.tempo.sso¶
Type: object
client_id: ''
client_secret: ''
enabled: false
Description: This section is deprecated and will be removed in a future release
packages.tempo.sso.enabled¶
Type: bool
false
Description: Toggle SSO for Tempo on and off
packages.tempo.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for Tempo
packages.tempo.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for Tempo
packages.tempo.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. examples: “s3.amazonaws.com” “s3.us-gov-west-1.amazonaws.com” “minio.minio.svc.cluster.local:9000” Note: tempo does not require protocol prefix for URL.
packages.tempo.objectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
packages.tempo.objectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint.
packages.tempo.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
packages.tempo.objectStorage.bucket¶
Type: string
""
Description: Bucket Name for Tempo examples: “tempo-traces”
packages.tempo.objectStorage.insecure¶
Type: bool
false
Description: Whether or not objectStorage connection should require HTTPS, if connecting to in-cluster object storage on port 80/9000 set this value to true.
packages.tempo.metricsGenerator¶
Type: object
enabled: false
Description: Whether or not to enable Tempo’s internal metrics generator, the monitoring package will also be be required for this integration.
packages.tempo.values¶
Type: object
{}
Description: Values to passthrough to the Tempo chart: https://repo1.dso.mil/big-bang/product/packages/tempo.git
packages.tempo.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.prometheusOperatorCRDs¶
Type: object
enabled: true
flux:
driftDetection:
mode: warn
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/prometheus-operator-crds.git
tag: 32.0.1-bb.0
helmRepo:
chartName: prometheus-operator-crds
repoName: registry1
tag: 32.0.1-bb.0
postRenderers: []
sourceType: git
values: {}
Description: Prometheus Operator CRDs package configuration.
packages.prometheusOperatorCRDs.enabled¶
Type: bool
true
Description: Toggle deployment of Monitoring/Prometheus Operator CRDs (ServiceMonitor, PodMonitor, AlertManager, ScrapeConfigs etc..)
packages.prometheusOperatorCRDs.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.prometheusOperatorCRDs.values¶
Type: object
{}
Description: Values to passthrough to the Prometheus Operator CRDs chart
packages.prometheusOperatorCRDs.flux¶
Type: object
driftDetection:
mode: warn
Description: Flux reconciliation overrides specifically for the Prometheus Operator CRDs Package
packages.prometheusOperatorCRDs.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.monitoring.enabled¶
Type: bool
true
Description: Toggle deployment of Monitoring (Prometheus, Grafana, and Alertmanager).
packages.monitoring.prometheusMetrics¶
Type: object
enabled: true
Description: Toggle Prometheus metrics scraping. Set to false when using alloy-metrics as the scraper.
packages.monitoring.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.monitoring.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Alertmanager
- paths:
- ''
target:
kind: Prometheus
- paths:
- ''
target:
kind: PrometheusRule
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
Description: Flux reconciliation overrides specifically for the Monitoring Package
packages.monitoring.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.monitoring.sso.enabled¶
Type: bool
false
Description: Toggle SSO for monitoring components on and off
packages.monitoring.sso.prometheus.client_id¶
Type: string
""
Description: Prometheus OIDC client ID
packages.monitoring.sso.prometheus.client_secret¶
Type: string
""
Description: Prometheus OIDC client secret
packages.monitoring.sso.alertmanager.client_id¶
Type: string
""
Description: Alertmanager OIDC client ID
packages.monitoring.sso.alertmanager.client_secret¶
Type: string
""
Description: Alertmanager OIDC client secret
packages.monitoring.values¶
Type: object
{}
Description: Values to passthrough to the monitoring chart: https://repo1.dso.mil/big-bang/product/packages/monitoring.git
packages.monitoring.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.grafana¶
Type: object
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/grafana.git
tag: 13.2.4-bb.1
helmRepo:
chartName: grafana
repoName: registry1
tag: 13.2.4-bb.1
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
enabled: false
grafana:
allow_sign_up: true
client_id: ''
client_secret: ''
role_attribute_path: Viewer
scopes: ''
values: {}
Description: Grafana package configuration.
packages.grafana.enabled¶
Type: bool
true
Description: Toggle deployment of Grafana
packages.grafana.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.grafana.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Grafana Package
packages.grafana.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.grafana.sso.enabled¶
Type: bool
false
Description: Toggle SSO for grafana components on and off
packages.grafana.sso.grafana.client_id¶
Type: string
""
Description: Grafana OIDC client ID
packages.grafana.sso.grafana.client_secret¶
Type: string
""
Description: Grafana OIDC client secret
packages.grafana.sso.grafana.scopes¶
Type: string
""
Description: Grafana OIDC client scopes, comma separated, see https://grafana.com/docs/grafana/latest/auth/generic-oauth/
packages.grafana.values¶
Type: object
{}
Description: Values to passthrough to the grafana chart: https://repo1.dso.mil/big-bang/product/packages/grafana.git
packages.grafana.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.twistlock¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/twistlock.git
tag: 0.31.0-bb.1
helmRepo:
chartName: twistlock
repoName: registry1
tag: 0.31.0-bb.1
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
enabled: false
groups: ''
provider_type: shibboleth
values: {}
Description: Twistlock package configuration.
packages.twistlock.enabled¶
Type: bool
false
Description: Toggle deployment of Twistlock.
packages.twistlock.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.twistlock.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Twistlock Package
packages.twistlock.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.twistlock.sso.enabled¶
Type: bool
false
Description: Toggle SAML SSO, requires a license and enabling the init job - see https://repo1.dso.mil/big-bang/product/packages/initialization.md
packages.twistlock.sso.client_id¶
Type: string
""
Description: SAML client ID
packages.twistlock.sso.provider_type¶
Type: string
"shibboleth"
Description: SAML Identity Provider. shibboleth is recommended by Twistlock support for Keycloak Possible values: okta, gsuite, ping, shibboleth, azure, adfs
packages.twistlock.sso.groups¶
Type: string
""
Description: Groups attribute (optional)
packages.twistlock.values¶
Type: object
{}
Description: Values to passthrough to the twistlock chart: https://repo1.dso.mil/big-bang/product/packages/twistlock.git
packages.twistlock.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.renovate.enabled¶
Type: bool
false
Description: Toggle deployment of Renovate
packages.renovate.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.renovate.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Renovate Package
packages.renovate.values¶
Type: object
{}
Description: Values to passthrough to the Renovate chart: https://repo1.dso.mil/big-bang/product/packages/renovate.git
packages.renovate.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.certManager¶
Type: object
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/cert-manager.git
tag: v1.20.3-bb.2
helmRepo:
chartName: cert-manager
repoName: registry1
tag: v1.20.3-bb.2
namespace:
create: true
labels:
istio.io/dataplane-mode: none
name: cert-manager
postRenderers: []
sourceType: git
values:
issuers:
letsEncrypt:
enabled: false
selfSigned:
enabled: false
upstream:
crds:
enabled: true
Description: cert-manager package configuration.
packages.certManager.enabled¶
Type: bool
true
Description: Toggle deployment of cert-manager
packages.certManager.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.certManager.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for cert-manager
packages.certManager.values¶
Type: object
issuers:
letsEncrypt:
enabled: false
selfSigned:
enabled: false
upstream:
crds:
enabled: true
Description: Values to pass through to the cert-manager chart
packages.certManager.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.argocd.enabled¶
Type: bool
false
Description: Toggle deployment of ArgoCD.
packages.argocd.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.argocd.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the ArgoCD Package
packages.argocd.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.argocd.redis.host¶
Type: string
""
Description: Hostname of a pre-existing Redis to use for ArgoCD. Entering connection info will enable external Redis and will auto-create any required secrets.
packages.argocd.redis.port¶
Type: string
""
Description: Port of a pre-existing Redis to use for ArgoCD.
packages.argocd.sso.enabled¶
Type: bool
false
Description: Toggle SSO for ArgoCD on and off
packages.argocd.sso.client_id¶
Type: string
""
Description: ArgoCD OIDC client ID
packages.argocd.sso.client_secret¶
Type: string
""
Description: ArgoCD OIDC client secret
packages.argocd.sso.groups¶
Type: string
"g, Impact Level 2 Authorized, role:admin\n"
Description: ArgoCD SSO group roles, see docs for more details: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/
packages.argocd.values¶
Type: object
{}
Description: Values to passthrough to the argocd chart: https://repo1.dso.mil/big-bang/product/packages/argocd.git
packages.argocd.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.authservice.enabled¶
Type: bool
false
Description: Toggle deployment of Authservice. if enabling authservice, a filter needs to be provided by either enabling sso for monitoring or tempo, or manually adding a filter chain in the values here: .Values.packages.authservice.chains.minimal.callback_uri="https://somecallback"
packages.authservice.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.authservice.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Authservice Package
packages.authservice.values¶
Type: object
{}
Description: Values to passthrough to the authservice chart: https://repo1.dso.mil/big-bang/product/packages/authservice.git
packages.authservice.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.authservice.chains¶
Type: object
{}
Description: Additional authservice chain configurations.
packages.minioOperator¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/minio-operator.git
tag: 7.1.1-bb.13
helmRepo:
chartName: minio-operator
repoName: registry1
tag: 7.1.1-bb.13
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
Description: MinIO Operator package configuration.
packages.minioOperator.enabled¶
Type: bool
false
Description: Toggle deployment of minio operator and instance.
packages.minioOperator.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.minioOperator.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Minio Operator Package
packages.minioOperator.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.minioOperator.values¶
Type: object
{}
Description: Values to passthrough to the minio operator chart: https://repo1.dso.mil/big-bang/product/packages/minio-operator.git
packages.minioOperator.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.minio.enabled¶
Type: bool
false
Description: Toggle deployment of minio.
packages.minio.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.minio.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Minio Package
packages.minio.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.minio.accesskey¶
Type: string
""
Description: Default access key to use for minio.
packages.minio.secretkey¶
Type: string
""
Description: Default secret key to instantiate with minio, you should change/delete this after installation.
packages.minio.values¶
Type: object
{}
Description: Values to passthrough to the minio instance chart: https://repo1.dso.mil/big-bang/product/packages/minio.git
packages.minio.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.gitlab.enabled¶
Type: bool
false
Description: Toggle deployment of Gitlab
packages.gitlab.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.gitlab.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Gitlab Package
packages.gitlab.dependsOn¶
Type: string
nil
Description: Appends dependencies to BB’s generated HelmRelease defaults (gatekeeper, istio, kyverno-policies, monitoring where applicable). Use this when GitLab depends on a Helm release not in BB’s defaults, such as cloudnative-pg. Mutually exclusive with dependsOnOverride.
packages.gitlab.dependsOnOverride¶
Type: string
nil
Description: Replaces ALL Flux HelmRelease dependencies; BB-generated defaults are dropped. Set to [] to clear all dependencies. Mutually exclusive with dependsOn. Only applies to HelmRelease, not Kustomization. See https://fluxcd.io/flux/components/helm/helmreleases/#helmrelease-dependencies
packages.gitlab.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.gitlab.sso.enabled¶
Type: bool
false
Description: Toggle OIDC SSO for Gitlab on and off. Enabling this option will auto-create any required secrets.
packages.gitlab.sso.client_id¶
Type: string
""
Description: Gitlab OIDC client ID
packages.gitlab.sso.client_secret¶
Type: string
""
Description: Gitlab OIDC client secret
packages.gitlab.sso.scopes¶
Type: list
- Gitlab
Description: Gitlab SSO Scopes, default is [“Gitlab”]
packages.gitlab.sso.groups¶
Type: list
[]
Description: Fill out the groups block below and populate with Keycloak groups according to your desired Gitlab membership requirements. The default groupsAttribute is “groups”. Full documentation: https://docs.gitlab.com/ee/administration/auth/oidc.html?tab=Linux+package+%28Omnibus%29#configure-users-based-on-oidc-group-membership
packages.gitlab.database.host¶
Type: string
""
Description: Hostname of a pre-existing PostgreSQL database to use for Gitlab. Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.
packages.gitlab.database.port¶
Type: int
5432
Description: Port of a pre-existing PostgreSQL database to use for Gitlab.
packages.gitlab.database.database¶
Type: string
""
Description: Database name to connect to on host.
packages.gitlab.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
packages.gitlab.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
packages.gitlab.objectStorage.type¶
Type: string
""
Description: Type of object storage to use for Gitlab, setting to s3 will assume an external, pre-existing object storage is to be used. Entering connection info will enable this option and will auto-create any required secrets
packages.gitlab.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. GitLab 19 requires the URI scheme for non-AWS S3-compatible endpoints. examples: “https://s3.amazonaws.com” “https://s3.us-gov-west-1.amazonaws.com” “http://minio.minio.svc.cluster.local:9000”
packages.gitlab.objectStorage.regionendpoint¶
Type: string
""
Description: S3 compatible service endpoint for use with Minio or aws S3. The value must include an http:// or https:// URI scheme. See: https://gitlab.com/gitlab-org/charts/gitlab/-/tree/master/examples/objectstorage Setting this allows the registry to use a different endpoint than the global objectStorage.endpoint documented above. objectStorage.endpoint must be set in order for objectStorage.regionendpoint endpoint to be used. See: https://docs.gitlab.com/administration/object_storage/ Also note rails.s3.yaml and registry.s3.yaml here for implementation parallel: https://gitlab.com/gitlab-org/charts/gitlab/-/tree/master/examples/objectstorage examples: "https://s3.us-gov-west-1.amazonaws.com" "https://minio.example.com:9000"
packages.gitlab.objectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
packages.gitlab.objectStorage.accessKey¶
Type: string
""
Description: If using accessKey and accessSecret, the iamProfile must be left as an empty string: “”
packages.gitlab.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
packages.gitlab.objectStorage.bucketPrefix¶
Type: string
""
Description: Bucket prefix to use for identifying buckets. Example: “prod” will produce “prod-gitlab-bucket”
packages.gitlab.objectStorage.iamProfile¶
Type: string
""
Description: If using an AWS IAM profile, the accessKey and accessSecret values must be left as empty strings eg: “”
packages.gitlab.smtp.password¶
Type: string
""
Description: Passwords should be placed in an encrypted file. Example: environment-bb-secret.enc.yaml If a value is provided BigBang will create a k8s secret named gitlab-smtp-password in the gitlab namespace
packages.gitlab.redis.password¶
Type: string
""
Description: Plain text password for an externally managed Redis or Valkey service. When set, Big Bang creates gitlab-redis-secret-bb and configures GitLab to use it. Configure the external endpoint with packages.gitlab.values.global.redis.host or packages.gitlab.values.global.redis.redisYmlOverride. Leave this empty only when authentication is disabled or supplied entirely through passthrough values. A non-empty value is also required for the Grafana Redis datasource and dashboards.
packages.gitlab.railsSecret¶
Type: string
""
Description: Rails plain text secret to define. If empty (“”), the gitlab charts will create the gitlab-rails-secret with randomized data. Read the following for more information on setting Gitlab rails secrets: https://docs.gitlab.com/charts/installation/secrets#gitlab-rails-secret
packages.gitlab.values¶
Type: object
{}
Description: Values to passthrough to the gitlab chart: https://repo1.dso.mil/big-bang/product/packages/gitlab.git
packages.gitlab.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.gitlabRunner.enabled¶
Type: bool
false
Description: Toggle deployment of Gitlab Runner
packages.gitlabRunner.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.gitlabRunner.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Gitlab Runner Package
packages.gitlabRunner.autoRegister¶
Type: object
enabled: true
Description: Automatically register the runner when GitLab and Kyverno are enabled.
packages.gitlabRunner.values¶
Type: object
{}
Description: Values to passthrough to the gitlab runner chart: https://repo1.dso.mil/big-bang/product/packages/gitlab-runner.git
packages.gitlabRunner.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.sonarqube.enabled¶
Type: bool
false
Description: Toggle deployment of SonarQube.
packages.sonarqube.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.sonarqube.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Sonarqube Package
packages.sonarqube.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.sonarqube.sso.enabled¶
Type: bool
false
Description: Toggle SAML SSO for SonarQube. Enabling this option will auto-create any required secrets.
packages.sonarqube.sso.client_id¶
Type: string
""
Description: SonarQube SAML client ID
packages.sonarqube.sso.login¶
Type: string
"login"
Description: SonarQube login sso attribute.
packages.sonarqube.sso.name¶
Type: string
"name"
Description: SonarQube name sso attribute.
packages.sonarqube.sso.email¶
Type: string
"email"
Description: SonarQube email sso attribute.
packages.sonarqube.sso.group¶
Type: optional
"group"
Description: SonarQube group sso attribute.
packages.sonarqube.database.host¶
Type: string
""
Description: Hostname of a pre-existing PostgreSQL database to use for SonarQube.
packages.sonarqube.database.port¶
Type: int
5432
Description: Port of a pre-existing PostgreSQL database to use for SonarQube.
packages.sonarqube.database.database¶
Type: string
""
Description: Database name to connect to on host.
packages.sonarqube.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
packages.sonarqube.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
packages.sonarqube.values¶
Type: object
{}
Description: Values to passthrough to the sonarqube chart: https://repo1.dso.mil/big-bang/product/packages/sonarqube.git
packages.sonarqube.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.fortify.enabled¶
Type: bool
false
Description: Toggle deployment of Fortify.
packages.fortify.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.fortify.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Fortify Package
packages.fortify.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.fortify.externalDatabase.host¶
Type: string
""
Description: External MySQL host used to generate Fortify’s outbound bb-common route/ServiceEntry when values.mysql.enabled=false. This should match the hostname used in values.fortify_autoconfig .
packages.fortify.externalDatabase.port¶
Type: int
3306
Description: External MySQL port used to generate Fortify’s outbound bb-common route/ServiceEntry when values.mysql.enabled=false. This should match the port used in values.fortify_autoconfig.
packages.fortify.values¶
Type: object
{}
Description: Values to passthrough to the fortify chart: https://repo1.dso.mil/big-bang/product/packages/fortify.git
packages.fortify.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.anchoreEnterprise.enabled¶
Type: bool
false
Description: Toggle deployment of Anchore.
packages.anchoreEnterprise.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.anchoreEnterprise.flux¶
Type: object
upgrade:
disableWait: true
Description: Flux reconciliation overrides specifically for the Anchore Package
packages.anchoreEnterprise.adminPassword¶
Type: string
""
Description: Initial admin password used to authenticate to Anchore.
packages.anchoreEnterprise.enterprise¶
Type: object
licenseYaml: 'FULL LICENSE
'
Description: Anchore Enterprise functionality.
packages.anchoreEnterprise.enterprise.licenseYaml¶
Type: string
"FULL LICENSE\n"
Description: License for Anchore Enterprise. Enterprise is the only option available for the chart starting with chart major version 2.X. For formatting examples see https://repo1.dso.mil/big-bang/product/packages/CHART.md#enabling-enterprise-services
packages.anchoreEnterprise.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.anchoreEnterprise.sso.enabled¶
Type: bool
false
Description: Toggle SAML SSO for Anchore on and off. Enabling this option will auto-create any required secrets (Note: SSO requires an Enterprise license).
packages.anchoreEnterprise.sso.client_id¶
Type: string
""
Description: Anchore SAML client ID
packages.anchoreEnterprise.sso.role_attribute¶
Type: string
""
Description: Anchore SAML client role attribute
packages.anchoreEnterprise.database.host¶
Type: string
""
Description: Hostname of a pre-existing PostgreSQL database to use for Anchore. Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.
packages.anchoreEnterprise.database.port¶
Type: string
""
Description: Port of a pre-existing PostgreSQL database to use for Anchore.
packages.anchoreEnterprise.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
packages.anchoreEnterprise.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
packages.anchoreEnterprise.database.database¶
Type: string
""
Description: Database name to connect to on host (Note: database name CANNOT contain hyphens).
packages.anchoreEnterprise.redis.host¶
Type: string
""
Description: Hostname of a pre-existing Redis to use for Anchore Enterprise. Entering connection info will enable external redis and will auto-create any required secrets. Anchore only requires redis for enterprise deployments and will not provision an instance if using external
packages.anchoreEnterprise.redis.port¶
Type: string
""
Description: Port of a pre-existing Redis to use for Anchore Enterprise.
packages.anchoreEnterprise.redis.username¶
Type: string
""
Description: OPTIONAL: Username to connect to a pre-existing Redis (for password-only auth leave empty)
packages.anchoreEnterprise.redis.password¶
Type: string
""
Description: Password to connect to pre-existing Redis.
packages.anchoreEnterprise.values¶
Type: object
{}
Description: Values to passthrough to the anchore chart: https://repo1.dso.mil/big-bang/product/packages/anchore-enterprise.git
packages.anchoreEnterprise.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.mattermostOperator¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/mattermost-operator.git
tag: 1.25.9-bb.2
helmRepo:
chartName: mattermost-operator
repoName: registry1
tag: 1.25.9-bb.2
postRenderers: []
sourceType: git
values: {}
Description: Mattermost Operator package configuration.
packages.mattermostOperator.enabled¶
Type: bool
false
Description: Toggle deployment of Mattermost Operator.
packages.mattermostOperator.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.mattermostOperator.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Mattermost Operator Package
packages.mattermostOperator.values¶
Type: object
{}
Description: Values to passthrough to the mattermost operator chart: https://repo1.dso.mil/big-bang/product/packages/mattermost-operator.git
packages.mattermostOperator.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.mattermost.enabled¶
Type: bool
false
Description: Toggle deployment of Mattermost.
packages.mattermost.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.mattermost.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Mattermost
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Mattermost Package
packages.mattermost.enterprise¶
Type: object
enabled: false
existingSecret: ''
license: ''
Description: Mattermost Enterprise functionality.
packages.mattermost.enterprise.enabled¶
Type: bool
false
Description: Toggle the Mattermost Enterprise. This must be accompanied by a valid license input via Helm values OR an existing secret name for Mattermost to reference.
packages.mattermost.enterprise.license¶
Type: string
""
Description: License for Mattermost. This should be the entire contents of the license file from Mattermost (should be one line), example below license: “eyJpZCI6InIxM205bjR3eTdkYjludG95Z3RiOD—REST—IS—HIDDEN
packages.mattermost.enterprise.existingSecret¶
Type: string
""
Description: Pre existing secret created outside of Helm values with license for Mattermost.
packages.mattermost.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.mattermost.sso.enabled¶
Type: bool
false
Description: Toggle OIDC SSO for Mattermost on and off. Enabling this option will auto-create any required secrets.
packages.mattermost.sso.client_id¶
Type: string
""
Description: Mattermost OIDC client ID
packages.mattermost.sso.client_secret¶
Type: string
""
Description: Mattermost OIDC client secret
packages.mattermost.database.host¶
Type: string
""
Description: Hostname of a pre-existing PostgreSQL database to use for Mattermost. Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.
packages.mattermost.database.port¶
Type: string
""
Description: Port of a pre-existing PostgreSQL database to use for Mattermost.
packages.mattermost.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
packages.mattermost.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
packages.mattermost.database.database¶
Type: string
""
Description: Database name to connect to on host.
packages.mattermost.database.ssl_mode¶
Type: string
""
Description: SSL Mode to use when connecting to the database. Allowable values for this are viewable in the postgres documentation: https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-SSLMODE-STATEMENTS
packages.mattermost.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. Entering connection info will enable this option and will auto-create any required secrets. examples: “s3.amazonaws.com” “s3.us-gov-west-1.amazonaws.com” “minio.minio.svc.cluster.local:9000”
packages.mattermost.objectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint.
packages.mattermost.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
packages.mattermost.objectStorage.bucket¶
Type: string
""
Description: Bucket name to use for Mattermost - will be auto-created.
packages.mattermost.elasticsearch¶
Type: object
enabled: false
Description: Mattermost Elasticsearch integration - requires enterprise E20 license - https://docs.mattermost.com/administration-guide/configure/environment-configuration-settings Connection info defaults to the BB deployed Elastic, all values can be overridden via the “values” passthrough for other connections. See values spec in MM chart “elasticsearch” yaml block - https://repo1.dso.mil/big-bang/product/packages/mattermost.git
packages.mattermost.elasticsearch.enabled¶
Type: bool
false
Description: Toggle interaction with Elastic for optimized search indexing
packages.mattermost.values¶
Type: object
{}
Description: Values to passthrough to the Mattermost chart: https://repo1.dso.mil/big-bang/product/packages/mattermost.git
packages.mattermost.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.velero.enabled¶
Type: bool
false
Description: Toggle deployment of Velero.
packages.velero.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.velero.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Velero Package
packages.velero.values¶
Type: object
{}
Description: Values to passthrough to the Velero chart: https://repo1.dso.mil/big-bang/product/packages/velero.git
packages.velero.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.keycloak¶
Type: object
database:
database: ''
host: ''
password: ''
port: 5432
type: postgres
username: ''
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/keycloak.git
tag: 7.3.2-bb.2
helmRepo:
chartName: keycloak
repoName: registry1
tag: 7.3.2-bb.2
ingress:
cert: ''
gateway: ''
key: ''
postRenderers: []
sourceType: git
values: {}
Description: Keycloak package configuration.
packages.keycloak.enabled¶
Type: bool
false
Description: Toggle deployment of Keycloak.
packages.keycloak.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.keycloak.database.host¶
Type: string
""
Description: Hostname of a pre-existing database to use for Keycloak. Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.
packages.keycloak.database.type¶
Type: string
"postgres"
Description: Pre-existing database type (e.g. postgres) to use for Keycloak.
packages.keycloak.database.port¶
Type: int
5432
Description: Port of a pre-existing database to use for Keycloak.
packages.keycloak.database.database¶
Type: string
""
Description: Database name to connect to on host.
packages.keycloak.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
packages.keycloak.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
packages.keycloak.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Keycloak Package
packages.keycloak.ingress¶
Type: object
cert: ''
gateway: ''
key: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.keycloak.ingress.key¶
Type: string
""
Description: Certificate/Key pair to use as the certificate for exposing Keycloak Setting the ingress cert here will automatically create the volume and volumemounts in the Keycloak Package chart Leave the values blank to set keycloak to use a TLS terminated gateway; otherwise, it will use a passthrough gateway and terminate TLS directly on the keycloak workload
packages.keycloak.values¶
Type: object
{}
Description: Values to passthrough to the keycloak chart: https://repo1.dso.mil/big-bang/product/packages/keycloak.git; WARNING: The upstream keycloak chart has some limitations on certain keys due to its templating architecture. Some of the offending keys are extraEnvFrom, extraVolumeMounts, and extraVolumes. These keys are set as strings when installing the chart, so subsequent overrides aren’t merged with existing values: they simply replace them. This means that if you set any of these keys in your overrides, you must include all the existing values you wish to keep from Big Bang’s overrides in addition to your own.
packages.keycloak.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.vault¶
Type: object
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: MutatingWebhookConfiguration
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/vault.git
tag: 0.34.1-bb.5
helmRepo:
chartName: vault
repoName: registry1
tag: 0.34.1-bb.5
ingress:
cert: ''
gateway: ''
key: ''
postRenderers: []
sourceType: git
values: {}
Description: Vault package configuration.
packages.vault.enabled¶
Type: bool
false
Description: Toggle deployment of Vault.
packages.vault.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.vault.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: MutatingWebhookConfiguration
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Vault Package
packages.vault.ingress¶
Type: object
cert: ''
gateway: ''
key: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.vault.ingress.key¶
Type: string
""
Description: Certificate/Key pair to use as the certificate for exposing Vault Setting the ingress cert here will automatically create the volume and volumemounts in the Vault package chart
packages.vault.values¶
Type: object
{}
Description: Values to passthrough to the vault chart: https://repo1.dso.mil/big-bang/product/packages/vault.git
packages.vault.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.metricsServer¶
Type: object
automountServiceAccountToken: true
enabled: auto
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/metrics-server.git
tag: 3.14.0-bb.1
helmRepo:
chartName: metrics-server
repoName: registry1
tag: 3.14.0-bb.1
namespace:
annotations: {}
create: false
labels: {}
name: kube-system
postRenderers: []
sourceType: git
values: {}
Description: Metrics Server package configuration.
packages.metricsServer.enabled¶
Type: string
"auto"
Description: Toggle deployment of metrics server Acceptable options are enabled: true, enabled: false, enabled: auto true = enabled / false = disabled / auto = automatic (Installs only if metrics API endpoint is not present)
packages.metricsServer.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.metricsServer.automountServiceAccountToken¶
Type: bool
true
Description: Enabled automount Service Account Token so that metrics-server fetches resource metrics from the kubelets
packages.metricsServer.namespace¶
Type: object
annotations: {}
create: false
labels: {}
name: kube-system
Description: Namespace settings for metrics-server. The default target namespace is kube-system; set namespace.name and namespace.create=true to deploy to and create a custom namespace.
packages.metricsServer.namespace.name¶
Type: string
"kube-system"
Description: Namespace to deploy metrics-server resources to.
packages.metricsServer.namespace.create¶
Type: bool
false
Description: Create the target namespace. Keep false when using an existing namespace such as kube-system.
packages.metricsServer.namespace.labels¶
Type: object
{}
Description: Labels to add to or override on the created namespace when namespace.create=true.
packages.metricsServer.namespace.annotations¶
Type: object
{}
Description: Annotations to add to the created namespace when namespace.create=true.
packages.metricsServer.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the metrics server Package
packages.metricsServer.values¶
Type: object
{}
Description: Values to passthrough to the metrics server chart: https://repo1.dso.mil/big-bang/product/packages/metrics-server.git
packages.metricsServer.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.harbor¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/harbor.git
tag: 1.19.2-bb.4
helmRepo:
chartName: harbor
repoName: registry1
tag: 1.19.2-bb.4
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
Description: Harbor package configuration.
packages.harbor.enabled¶
Type: bool
false
Description: Toggle deployment of harbor
packages.harbor.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.harbor.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Harbor Package
packages.harbor.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.harbor.values¶
Type: object
{}
Description: Values to pass through to Harbor chart: https://repo1.dso.mil/big-bang/product/packages/harbor.git
packages.harbor.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
packages.thanos¶
Type: object
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/thanos.git
tag: 17.6.0-bb.4
helmRepo:
chartName: thanos
repoName: registry1
tag: 17.6.0-bb.4
ingress:
gateway: ''
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
insecure: false
region: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
Description: Thanos package configuration.
packages.thanos.enabled¶
Type: bool
false
Description: Toggle deployment of thanos
packages.thanos.sso.enabled¶
Type: bool
false
Description: Toggle SSO for Thanos on and off
packages.thanos.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for Thanos
packages.thanos.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for Thanos
packages.thanos.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. examples: “s3.amazonaws.com” “s3.us-gov-west-1.amazonaws.com” “minio.minio.svc.cluster.local:9000” Note: Thanos does not require protocol prefix for URL.
packages.thanos.objectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
packages.thanos.objectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint.
packages.thanos.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
packages.thanos.objectStorage.bucket¶
Type: string
""
Description: Bucket Name for Thanos examples: “Thanos-metrics”
packages.thanos.objectStorage.insecure¶
Type: bool
false
Description: Whether or not objectStorage connection should require HTTPS, if connecting to in-cluster object
packages.thanos.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.thanos.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Thanos Package
packages.thanos.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.externalSecrets.enabled¶
Type: bool
false
Description: Toggle deployment of external secrets
packages.externalSecrets.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.externalSecrets.flux¶
Type: object
{}
Description: Override flux settings for this package
packages.externalSecrets.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.mimir.enabled¶
Type: bool
false
Description: Toggle deployment of Mimir
packages.mimir.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.mimir.enterprise¶
Type: object
enabled: false
Description: Enable Mimir Enterprise
packages.mimir.s3ObjectStorage¶
Type: object
accessKey: ''
accessSecret: ''
bucketName: ''
enabled: false
endpoint: ''
insecure: false
region: ''
Description: Configure Mimir to use S3 bucket
packages.mimir.s3ObjectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
packages.mimir.s3ObjectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint. If using IRSA annotation this should be left blank.
packages.mimir.s3ObjectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. If using IRSA annotation this should be left blank. Unencoded string data. This should be placed in the secret values and then encrypted
packages.mimir.s3ObjectStorage.bucketName¶
Type: string
""
Description: Bucket name for the Mimir bucket.
packages.mimir.s3ObjectStorage.insecure¶
Type: bool
false
Description: Whether or not objectStorage connection should require HTTPS, if connecting to in-cluster object
packages.mimir.kafkaIngestStorage¶
Type: object
brokerClusterDomain: ''
brokerHost: ''
brokerNetworkCIDR: ''
brokerPort: 9092
enabled: false
topic: mimir-ingest
Description: Configure Mimir to use external Kafka for ingest storage (Mimir 6.x+) When enabled, disables the classic gRPC push path and enables the Kafka-backed ingest storage path. For production, use a cloud-managed Kafka service (Amazon MSK, Confluent Cloud, Azure Event Hubs). The bundled kafka-native image in the mimir chart is for testing only and is not used here.
packages.mimir.kafkaIngestStorage.brokerHost¶
Type: string
""
Description: Kafka broker hostname (bootstrap broker). Examples: “b-1.cluster.kafka.us-east-1.amazonaws.com” (Amazon MSK), “pkc-xxxxx.us-east-1.aws.confluent.cloud” (Confluent Cloud)
packages.mimir.kafkaIngestStorage.brokerPort¶
Type: int
9092
Description: Kafka broker port. Use 9092 for plaintext, 9093 for TLS. For auth (SASL, IAM) or TLS client config, use values.upstream.mimir.structuredConfig.ingest_storage.kafka directly.
packages.mimir.kafkaIngestStorage.topic¶
Type: string
"mimir-ingest"
Description: Kafka topic name for Mimir ingest storage.
packages.mimir.kafkaIngestStorage.brokerNetworkCIDR¶
Type: string
""
Description: CIDR block of the network where Kafka brokers reside. When empty (default), no Kafka egress NetworkPolicy is rendered. When set, renders a scoped NetworkPolicy egress rule for distributor and ingester pods. Examples: “172.31.0.0/16” (MSK in a specific VPC), “10.0.0.0/8” (private cloud)
packages.mimir.kafkaIngestStorage.brokerClusterDomain¶
Type: string
""
Description: Cluster domain covering all Kafka brokers (builds a wildcard Istio ServiceEntry). Required when Istio REGISTRY_ONLY is enabled: MSK/Kafka redirects clients to multiple broker addresses after bootstrap, all of which must be registered. Strip the “b-N.” prefix from any broker FQDN to get this value. Example: “mimir-kafka-test.
packages.mimir.serviceAccountAnnotations¶
Type: object
{}
Description: Mimir Service Account Annotations
packages.mimir.dependsOn¶
Type: string
nil
Description: Appends dependencies to BB’s generated HelmRelease defaults (istio, kyverno-policies where applicable). Use this when Mimir depends on a Helm release not in BB’s defaults, such as garage. Mutually exclusive with dependsOnOverride.
packages.mimir.dependsOnOverride¶
Type: string
nil
Description: Replaces ALL Flux HelmRelease dependencies; BB-generated defaults are dropped. Set to [] to clear all dependencies. Mutually exclusive with dependsOn. Only applies to HelmRelease, not Kustomization. See https://fluxcd.io/flux/components/helm/helmreleases/#helmrelease-dependencies
packages.mimir.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Mimir Package
packages.headlamp¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/headlamp.git
tag: 0.46.0-bb.0
helmRepo:
chartName: headlamp
repoName: registry1
tag: 0.46.0-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
Description: Headlamp package configuration.
packages.headlamp.enabled¶
Type: bool
false
Description: Toggle deployment of headlamp
packages.headlamp.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.headlamp.flux¶
Type: object
{}
Description: Override flux settings for this package
packages.headlamp.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
packages.headlamp.sso.enabled¶
Type: bool
false
Description: Toggle OIDC SSO for Headlamp on and off. Enabling this option will auto-create any required secrets.
packages.headlamp.sso.client_id¶
Type: string
""
Description: Headlamp OIDC client ID
packages.headlamp.sso.client_secret¶
Type: string
""
Description: Headlamp OIDC client secret
packages.sample¶
Type: object
bbCommonValues: true
configMaps: {}
dependsOn: null
dependsOnOverride: null
enabled: false
flux: {}
git:
branch: null
commit: null
credentials:
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
existingSecret: ''
path: null
repo: null
semver: null
tag: null
helmRepo:
chartName: null
repoName: null
tag: null
includeDefaultDependsOn: true
istio: {}
kustomize: false
monitor: {}
namespace: {}
network: {}
passBigBangValues: false
postRenderers: []
secrets: {}
sourceType: git
values: {}
wrapper:
enabled: false
postRenderers: []
Description: Package name. Each package will be independently wrapped for Big Bang integration.
packages.sample.namespace¶
Type: object
{}
Description: Namespace settings for this package. Use namespace.labels to add custom labels or override labels rendered by Big Bang for this package namespace.
packages.sample.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.sample.wrapper.postRenderers¶
Type: list
[]
Description: After deployment, patch wrapper resources. More info
packages.sample.kustomize¶
Type: bool
false
Description: Use a kustomize deployment rather than Helm
packages.sample.helmRepo¶
Type: object
chartName: null
repoName: null
tag: null
Description: HelmRepo source is supported as an option for Helm deployments and is selected with sourceType: helmRepo.
packages.sample.helmRepo.tag¶
Type: string
nil
Description: Tag of the chart in the Helm repo, required
packages.sample.git¶
Type: object
branch: null
commit: null
credentials:
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
existingSecret: ''
path: null
repo: null
semver: null
tag: null
Description: Git source is supported for both Helm and Kustomize deployments and is selected with sourceType: git.
packages.sample.git.repo¶
Type: string
nil
Description: Git repo URL holding the helm chart for this package, required if using git
packages.sample.git.commit¶
Type: string
nil
Description: Git commit to check out. Takes precedence over semver, tag, and branch. More info
packages.sample.git.semver¶
Type: string
nil
Description: Git semVer tag expression to check out. Takes precedence over tag. More info
packages.sample.git.tag¶
Type: string
nil
Description: Git tag to check out. Takes precedence over branch. More info
packages.sample.git.existingSecret¶
Type: string
""
Description: Optional, alternative existing secret to use for git credentials, must be in the appropriate format: https://toolkit.fluxcd.io/components/source/gitrepositories/#https-authentication
packages.sample.git.credentials¶
Type: object
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
Description: Optional, alternative Chart created secrets with user defined values
packages.sample.git.credentials.username¶
Type: string
""
Description: HTTP git credentials, both username and password must be provided
packages.sample.git.credentials.caFile¶
Type: string
""
Description: HTTPS certificate authority file. Required for any repo with a self signed certificate
packages.sample.git.credentials.privateKey¶
Type: string
""
Description: SSH git credentials, privateKey, publicKey, and knownHosts must be provided
packages.sample.flux¶
Type: object
{}
Description: Override flux settings for this package
packages.sample.postRenderers¶
Type: list
[]
Description: After deployment, patch package resources. More info
packages.sample.dependsOn¶
Type: string
nil
Description: Appends dependencies to BB’s generated HelmRelease defaults (gatekeeper, kyverno-policies, istio where applicable). Mutually exclusive with dependsOnOverride.
packages.sample.dependsOnOverride¶
Type: string
nil
Description: Replaces ALL Flux HelmRelease dependencies; BB-generated defaults are dropped. Set to [] to clear all dependencies. Mutually exclusive with dependsOn. Only applies to HelmRelease, not Kustomization. See https://fluxcd.io/flux/components/helm/helmreleases/#helmrelease-dependencies
packages.sample.includeDefaultDependsOn¶
Type: bool
true
Description: Include default Big Bang package HelmRelease dependencies (gatekeeper, kyverno-policies, istio where applicable).
packages.sample.istio¶
Type: object
{}
Description: Package details for Istio. See wrapper values for settings.
packages.sample.monitor¶
Type: object
{}
Description: Package details for monitoring. See wrapper values for settings.
packages.sample.network¶
Type: object
{}
Description: Package details for network policies. See wrapper values for settings.
packages.sample.secrets¶
Type: object
{}
Description: Secrets that should be created prior to package installation. See wrapper values for settings.
packages.sample.configMaps¶
Type: object
{}
Description: ConfigMaps that should be created prior to package installation. See wrapper values for settings.
packages.sample.values¶
Type: object
{}
Description: Values to pass through to package Helm chart