Big Bang values.yaml¶
domain¶
Type: string
"dev.bigbang.mil"
Description: Domain used for BigBang created exposed services, can be overridden by individual packages.
istio¶
Type: object
ambient:
enabled: false
Description: Global Istio settings
istio.ambient¶
Type: object
enabled: false
Description: Ambient mesh mode configuration
istio.ambient.enabled¶
Type: bool
false
Description: Enable Istio ambient mesh mode. When true, uses ztunnel for mTLS instead of sidecars. This automatically enables istioCNI, ztunnel, and gatewayAPI packages. NOTE: Ambient mode is currently in an alpha state.
offline¶
Type: bool
false
Description: Prevent Big Bang from creating GitRepository resources. HelmReleases configured with Git sources will continue to reference those resources, so they must already exist in the expected namespaces. This applies to integrated packages, additional packages, and the package wrapper.
helmRepositories¶
Type: list
[]
Description: List of Helm repositories/credentials to pull helm charts from. OCI Type: Must specify username/password or existingSecret if repository requires auth. Using “private-registry” for existingSecret will reuse credentials from registryCredentials above. Default Type: Must specify existingSecret with auth - see https://fluxcd.io/flux/components/source/helmrepositories/#secret-reference for details on secret data required.
registryCredentials¶
Type: object, list, or null
nil
Description: Registry credentials used to pull all images deployed by Big Bang. Set to null (or omit) if your environment provides ambient image pull access, e.g. AWS EKS nodes with an IAM role granting ECR access, or GKE Workload Identity for GCR. When null, no private-registry Secret or imagePullSecrets stanzas are created. registryCredentials.username is required to be non-null if registryCredentials is defined registryCredentials.password is required to be non-null if registryCredentials is defined registryCredentials.registry will default to registry1.dso.mil registryCredentials.email will default to “”
openshift¶
Type: bool
false
Description: OpenShift Container Platform feature toggle.
git¶
Type: object
credentials:
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
existingSecret: ''
Description: Git credential settings for accessing private repositories Order of precedence is: 1. existingSecret 2. http credentials (username/password/caFile) 3. ssh credentials (privateKey/publicKey/knownHosts)
git.existingSecret¶
Type: string
""
Description: Existing secret to use for git credentials, must be in the appropriate format: https://toolkit.fluxcd.io/components/source/gitrepositories/#https-authentication
git.credentials¶
Type: object
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
Description: Chart created secrets with user defined values
git.credentials.username¶
Type: string
""
Description: HTTP git credentials, both username and password must be provided
git.credentials.caFile¶
Type: string
""
Description: HTTPS certificate authority file. Required for any repo with a self signed certificate
git.credentials.privateKey¶
Type: string
""
Description: SSH git credentials, privateKey, publicKey, and knownHosts must be provided
sso¶
Type: object
certificateAuthority:
cert: ''
secretName: tls-ca-sso
name: SSO
oidc:
authorization: '{{ .Values.sso.url }}/protocol/openid-connect/auth'
claims:
email: email
groups: groups
name: name
username: preferred_username
discoveryUrl: '{{ .Values.sso.url }}/.well-known/openid-configuration'
endSession: '{{ .Values.sso.url }}/protocol/openid-connect/logout'
jwks: ''
jwksUri: '{{ .Values.sso.url }}/protocol/openid-connect/certs'
token: '{{ .Values.sso.url }}/protocol/openid-connect/token'
userinfo: '{{ .Values.sso.url }}/protocol/openid-connect/userinfo'
saml:
entityDescriptor: '{{ .Values.sso.url }}/protocol/saml/descriptor'
metadata: ''
service: '{{ .Values.sso.url }}/protocol/saml'
url: https://login.dso.mil/auth/realms/baby-yoda
Description: Global SSO values used for BigBang deployments when sso is enabled
sso.name¶
Type: string
"SSO"
Description: Name of the identity provider. This is used by some packages as the SSO login label.
sso.url¶
Type: string
"https://login.dso.mil/auth/realms/baby-yoda"
Description: Base URL for the identity provider. For OIDC, this is the issuer. For SAML this is the entityID.
sso.certificateAuthority¶
Type: object
cert: ''
secretName: tls-ca-sso
Description: Certificate authority for the identity provider’s certificates
sso.certificateAuthority.cert¶
Type: string
""
Description: The certificate authority public certificate in .pem format. Populating this will create a secret in each namespace that enables SSO.
sso.certificateAuthority.secretName¶
Type: string
"tls-ca-sso"
Description: The secret name to use for the certificate authority. Can be manually populated if cert is blank.
sso.saml.entityDescriptor¶
Type: string
"{{ .Values.sso.url }}/protocol/saml/descriptor"
Description: SAML entityDescriptor (metadata) path
sso.saml.service¶
Type: string
"{{ .Values.sso.url }}/protocol/saml"
Description: SAML SSO Service path
sso.saml.metadata¶
Type: string
""
Description: Literal SAML XML metadata retrieved from {{ .Values.sso.saml.entityDescriptor }}. Required for SSO in Twistlock or Sonarqube. Optional for Anchore Enterprise.
sso.oidc¶
Type: object
authorization: '{{ .Values.sso.url }}/protocol/openid-connect/auth'
claims:
email: email
groups: groups
name: name
username: preferred_username
discoveryUrl: '{{ .Values.sso.url }}/.well-known/openid-configuration'
endSession: '{{ .Values.sso.url }}/protocol/openid-connect/logout'
jwks: ''
jwksUri: '{{ .Values.sso.url }}/protocol/openid-connect/certs'
token: '{{ .Values.sso.url }}/protocol/openid-connect/token'
userinfo: '{{ .Values.sso.url }}/protocol/openid-connect/userinfo'
Description: OIDC endpoints can be retrieved from {{ .Values.sso.url }}/.well-known/openid-configuration
sso.oidc.discoveryUrl¶
Type: string
"{{ .Values.sso.url }}/.well-known/openid-configuration"
Description: OIDC discovery URL
sso.oidc.authorization¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/auth"
Description: OIDC authorization path
sso.oidc.endSession¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/logout"
Description: OIDC logout / end session path
sso.oidc.jwksUri¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/certs"
Description: OIDC JSON Web Key Set (JWKS) path
sso.oidc.token¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/token"
Description: OIDC token path
sso.oidc.userinfo¶
Type: string
"{{ .Values.sso.url }}/protocol/openid-connect/userinfo"
Description: OIDC user information path
sso.oidc.jwks¶
Type: string
""
Description: Literal OIDC JWKS data retrieved from JWKS Uri. Only needed if jwksUri is not defined.
sso.oidc.claims¶
Type: object
email: email
groups: groups
name: name
username: preferred_username
Description: Identity provider claim names that store metadata about the authenticated user.
sso.oidc.claims.email¶
Type: string
"email"
Description: IdP’s claim name used for the user’s email address.
sso.oidc.claims.name¶
Type: string
"name"
Description: IdP’s claim name used for the user’s full name
sso.oidc.claims.username¶
Type: string
"preferred_username"
Description: IdP’s claim name used for the username
sso.oidc.claims.groups¶
Type: string
"groups"
Description: IdP’s claim name used for the user’s groups or roles
flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
mode: enabled
install:
remediation:
retries: -1
interval: 2m
rollback:
cleanupOnFail: true
timeout: 10m
test:
enable: false
timeout: 10m
upgrade:
cleanupOnFail: true
remediation:
remediateLastFailure: true
retries: 3
Description: Advanced Flux reconciliation parameters. The default values provided will be sufficient for the majority of workloads.
networkPolicies¶
Type: object
controlPlaneCidr: 0.0.0.0/0
egress:
definitions:
database-subnets:
ports:
- port: 5432
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
kafka-subnets:
ports:
- port: 9092
protocol: TCP
- port: 9093
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
redis-subnets:
ports:
- port: 6379
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
sso:
to:
- ipBlock:
cidr: 0.0.0.0/0
storage-subnets:
ports:
- port: 443
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
enabled: true
ingress:
definitions:
kubeAPI:
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
load-balancer-subnets:
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
nodeCidr: ''
vpcCidr: 0.0.0.0/0
Description: Global NetworkPolicies settings
networkPolicies.enabled¶
Type: bool
true
Description: Toggle all package NetworkPolicies, can disable specific packages with package.values.networkPolicies.enabled
networkPolicies.controlPlaneCidr¶
Type: string
"0.0.0.0/0"
Description: Control Plane CIDR, defaults to 0.0.0.0/0, use kubectl get endpoints -n default kubernetes to get the CIDR range needed for your cluster Must be an IP CIDR range (x.x.x.x/x - ideally with /32 for the specific IP of a single endpoint, broader range for multiple masters/endpoints) Used by package NetworkPolicies to allow Kube API access
networkPolicies.nodeCidr¶
Type: string
""
Description: Node CIDR, defaults to allowing “10.0.0.0/8” “172.16.0.0/12” “192.168.0.0/16” “100.64.0.0/10” networks. use kubectl get nodes -owide and review the INTERNAL-IP column to derive CIDR range. Must be an IP CIDR range (x.x.x.x/x - ideally a /16 or /24 to include multiple IPs)
networkPolicies.vpcCidr¶
Type: string
"0.0.0.0/0"
Description: VPC CIDR, defaults to 0.0.0.0/0 In a production environment, it is recommended to setup a Private Endpoint for your AWS services like KMS or S3. Please review https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.html to setup routing to AWS services that never leave the AWS network. Once created update networkPolicies.vpcCidr to match the CIDR of your VPC so Vault will be able to reach your VPCs DNS and new KMS endpoint.
networkPolicies.egress.definitions¶
Type: object
database-subnets:
ports:
- port: 5432
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
kafka-subnets:
ports:
- port: 9092
protocol: TCP
- port: 9093
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
redis-subnets:
ports:
- port: 6379
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
sso:
to:
- ipBlock:
cidr: 0.0.0.0/0
storage-subnets:
ports:
- port: 443
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
Description: Egress definitions; create definitions here that you want to re-use globally across all packages
networkPolicies.egress.definitions.sso¶
Type: object
to:
- ipBlock:
cidr: 0.0.0.0/0
Description: Egress definition for SSO; Set this to the CIDRs your SSO implementation is being served on; Example: Okta maintains a list of their CIDRs for this purpose
networkPolicies.egress.definitions.storage-subnets¶
Type: object
ports:
- port: 443
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
Description: Egress definition for Storage subnets (i.e. S3, Azure blob storage, etc.)
networkPolicies.egress.definitions.redis-subnets¶
Type: object
ports:
- port: 6379
protocol: TCP
to:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
Description: Egress definition for Redis or Valkey subnets. Override these CIDRs and ports to match externally managed Redis, Valkey, or Sentinel endpoints.
networkPolicies.egress.definitions.kafka-subnets¶
Type: object
ports:
- port: 9092
protocol: TCP
- port: 9093
protocol: TCP
to:
- ipBlock:
cidr: 0.0.0.0/0
Description: Egress definition for Kafka broker subnets (i.e. Amazon MSK, Confluent Cloud, Azure Event Hubs, etc.)
networkPolicies.ingress.definitions¶
Type: object
kubeAPI:
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
load-balancer-subnets:
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
Description: Ingress definitions; create definitions here that you want to re-use globally across all packages
networkPolicies.ingress.definitions.load-balancer-subnets¶
Type: object
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
Description: Ingress definition for load balancer subnets; change these CIDRs to match the subnet CIDRs where your load balancers are deployed
networkPolicies.ingress.definitions.kubeAPI¶
Type: object
from:
- ipBlock:
cidr: 192.168.0.0/16
- ipBlock:
cidr: 172.16.0.0/12
- ipBlock:
cidr: 10.0.0.0/8
Description: Ingress definition for Kube API subnets; Used to build Network Policy for packages that need to allow incoming traffic from the Kube API (i.e. Gatekeeper, Kyverno, etc.)
imagePullPolicy¶
Type: string
"IfNotPresent"
Description: Global ImagePullPolicy value for all packages Permitted values are: Never, Always, IfNotPresent
istioCNI¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/istio-cni.git
tag: 1.30.3-bb.0
helmRepo:
chartName: istio-cni
repoName: registry1
tag: 1.30.3-bb.0
postRenderers: []
sourceType: git
values: {}
Description: Istio CNI package configuration.
istioCNI.enabled¶
Type: bool
false
Description: Toggle deployment of Istio CNI
istioCNI.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
istioCNI.values¶
Type: object
{}
Description: Values to passthrough to the Istio CNI chart
istioCNI.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Istio CNI Package
istioCNI.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
istioCRDs.enabled¶
Type: bool
true
Description: Toggle deployment of Istio CRDs
istioCRDs.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
istioCRDs.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/istio-crds.git"
istioCRDs.git.path¶
Type: string
"./chart"
istioCRDs.git.tag¶
Type: string
"1.30.3-bb.0"
istioCRDs.helmRepo.repoName¶
Type: string
"registry1"
istioCRDs.helmRepo.chartName¶
Type: string
"istio-crds"
istioCRDs.helmRepo.tag¶
Type: string
"1.30.3-bb.0"
istioCRDs.values¶
Type: object
{}
Description: Values to passthrough to the Istio CRDs chart
istioCRDs.flux¶
Type: object
driftDetection:
ignore:
- paths:
- /webhooks/0/failurePolicy
target:
kind: ValidatingWebhookConfiguration
name: istiod-default-validator
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
mode: warn
Description: Flux reconciliation overrides specifically for the Istio CRDs Package
istioCRDs.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
gatewayAPI.enabled¶
Type: bool
false
Description: Toggle deployment of Gateway API CRDs
gatewayAPI.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
gatewayAPI.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/gateway-api.git"
gatewayAPI.git.path¶
Type: string
"./chart"
gatewayAPI.git.tag¶
Type: string
"1.6.1-bb.0"
gatewayAPI.helmRepo.repoName¶
Type: string
"registry1"
gatewayAPI.helmRepo.chartName¶
Type: string
"gateway-api"
gatewayAPI.helmRepo.tag¶
Type: string
"1.6.1-bb.0"
gatewayAPI.values¶
Type: object
{}
Description: Values to passthrough to the Gateway API chart
gatewayAPI.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Gateway API Package
gatewayAPI.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
istiod.enabled¶
Type: bool
true
Description: Toggle deployment of istiod
istiod.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
istiod.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/istiod.git"
istiod.git.path¶
Type: string
"./chart"
istiod.git.tag¶
Type: string
"1.30.3-bb.0"
istiod.helmRepo.repoName¶
Type: string
"registry1"
istiod.helmRepo.chartName¶
Type: string
"istiod"
istiod.helmRepo.tag¶
Type: string
"1.30.3-bb.0"
istiod.values¶
Type: object
{}
Description: Values to passthrough to the istiod chart
istiod.flux¶
Type: object
driftDetection:
ignore:
- paths:
- /webhooks/0/failurePolicy
target:
kind: ValidatingWebhookConfiguration
name: istio-validator-istio-system
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
mode: warn
Description: Flux reconciliation overrides specifically for the Istio Core Package
istiod.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
istioGateway.enabled¶
Type: bool
true
Description: Toggle deployment of Istio Gateway(s)
istioGateway.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
istioGateway.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/istio-gateway.git"
istioGateway.git.path¶
Type: string
"./chart"
istioGateway.git.tag¶
Type: string
"1.30.3-bb.0"
istioGateway.helmRepo.repoName¶
Type: string
"registry1"
istioGateway.helmRepo.chartName¶
Type: string
"gateway"
istioGateway.helmRepo.tag¶
Type: string
"1.30.3-bb.0"
istioGateway.values¶
Type: object
{}
Description: Gateway chart values. Values under shared apply to every gateway; values under gateways.
istioGateway.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: PeerAuthentication
namespace: istio-gateway
- paths:
- ''
target:
kind: AuthorizationPolicy
namespace: istio-gateway
- paths:
- ''
target:
kind: NetworkPolicy
namespace: istio-gateway
Description: Flux reconciliation overrides specifically for the Istio Gateway Package
istioGateway.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md The istioGateway package supports advanced postRenderer definitions. If an array of postRenderers is provided, the postRenderers will be applied to all gateways. If a map of postRenderers is provided, the postRenderers will be applied only to their respective gateways. The map key must match the gateway name for the postRenderers to be applied to that gateway. You cannot mix array and map postRenderers.
ztunnel.enabled¶
Type: bool
false
Description: Toggle deployment of ztunnel (required for Istio ambient mode)
ztunnel.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
ztunnel.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/ztunnel.git"
ztunnel.git.path¶
Type: string
"./chart"
ztunnel.git.tag¶
Type: string
"1.30.3-bb.0"
ztunnel.helmRepo.repoName¶
Type: string
"registry1"
ztunnel.helmRepo.chartName¶
Type: string
"ztunnel"
ztunnel.helmRepo.tag¶
Type: string
"1.30.3-bb.0"
ztunnel.values¶
Type: object
{}
Description: Values to passthrough to the ztunnel chart
ztunnel.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the ztunnel Package
ztunnel.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
kiali.enabled¶
Type: bool
true
Description: Toggle deployment of Kiali.
kiali.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
kiali.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/kiali.git"
kiali.git.path¶
Type: string
"./chart"
kiali.git.tag¶
Type: string
"2.30.0-bb.0"
kiali.helmRepo.repoName¶
Type: string
"registry1"
kiali.helmRepo.chartName¶
Type: string
"kiali"
kiali.helmRepo.tag¶
Type: string
"2.30.0-bb.0"
kiali.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Kiali
Description: Flux reconciliation overrides specifically for the Kiali Package
kiali.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
kiali.sso.enabled¶
Type: bool
false
Description: Toggle SSO for Kiali on and off
kiali.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for Kiali
kiali.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for Kiali
kiali.values¶
Type: object
{}
Description: Values to pass through to Kiali chart: https://repo1.dso.mil/big-bang/product/packages/kiali
kiali.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
gatekeeper¶
Type: object
enabled: false
flux:
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
waitStrategy:
name: legacy
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/policy.git
tag: 3.23.0-bb.0
helmRepo:
chartName: gatekeeper
repoName: registry1
tag: 3.23.0-bb.0
postRenderers: []
sourceType: git
values: {}
Description: OPA Gatekeeper package configuration.
gatekeeper.enabled¶
Type: bool
false
Description: Toggle deployment of OPA Gatekeeper.
gatekeeper.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
gatekeeper.flux¶
Type: object
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
waitStrategy:
name: legacy
Description: Flux reconciliation overrides specifically for the OPA Gatekeeper Package
gatekeeper.values¶
Type: object
{}
Description: Values to passthrough to the gatekeeper chart: https://repo1.dso.mil/big-bang/product/packages/policy.git
gatekeeper.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
kyverno¶
Type: object
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: CustomResourceDefinition
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/kyverno.git
tag: 3.9.0-bb.0
helmRepo:
chartName: kyverno
repoName: registry1
tag: 3.9.0-bb.0
postRenderers: []
sourceType: git
values: {}
Description: Kyverno package configuration.
kyverno.enabled¶
Type: bool
true
Description: Toggle deployment of Kyverno.
kyverno.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
kyverno.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: CustomResourceDefinition
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
Description: Flux reconciliation overrides specifically for the Kyverno Package
kyverno.values¶
Type: object
{}
Description: Values to passthrough to the kyverno chart: https://repo1.dso.mil/big-bang/product/packages/kyverno.git
kyverno.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
kyvernoPolicies.enabled¶
Type: bool
true
Description: Toggle deployment of Kyverno policies
kyvernoPolicies.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
kyvernoPolicies.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/kyverno-policies.git"
kyvernoPolicies.git.path¶
Type: string
"./chart"
kyvernoPolicies.git.tag¶
Type: string
"3.3.4-bb.87"
kyvernoPolicies.helmRepo.repoName¶
Type: string
"registry1"
kyvernoPolicies.helmRepo.chartName¶
Type: string
"kyverno-policies"
kyvernoPolicies.helmRepo.tag¶
Type: string
"3.3.4-bb.87"
kyvernoPolicies.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: ClusterPolicy
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Kyverno Policies Package
kyvernoPolicies.values¶
Type: object
{}
Description: Values to passthrough to the kyverno policies chart: https://repo1.dso.mil/big-bang/product/packages/kyverno-policies.git
kyvernoPolicies.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
kyvernoReporter.enabled¶
Type: bool
true
Description: Toggle deployment of Kyverno Reporter
kyvernoReporter.sso.enabled¶
Type: bool
false
Description: Toggle SSO for kyvernoReporter virtualservice on and off
kyvernoReporter.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for kyvernoReporter
kyvernoReporter.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for kyvernoReporter
kyvernoReporter.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
kyvernoReporter.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/kyverno-reporter.git"
kyvernoReporter.git.path¶
Type: string
"./chart"
kyvernoReporter.git.tag¶
Type: string
"3.9.0-bb.2"
kyvernoReporter.helmRepo.repoName¶
Type: string
"registry1"
kyvernoReporter.helmRepo.chartName¶
Type: string
"kyverno-reporter"
kyvernoReporter.helmRepo.tag¶
Type: string
"3.9.0-bb.2"
kyvernoReporter.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Kyverno Reporter Package
kyvernoReporter.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
kyvernoReporter.values¶
Type: object
{}
Description: Values to passthrough to the kyverno reporter chart: https://repo1.dso.mil/big-bang/product/packages/kyverno-reporter.git
kyvernoReporter.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
elasticsearchKibana¶
Type: object
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Kibana
- paths:
- ''
target:
kind: Elasticsearch
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
timeout: 20m
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/elasticsearch-kibana.git
tag: 1.41.0-bb.0
helmRepo:
chartName: elasticsearch-kibana
repoName: registry1
tag: 1.41.0-bb.0
ingress:
gateway: ''
license:
keyJSON: ''
trial: false
postRenderers: []
serviceAccountAnnotations:
elasticsearch: {}
kibana: {}
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
Description: Elasticsearch and Kibana package configuration.
elasticsearchKibana.enabled¶
Type: bool
false
Description: Toggle deployment of Logging (EFK).
elasticsearchKibana.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
elasticsearchKibana.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Kibana
- paths:
- ''
target:
kind: Elasticsearch
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
timeout: 20m
Description: Flux reconciliation overrides specifically for the Logging (EFK) Package
elasticsearchKibana.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
elasticsearchKibana.sso.enabled¶
Type: bool
false
Description: Toggle OIDC SSO for Kibana/Elasticsearch on and off. Enabling this option will auto-create any required secrets.
elasticsearchKibana.sso.client_id¶
Type: string
""
Description: Elasticsearch/Kibana OIDC client ID
elasticsearchKibana.sso.client_secret¶
Type: string
""
Description: Elasticsearch/Kibana OIDC client secret
elasticsearchKibana.serviceAccountAnnotations¶
Type: object
elasticsearch: {}
kibana: {}
Description: Elasticsearch/Kibana Service Account Annotations
elasticsearchKibana.license.trial¶
Type: bool
false
Description: Toggle trial license installation of elasticsearch. Note that enterprise (non trial) is required for SSO to work.
elasticsearchKibana.license.keyJSON¶
Type: string
""
Description: Elasticsearch license in json format seen here: https://repo1.dso.mil/big-bang/product/packages/elasticsearch-kibana#enterprise-license
elasticsearchKibana.values¶
Type: object
{}
Description: Values to passthrough to the elasticsearch-kibana chart: https://repo1.dso.mil/big-bang/product/packages/elasticsearch-kibana.git
elasticsearchKibana.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
eckOperator.enabled¶
Type: bool
false
Description: Toggle deployment of ECK Operator.
eckOperator.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
eckOperator.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/eck-operator.git"
eckOperator.git.path¶
Type: string
"./chart"
eckOperator.git.tag¶
Type: string
"3.4.1-bb.1"
eckOperator.helmRepo.repoName¶
Type: string
"registry1"
eckOperator.helmRepo.chartName¶
Type: string
"eck-operator"
eckOperator.helmRepo.tag¶
Type: string
"3.4.1-bb.1"
eckOperator.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the ECK Operator Package
eckOperator.values¶
Type: object
{}
Description: Values to passthrough to the eck-operator chart: https://repo1.dso.mil/big-bang/product/packages/eck-operator.git
eckOperator.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
fluentbit.enabled¶
Type: bool
false
Description: Toggle deployment of Fluent-Bit.
fluentbit.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
fluentbit.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/fluentbit.git"
fluentbit.git.path¶
Type: string
"./chart"
fluentbit.git.tag¶
Type: string
"0.57.9-bb.1"
fluentbit.helmRepo.repoName¶
Type: string
"registry1"
fluentbit.helmRepo.chartName¶
Type: string
"fluentbit"
fluentbit.helmRepo.tag¶
Type: string
"0.57.9-bb.1"
fluentbit.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Fluent-Bit Package
fluentbit.values¶
Type: object
{}
Description: Values to passthrough to the fluentbit chart: https://repo1.dso.mil/big-bang/product/packages/fluentbit.git
fluentbit.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
alloy¶
Type: object
additionalDestinations: []
alloyClusterEvents:
enabled: true
alloyLogs:
enabled: true
alloyMetrics:
enabled: false
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/alloy.git
tag: 4.3.2-bb.0
helmRepo:
chartName: k8s-monitoring
repoName: registry1
tag: 4.3.2-bb.0
postRenderers: []
sourceType: git
values: {}
Description: Grafana Alloy package configuration.
alloy.enabled¶
Type: bool
true
Description: Toggle deployment of grafana alloy
alloy.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
alloy.alloyLogs¶
Type: object
enabled: true
Description: Toggle Alloy to collect logs
alloy.alloyMetrics¶
Type: object
enabled: false
Description: Toggle Alloy to scrape metrics
alloy.alloyClusterEvents¶
Type: object
enabled: true
Description: Toggle Alloy to collect cluster events
alloy.additionalDestinations¶
Type: list
[]
Description: Additional Alloy destinations not included in Big Bang
alloy.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the alloy package
loki.enabled¶
Type: bool
true
Description: Toggle deployment of Loki.
loki.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
loki.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/loki.git"
loki.git.path¶
Type: string
"./chart"
loki.git.tag¶
Type: string
"6.55.0-bb.5"
loki.helmRepo.repoName¶
Type: string
"registry1"
loki.helmRepo.chartName¶
Type: string
"loki"
loki.helmRepo.tag¶
Type: string
"6.55.0-bb.5"
loki.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Sidecar
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Loki Package
loki.strategy¶
Type: string
"monolith"
Description: Loki architecture. Options are monolith, scalable, and distributed (unsupported).
loki.clusterName¶
Type: string
""
Description: Loki clusterName identifier
loki.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. examples: “https://s3.amazonaws.com” “https://s3.us-gov-west-1.amazonaws.com” “http://minio.minio.svc.cluster.local:9000”
loki.objectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
loki.objectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint.
loki.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
loki.objectStorage.bucketNames¶
Type: object
{}
Description: Bucket Names for the Loki buckets as YAML chunks: loki-logs ruler: loki-ruler admin: loki-admin
loki.values¶
Type: object
{}
Description: Values to passthrough to the Loki chart: https://repo1.dso.mil/big-bang/product/packages/loki.git
loki.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
neuvector¶
Type: object
enabled: true
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: CronJob
- paths:
- ''
target:
kind: Lease
- paths:
- ''
target:
kind: Secret
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/neuvector.git
tag: 2.11.0-bb.2
helmRepo:
chartName: neuvector
repoName: registry1
tag: 2.11.0-bb.2
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
default_role: ''
enabled: false
group_claim: ''
group_mapped_roles: []
values: {}
Description: NeuVector package configuration.
neuvector.enabled¶
Type: bool
true
Description: Toggle deployment of Neuvector.
neuvector.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
neuvector.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
neuvector.sso.enabled¶
Type: bool
false
Description: Toggle SSO for Neuvector on and off
neuvector.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for Neuvector
neuvector.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for Neuvector
neuvector.sso.default_role¶
Type: string
""
Description: Default role to use for Neuvector OIDC users. Supports admin, reader, or no default
neuvector.sso.group_claim¶
Type: string
""
Description: OIDC claim used to identify Neuvector groups.
neuvector.sso.group_mapped_roles¶
Type: list
[]
Description: Mapping of OIDC groups to Neuvector global roles.
neuvector.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: CronJob
- paths:
- ''
target:
kind: Lease
- paths:
- ''
target:
kind: Secret
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Neuvector Package
neuvector.values¶
Type: object
{}
Description: Values to passthrough to the Neuvector chart: https://repo1.dso.mil/big-bang/product/packages/neuvector.git
neuvector.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
tempo¶
Type: object
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/tempo.git
tag: 2.1.0-bb.2
helmRepo:
chartName: tempo
repoName: registry1
tag: 2.1.0-bb.2
metricsGenerator:
enabled: false
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
insecure: false
region: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
Description: Tempo package configuration.
tempo.enabled¶
Type: bool
true
Description: Toggle deployment of Tempo.
tempo.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
tempo.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Tempo Package
tempo.sso¶
Type: object
client_id: ''
client_secret: ''
enabled: false
Description: This section is deprecated and will be removed in a future release
tempo.sso.enabled¶
Type: bool
false
Description: Toggle SSO for Tempo on and off
tempo.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for Tempo
tempo.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for Tempo
tempo.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. examples: “s3.amazonaws.com” “s3.us-gov-west-1.amazonaws.com” “minio.minio.svc.cluster.local:9000” Note: tempo does not require protocol prefix for URL.
tempo.objectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
tempo.objectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint.
tempo.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
tempo.objectStorage.bucket¶
Type: string
""
Description: Bucket Name for Tempo examples: “tempo-traces”
tempo.objectStorage.insecure¶
Type: bool
false
Description: Whether or not objectStorage connection should require HTTPS, if connecting to in-cluster object storage on port 80/9000 set this value to true.
tempo.metricsGenerator¶
Type: object
enabled: false
Description: Whether or not to enable Tempo’s internal metrics generator, the monitoring package will also be be required for this integration.
tempo.values¶
Type: object
{}
Description: Values to passthrough to the Tempo chart: https://repo1.dso.mil/big-bang/product/packages/tempo.git
tempo.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
prometheusOperatorCRDs¶
Type: object
enabled: true
flux:
driftDetection:
mode: warn
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/prometheus-operator-crds.git
tag: 31.0.1-bb.0
helmRepo:
chartName: prometheus-operator-crds
repoName: registry1
tag: 31.0.1-bb.0
postRenderers: []
sourceType: git
values: {}
Description: Prometheus Operator CRDs package configuration.
prometheusOperatorCRDs.enabled¶
Type: bool
true
Description: Toggle deployment of Monitoring/Prometheus Operator CRDs (ServiceMonitor, PodMonitor, AlertManager, ScrapeConfigs etc..)
prometheusOperatorCRDs.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
prometheusOperatorCRDs.values¶
Type: object
{}
Description: Values to passthrough to the Prometheus Operator CRDs chart
prometheusOperatorCRDs.flux¶
Type: object
driftDetection:
mode: warn
Description: Flux reconciliation overrides specifically for the Prometheus Operator CRDs Package
prometheusOperatorCRDs.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
monitoring.enabled¶
Type: bool
true
Description: Toggle deployment of Monitoring (Prometheus, Grafana, and Alertmanager).
monitoring.prometheusMetrics¶
Type: object
enabled: true
Description: Toggle Prometheus metrics scraping. Set to false when using alloy-metrics as the scraper.
monitoring.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
monitoring.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/monitoring.git"
monitoring.git.path¶
Type: string
"./chart"
monitoring.git.tag¶
Type: string
"88.3.0-bb.0"
monitoring.helmRepo.repoName¶
Type: string
"registry1"
monitoring.helmRepo.chartName¶
Type: string
"monitoring"
monitoring.helmRepo.tag¶
Type: string
"88.3.0-bb.0"
monitoring.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Alertmanager
- paths:
- ''
target:
kind: Prometheus
- paths:
- ''
target:
kind: PrometheusRule
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
install:
crds: CreateReplace
upgrade:
crds: CreateReplace
Description: Flux reconciliation overrides specifically for the Monitoring Package
monitoring.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
monitoring.sso.enabled¶
Type: bool
false
Description: Toggle SSO for monitoring components on and off
monitoring.sso.prometheus.client_id¶
Type: string
""
Description: Prometheus OIDC client ID
monitoring.sso.prometheus.client_secret¶
Type: string
""
Description: Prometheus OIDC client secret
monitoring.sso.alertmanager.client_id¶
Type: string
""
Description: Alertmanager OIDC client ID
monitoring.sso.alertmanager.client_secret¶
Type: string
""
Description: Alertmanager OIDC client secret
monitoring.values¶
Type: object
{}
Description: Values to passthrough to the monitoring chart: https://repo1.dso.mil/big-bang/product/packages/monitoring.git
monitoring.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
grafana¶
Type: object
enabled: true
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/grafana.git
tag: 10.5.15-bb.6
helmRepo:
chartName: grafana
repoName: registry1
tag: 10.5.15-bb.6
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
enabled: false
grafana:
allow_sign_up: true
client_id: ''
client_secret: ''
role_attribute_path: Viewer
scopes: ''
values: {}
Description: Grafana package configuration.
grafana.enabled¶
Type: bool
true
Description: Toggle deployment of Grafana
grafana.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
grafana.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Grafana Package
grafana.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
grafana.sso.enabled¶
Type: bool
false
Description: Toggle SSO for grafana components on and off
grafana.sso.grafana.client_id¶
Type: string
""
Description: Grafana OIDC client ID
grafana.sso.grafana.client_secret¶
Type: string
""
Description: Grafana OIDC client secret
grafana.sso.grafana.scopes¶
Type: string
""
Description: Grafana OIDC client scopes, comma separated, see https://grafana.com/docs/grafana/latest/auth/generic-oauth/
grafana.values¶
Type: object
{}
Description: Values to passthrough to the grafana chart: https://repo1.dso.mil/big-bang/product/packages/grafana.git
grafana.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
twistlock¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/twistlock.git
tag: 0.30.0-bb.0
helmRepo:
chartName: twistlock
repoName: registry1
tag: 0.30.0-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
enabled: false
groups: ''
provider_type: shibboleth
values: {}
Description: Twistlock package configuration.
twistlock.enabled¶
Type: bool
false
Description: Toggle deployment of Twistlock.
twistlock.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
twistlock.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Twistlock Package
twistlock.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
twistlock.sso.enabled¶
Type: bool
false
Description: Toggle SAML SSO, requires a license and enabling the init job - see https://repo1.dso.mil/big-bang/product/packages/initialization.md
twistlock.sso.client_id¶
Type: string
""
Description: SAML client ID
twistlock.sso.provider_type¶
Type: string
"shibboleth"
Description: SAML Identity Provider. shibboleth is recommended by Twistlock support for Keycloak Possible values: okta, gsuite, ping, shibboleth, azure, adfs
twistlock.sso.groups¶
Type: string
""
Description: Groups attribute (optional)
twistlock.values¶
Type: object
{}
Description: Values to passthrough to the twistlock chart: https://repo1.dso.mil/big-bang/product/packages/twistlock.git
twistlock.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
renovate.enabled¶
Type: bool
false
Description: Toggle deployment of Renovate
renovate.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
renovate.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/renovate.git"
renovate.git.path¶
Type: string
"./chart"
renovate.git.tag¶
Type: string
"46.251.0-bb.0"
renovate.helmRepo.repoName¶
Type: string
"registry1"
renovate.helmRepo.chartName¶
Type: string
"renovate"
renovate.helmRepo.tag¶
Type: string
"46.251.0-bb.0"
renovate.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Renovate Package
renovate.values¶
Type: object
{}
Description: Values to passthrough to the Renovate chart: https://repo1.dso.mil/big-bang/product/packages/renovate.git
renovate.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
certManager¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/cert-manager.git
tag: v1.20.3-bb.2
helmRepo:
chartName: cert-manager
repoName: registry1
tag: v1.20.3-bb.2
namespace:
create: true
labels:
istio.io/dataplane-mode: none
name: cert-manager
postRenderers: []
sourceType: git
values:
issuers:
letsEncrypt:
enabled: false
selfSigned:
enabled: false
upstream:
crds:
enabled: true
Description: cert-manager package configuration.
certManager.enabled¶
Type: bool
false
Description: Toggle deployment of cert-manager
certManager.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
certManager.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for cert-manager
certManager.values¶
Type: object
issuers:
letsEncrypt:
enabled: false
selfSigned:
enabled: false
upstream:
crds:
enabled: true
Description: Values to pass through to the cert-manager chart
certManager.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons¶
Type: object
anchoreEnterprise:
adminPassword: ''
database:
database: ''
host: ''
password: ''
port: ''
username: ''
enabled: false
enterprise:
licenseYaml: 'FULL LICENSE
'
flux:
upgrade:
disableWait: true
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/anchore-enterprise.git
tag: 3.25.1-bb.3
helmRepo:
chartName: anchore-enterprise
repoName: registry1
tag: 3.25.1-bb.3
ingress:
gateway: ''
postRenderers: []
redis:
host: ''
password: ''
port: ''
username: ''
sourceType: git
sso:
client_id: ''
enabled: false
role_attribute: ''
values: {}
argocd:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/argocd.git
tag: 10.2.1-bb.0
helmRepo:
chartName: argocd
repoName: registry1
tag: 10.2.1-bb.0
ingress:
gateway: ''
postRenderers: []
redis:
host: ''
port: ''
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
groups: 'g, Impact Level 2 Authorized, role:admin
'
values: {}
authservice:
chains: {}
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/authservice.git
tag: 1.1.8-bb.1
helmRepo:
chartName: authservice
repoName: registry1
tag: 1.1.8-bb.1
postRenderers: []
sourceType: git
values: {}
externalSecrets:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/external-secrets.git
tag: 2.8.0-bb.0
helmRepo:
chartName: external-secrets
repoName: registry1
tag: 2.8.0-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
fortify:
enabled: false
externalDatabase:
host: ''
port: 3306
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/fortify.git
tag: 26.2.0-bb.2
helmRepo:
chartName: fortify-ssc
repoName: registry1
tag: 26.2.0-bb.2
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
gitlab:
database:
database: ''
host: ''
password: ''
port: 5432
username: ''
dependsOn: []
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/gitlab.git
tag: 10.2.4-bb.0
helmRepo:
chartName: gitlab
repoName: registry1
tag: 10.2.4-bb.0
hostnames:
gitlab: gitlab
registry: registry
ingress:
gateway: ''
objectStorage:
accessKey: ''
accessSecret: ''
bucketPrefix: ''
endpoint: ''
iamProfile: ''
region: ''
regionendpoint: ''
type: ''
postRenderers: []
railsSecret: ''
redis:
password: ''
smtp:
password: ''
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
groups: []
scopes:
- Gitlab
values: {}
gitlabRunner:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/gitlab-runner.git
tag: 0.91.2-bb.1
helmRepo:
chartName: gitlab-runner
repoName: registry1
tag: 0.91.2-bb.1
postRenderers: []
sourceType: git
values: {}
harbor:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/harbor.git
tag: 1.19.2-bb.0
helmRepo:
chartName: harbor
repoName: registry1
tag: 1.19.2-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
headlamp:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/headlamp.git
tag: 0.44.0-bb.0
helmRepo:
chartName: headlamp
repoName: registry1
tag: 0.44.0-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
keycloak:
database:
database: ''
host: ''
password: ''
port: 5432
type: postgres
username: ''
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/keycloak.git
tag: 7.3.0-bb.0
helmRepo:
chartName: keycloak
repoName: registry1
tag: 7.3.0-bb.0
ingress:
cert: ''
gateway: ''
key: ''
postRenderers: []
sourceType: git
values: {}
mattermost:
database:
database: ''
host: ''
password: ''
port: ''
ssl_mode: ''
username: ''
elasticsearch:
enabled: false
enabled: false
enterprise:
enabled: false
existingSecret: ''
license: ''
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Mattermost
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/mattermost.git
tag: 11.10.0-bb.0
helmRepo:
chartName: mattermost
repoName: registry1
tag: 11.10.0-bb.0
ingress:
gateway: ''
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
mattermostOperator:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/mattermost-operator.git
tag: 1.25.7-bb.3
helmRepo:
chartName: mattermost-operator
repoName: registry1
tag: 1.25.7-bb.3
postRenderers: []
sourceType: git
values: {}
metricsServer:
automountServiceAccountToken: true
enabled: auto
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/metrics-server.git
tag: 3.13.1-bb.1
helmRepo:
chartName: metrics-server
repoName: registry1
tag: 3.13.1-bb.1
namespace:
annotations: {}
create: false
labels: {}
name: kube-system
postRenderers: []
sourceType: git
values: {}
mimir:
enabled: false
enterprise:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/mimir.git
tag: 6.1.0-bb.1
helmRepo:
chartName: mimir
repoName: registry1
tag: 6.1.0-bb.1
kafkaIngestStorage:
brokerClusterDomain: ''
brokerHost: ''
brokerNetworkCIDR: ''
brokerPort: 9092
enabled: false
topic: mimir-ingest
minioObjectStorage:
bucketName: mimir
configSecret:
accessKey: minio
secretKey: minio123
defaultUserCredentials:
password: supersecret
username: mimir-user
enabled: false
postRenderers: []
s3ObjectStorage:
accessKey: ''
accessSecret: ''
bucketName: ''
enabled: false
endpoint: ''
insecure: false
region: ''
serviceAccountAnnotations: {}
sourceType: git
values: {}
minio:
accesskey: ''
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/minio.git
tag: 7.1.1-bb.23
helmRepo:
chartName: minio-instance
repoName: registry1
tag: 7.1.1-bb.23
ingress:
gateway: ''
postRenderers: []
secretkey: ''
sourceType: git
values: {}
minioOperator:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/minio-operator.git
tag: 7.1.1-bb.9
helmRepo:
chartName: minio-operator
repoName: registry1
tag: 7.1.1-bb.9
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
sonarqube:
database:
database: ''
host: ''
password: ''
port: 5432
username: ''
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/sonarqube.git
tag: 2026.4.0-bb.0
helmRepo:
chartName: sonarqube
repoName: registry1
tag: 2026.4.0-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
email: email
enabled: false
group: group
login: login
name: name
values: {}
thanos:
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/thanos.git
tag: 17.6.0-bb.0
helmRepo:
chartName: thanos
repoName: registry1
tag: 17.6.0-bb.0
ingress:
gateway: ''
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
insecure: false
region: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
vault:
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: MutatingWebhookConfiguration
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/vault.git
tag: 0.34.1-bb.0
helmRepo:
chartName: vault
repoName: registry1
tag: 0.34.1-bb.0
ingress:
cert: ''
gateway: ''
key: ''
postRenderers: []
sourceType: git
values: {}
velero:
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/velero.git
tag: 12.1.0-bb.3
helmRepo:
chartName: velero
repoName: registry1
tag: 12.1.0-bb.3
postRenderers: []
sourceType: git
values: {}
Description: Optional add-on package configuration.
addons.argocd.enabled¶
Type: bool
false
Description: Toggle deployment of ArgoCD.
addons.argocd.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.argocd.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the ArgoCD Package
addons.argocd.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.argocd.redis.host¶
Type: string
""
Description: Hostname of a pre-existing Redis to use for ArgoCD. Entering connection info will enable external Redis and will auto-create any required secrets.
addons.argocd.redis.port¶
Type: string
""
Description: Port of a pre-existing Redis to use for ArgoCD.
addons.argocd.sso.enabled¶
Type: bool
false
Description: Toggle SSO for ArgoCD on and off
addons.argocd.sso.client_id¶
Type: string
""
Description: ArgoCD OIDC client ID
addons.argocd.sso.client_secret¶
Type: string
""
Description: ArgoCD OIDC client secret
addons.argocd.sso.groups¶
Type: string
"g, Impact Level 2 Authorized, role:admin\n"
Description: ArgoCD SSO group roles, see docs for more details: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/
addons.argocd.values¶
Type: object
{}
Description: Values to passthrough to the argocd chart: https://repo1.dso.mil/big-bang/product/packages/argocd.git
addons.argocd.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.authservice.enabled¶
Type: bool
false
Description: Toggle deployment of Authservice. if enabling authservice, a filter needs to be provided by either enabling sso for monitoring or tempo, or manually adding a filter chain in the values here: .Values.addons.authservice.chains.minimal.callback_uri="https://somecallback"
addons.authservice.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.authservice.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Authservice Package
addons.authservice.values¶
Type: object
{}
Description: Values to passthrough to the authservice chart: https://repo1.dso.mil/big-bang/product/packages/authservice.git
addons.authservice.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.authservice.chains¶
Type: object
{}
Description: Additional authservice chain configurations.
addons.minioOperator¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/minio-operator.git
tag: 7.1.1-bb.9
helmRepo:
chartName: minio-operator
repoName: registry1
tag: 7.1.1-bb.9
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
Description: MinIO Operator package configuration.
addons.minioOperator.enabled¶
Type: bool
false
Description: Toggle deployment of minio operator and instance.
addons.minioOperator.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.minioOperator.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Minio Operator Package
addons.minioOperator.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.minioOperator.values¶
Type: object
{}
Description: Values to passthrough to the minio operator chart: https://repo1.dso.mil/big-bang/product/packages/minio-operator.git
addons.minioOperator.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.minio.enabled¶
Type: bool
false
Description: Toggle deployment of minio.
addons.minio.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.minio.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Minio Package
addons.minio.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.minio.accesskey¶
Type: string
""
Description: Default access key to use for minio.
addons.minio.secretkey¶
Type: string
""
Description: Default secret key to instantiate with minio, you should change/delete this after installation.
addons.minio.values¶
Type: object
{}
Description: Values to passthrough to the minio instance chart: https://repo1.dso.mil/big-bang/product/packages/minio.git
addons.minio.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.gitlab.enabled¶
Type: bool
false
Description: Toggle deployment of Gitlab
addons.gitlab.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.gitlab.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Gitlab Package
addons.gitlab.dependsOn¶
Type: list
[]
Description: Additional HelmRelease dependencies for GitLab. Use this for operators that must be Ready before the GitLab chart creates their custom resources.
addons.gitlab.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.gitlab.sso.enabled¶
Type: bool
false
Description: Toggle OIDC SSO for Gitlab on and off. Enabling this option will auto-create any required secrets.
addons.gitlab.sso.client_id¶
Type: string
""
Description: Gitlab OIDC client ID
addons.gitlab.sso.client_secret¶
Type: string
""
Description: Gitlab OIDC client secret
addons.gitlab.sso.scopes¶
Type: list
- Gitlab
Description: Gitlab SSO Scopes, default is [“Gitlab”]
addons.gitlab.sso.groups¶
Type: list
[]
Description: Fill out the groups block below and populate with Keycloak groups according to your desired Gitlab membership requirements. The default groupsAttribute is “groups”. Full documentation: https://docs.gitlab.com/ee/administration/auth/oidc.html?tab=Linux+package+%28Omnibus%29#configure-users-based-on-oidc-group-membership
addons.gitlab.database.host¶
Type: string
""
Description: Hostname of a pre-existing PostgreSQL database to use for Gitlab. Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.
addons.gitlab.database.port¶
Type: int
5432
Description: Port of a pre-existing PostgreSQL database to use for Gitlab.
addons.gitlab.database.database¶
Type: string
""
Description: Database name to connect to on host.
addons.gitlab.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
addons.gitlab.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
addons.gitlab.objectStorage.type¶
Type: string
""
Description: Type of object storage to use for Gitlab, setting to s3 will assume an external, pre-existing object storage is to be used. Entering connection info will enable this option and will auto-create any required secrets
addons.gitlab.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. GitLab 19 requires the URI scheme for non-AWS S3-compatible endpoints. examples: “https://s3.amazonaws.com” “https://s3.us-gov-west-1.amazonaws.com” “http://minio.minio.svc.cluster.local:9000”
addons.gitlab.objectStorage.regionendpoint¶
Type: string
""
Description: S3 compatible service endpoint for use with Minio or aws S3. The value must include an http:// or https:// URI scheme. See: https://gitlab.com/gitlab-org/charts/gitlab/-/tree/master/examples/objectstorage Setting this allows the registry to use a different endpoint than the global objectStorage.endpoint documented above. objectStorage.endpoint must be set in order for objectStorage.regionendpoint endpoint to be used. See: https://docs.gitlab.com/administration/object_storage/ Also note rails.s3.yaml and registry.s3.yaml here for implementation parallel: https://gitlab.com/gitlab-org/charts/gitlab/-/tree/master/examples/objectstorage examples: "https://s3.us-gov-west-1.amazonaws.com" "https://minio.example.com:9000"
addons.gitlab.objectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
addons.gitlab.objectStorage.accessKey¶
Type: string
""
Description: If using accessKey and accessSecret, the iamProfile must be left as an empty string: “”
addons.gitlab.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
addons.gitlab.objectStorage.bucketPrefix¶
Type: string
""
Description: Bucket prefix to use for identifying buckets. Example: “prod” will produce “prod-gitlab-bucket”
addons.gitlab.objectStorage.iamProfile¶
Type: string
""
Description: If using an AWS IAM profile, the accessKey and accessSecret values must be left as empty strings eg: “”
addons.gitlab.smtp.password¶
Type: string
""
Description: Passwords should be placed in an encrypted file. Example: environment-bb-secret.enc.yaml If a value is provided BigBang will create a k8s secret named gitlab-smtp-password in the gitlab namespace
addons.gitlab.redis.password¶
Type: string
""
Description: Plain text password for an externally managed Redis or Valkey service. When set, Big Bang creates gitlab-redis-secret-bb and configures GitLab to use it. Configure the external endpoint with addons.gitlab.values.global.redis.host or addons.gitlab.values.global.redis.redisYmlOverride. Leave this empty only when authentication is disabled or supplied entirely through passthrough values. A non-empty value is also required for the Grafana Redis datasource and dashboards.
addons.gitlab.railsSecret¶
Type: string
""
Description: Rails plain text secret to define. If empty (“”), the gitlab charts will create the gitlab-rails-secret with randomized data. Read the following for more information on setting Gitlab rails secrets: https://docs.gitlab.com/charts/installation/secrets#gitlab-rails-secret
addons.gitlab.values¶
Type: object
{}
Description: Values to passthrough to the gitlab chart: https://repo1.dso.mil/big-bang/product/packages/gitlab.git
addons.gitlab.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.gitlabRunner.enabled¶
Type: bool
false
Description: Toggle deployment of Gitlab Runner
addons.gitlabRunner.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.gitlabRunner.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Gitlab Runner Package
addons.gitlabRunner.values¶
Type: object
{}
Description: Values to passthrough to the gitlab runner chart: https://repo1.dso.mil/big-bang/product/packages/gitlab-runner.git
addons.gitlabRunner.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.sonarqube.enabled¶
Type: bool
false
Description: Toggle deployment of SonarQube.
addons.sonarqube.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.sonarqube.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Sonarqube Package
addons.sonarqube.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.sonarqube.sso.enabled¶
Type: bool
false
Description: Toggle SAML SSO for SonarQube. Enabling this option will auto-create any required secrets.
addons.sonarqube.sso.client_id¶
Type: string
""
Description: SonarQube SAML client ID
addons.sonarqube.sso.login¶
Type: string
"login"
Description: SonarQube login sso attribute.
addons.sonarqube.sso.name¶
Type: string
"name"
Description: SonarQube name sso attribute.
addons.sonarqube.sso.email¶
Type: string
"email"
Description: SonarQube email sso attribute.
addons.sonarqube.sso.group¶
Type: optional
"group"
Description: SonarQube group sso attribute.
addons.sonarqube.database.host¶
Type: string
""
Description: Hostname of a pre-existing PostgreSQL database to use for SonarQube.
addons.sonarqube.database.port¶
Type: int
5432
Description: Port of a pre-existing PostgreSQL database to use for SonarQube.
addons.sonarqube.database.database¶
Type: string
""
Description: Database name to connect to on host.
addons.sonarqube.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
addons.sonarqube.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
addons.sonarqube.values¶
Type: object
{}
Description: Values to passthrough to the sonarqube chart: https://repo1.dso.mil/big-bang/product/packages/sonarqube.git
addons.sonarqube.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.fortify.enabled¶
Type: bool
false
Description: Toggle deployment of Fortify.
addons.fortify.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.fortify.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Fortify Package
addons.fortify.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.fortify.externalDatabase.host¶
Type: string
""
Description: External MySQL host used to generate Fortify’s outbound bb-common route/ServiceEntry when values.mysql.enabled=false. This should match the hostname used in values.fortify_autoconfig .
addons.fortify.externalDatabase.port¶
Type: int
3306
Description: External MySQL port used to generate Fortify’s outbound bb-common route/ServiceEntry when values.mysql.enabled=false. This should match the port used in values.fortify_autoconfig.
addons.fortify.values¶
Type: object
{}
Description: Values to passthrough to the fortify chart: https://repo1.dso.mil/big-bang/product/packages/fortify.git
addons.fortify.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.anchoreEnterprise.enabled¶
Type: bool
false
Description: Toggle deployment of Anchore.
addons.anchoreEnterprise.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.anchoreEnterprise.flux¶
Type: object
upgrade:
disableWait: true
Description: Flux reconciliation overrides specifically for the Anchore Package
addons.anchoreEnterprise.adminPassword¶
Type: string
""
Description: Initial admin password used to authenticate to Anchore.
addons.anchoreEnterprise.enterprise¶
Type: object
licenseYaml: 'FULL LICENSE
'
Description: Anchore Enterprise functionality.
addons.anchoreEnterprise.enterprise.licenseYaml¶
Type: string
"FULL LICENSE\n"
Description: License for Anchore Enterprise. Enterprise is the only option available for the chart starting with chart major version 2.X. For formatting examples see https://repo1.dso.mil/big-bang/product/packages/CHART.md#enabling-enterprise-services
addons.anchoreEnterprise.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.anchoreEnterprise.sso.enabled¶
Type: bool
false
Description: Toggle SAML SSO for Anchore on and off. Enabling this option will auto-create any required secrets (Note: SSO requires an Enterprise license).
addons.anchoreEnterprise.sso.client_id¶
Type: string
""
Description: Anchore SAML client ID
addons.anchoreEnterprise.sso.role_attribute¶
Type: string
""
Description: Anchore SAML client role attribute
addons.anchoreEnterprise.database.host¶
Type: string
""
Description: Hostname of a pre-existing PostgreSQL database to use for Anchore. Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.
addons.anchoreEnterprise.database.port¶
Type: string
""
Description: Port of a pre-existing PostgreSQL database to use for Anchore.
addons.anchoreEnterprise.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
addons.anchoreEnterprise.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
addons.anchoreEnterprise.database.database¶
Type: string
""
Description: Database name to connect to on host (Note: database name CANNOT contain hyphens).
addons.anchoreEnterprise.redis.host¶
Type: string
""
Description: Hostname of a pre-existing Redis to use for Anchore Enterprise. Entering connection info will enable external redis and will auto-create any required secrets. Anchore only requires redis for enterprise deployments and will not provision an instance if using external
addons.anchoreEnterprise.redis.port¶
Type: string
""
Description: Port of a pre-existing Redis to use for Anchore Enterprise.
addons.anchoreEnterprise.redis.username¶
Type: string
""
Description: OPTIONAL: Username to connect to a pre-existing Redis (for password-only auth leave empty)
addons.anchoreEnterprise.redis.password¶
Type: string
""
Description: Password to connect to pre-existing Redis.
addons.anchoreEnterprise.values¶
Type: object
{}
Description: Values to passthrough to the anchore chart: https://repo1.dso.mil/big-bang/product/packages/anchore-enterprise.git
addons.anchoreEnterprise.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.mattermostOperator¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/mattermost-operator.git
tag: 1.25.7-bb.3
helmRepo:
chartName: mattermost-operator
repoName: registry1
tag: 1.25.7-bb.3
postRenderers: []
sourceType: git
values: {}
Description: Mattermost Operator package configuration.
addons.mattermostOperator.enabled¶
Type: bool
false
Description: Toggle deployment of Mattermost Operator.
addons.mattermostOperator.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.mattermostOperator.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Mattermost Operator Package
addons.mattermostOperator.values¶
Type: object
{}
Description: Values to passthrough to the mattermost operator chart: https://repo1.dso.mil/big-bang/product/packages/mattermost-operator.git
addons.mattermostOperator.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.mattermost.enabled¶
Type: bool
false
Description: Toggle deployment of Mattermost.
addons.mattermost.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.mattermost.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Mattermost
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Mattermost Package
addons.mattermost.enterprise¶
Type: object
enabled: false
existingSecret: ''
license: ''
Description: Mattermost Enterprise functionality.
addons.mattermost.enterprise.enabled¶
Type: bool
false
Description: Toggle the Mattermost Enterprise. This must be accompanied by a valid license input via Helm values OR an existing secret name for Mattermost to reference.
addons.mattermost.enterprise.license¶
Type: string
""
Description: License for Mattermost. This should be the entire contents of the license file from Mattermost (should be one line), example below license: “eyJpZCI6InIxM205bjR3eTdkYjludG95Z3RiOD—REST—IS—HIDDEN
addons.mattermost.enterprise.existingSecret¶
Type: string
""
Description: Pre existing secret created outside of Helm values with license for Mattermost.
addons.mattermost.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.mattermost.sso.enabled¶
Type: bool
false
Description: Toggle OIDC SSO for Mattermost on and off. Enabling this option will auto-create any required secrets.
addons.mattermost.sso.client_id¶
Type: string
""
Description: Mattermost OIDC client ID
addons.mattermost.sso.client_secret¶
Type: string
""
Description: Mattermost OIDC client secret
addons.mattermost.database.host¶
Type: string
""
Description: Hostname of a pre-existing PostgreSQL database to use for Mattermost. Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.
addons.mattermost.database.port¶
Type: string
""
Description: Port of a pre-existing PostgreSQL database to use for Mattermost.
addons.mattermost.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
addons.mattermost.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
addons.mattermost.database.database¶
Type: string
""
Description: Database name to connect to on host.
addons.mattermost.database.ssl_mode¶
Type: string
""
Description: SSL Mode to use when connecting to the database. Allowable values for this are viewable in the postgres documentation: https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-SSLMODE-STATEMENTS
addons.mattermost.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. Entering connection info will enable this option and will auto-create any required secrets. examples: “s3.amazonaws.com” “s3.us-gov-west-1.amazonaws.com” “minio.minio.svc.cluster.local:9000”
addons.mattermost.objectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint.
addons.mattermost.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
addons.mattermost.objectStorage.bucket¶
Type: string
""
Description: Bucket name to use for Mattermost - will be auto-created.
addons.mattermost.elasticsearch¶
Type: object
enabled: false
Description: Mattermost Elasticsearch integration - requires enterprise E20 license - https://docs.mattermost.com/deployment/elasticsearch.html Connection info defaults to the BB deployed Elastic, all values can be overridden via the “values” passthrough for other connections. See values spec in MM chart “elasticsearch” yaml block - https://repo1.dso.mil/big-bang/product/packages/mattermost.git
addons.mattermost.elasticsearch.enabled¶
Type: bool
false
Description: Toggle interaction with Elastic for optimized search indexing
addons.mattermost.values¶
Type: object
{}
Description: Values to passthrough to the Mattermost chart: https://repo1.dso.mil/big-bang/product/packages/mattermost.git
addons.mattermost.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.velero.enabled¶
Type: bool
false
Description: Toggle deployment of Velero.
addons.velero.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.velero.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Velero Package
addons.velero.values¶
Type: object
{}
Description: Values to passthrough to the Velero chart: https://repo1.dso.mil/big-bang/product/packages/velero.git
addons.velero.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.keycloak¶
Type: object
database:
database: ''
host: ''
password: ''
port: 5432
type: postgres
username: ''
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/keycloak.git
tag: 7.3.0-bb.0
helmRepo:
chartName: keycloak
repoName: registry1
tag: 7.3.0-bb.0
ingress:
cert: ''
gateway: ''
key: ''
postRenderers: []
sourceType: git
values: {}
Description: Keycloak package configuration.
addons.keycloak.enabled¶
Type: bool
false
Description: Toggle deployment of Keycloak.
addons.keycloak.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.keycloak.database.host¶
Type: string
""
Description: Hostname of a pre-existing database to use for Keycloak. Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.
addons.keycloak.database.type¶
Type: string
"postgres"
Description: Pre-existing database type (e.g. postgres) to use for Keycloak.
addons.keycloak.database.port¶
Type: int
5432
Description: Port of a pre-existing database to use for Keycloak.
addons.keycloak.database.database¶
Type: string
""
Description: Database name to connect to on host.
addons.keycloak.database.username¶
Type: string
""
Description: Username to connect as to external database, the user must have all privileges on the database.
addons.keycloak.database.password¶
Type: string
""
Description: Database password for the username used to connect to the existing database.
addons.keycloak.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Keycloak Package
addons.keycloak.ingress¶
Type: object
cert: ''
gateway: ''
key: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.keycloak.ingress.key¶
Type: string
""
Description: Certificate/Key pair to use as the certificate for exposing Keycloak Setting the ingress cert here will automatically create the volume and volumemounts in the Keycloak Package chart
addons.keycloak.values¶
Type: object
{}
Description: Values to passthrough to the keycloak chart: https://repo1.dso.mil/big-bang/product/packages/keycloak.git; WARNING: The upstream keycloak chart has some limitations on certain keys due to its templating architecture. Some of the offending keys are extraEnv, extraEnvFrom, extraVolumeMounts, and extraVolumes. These keys are set as strings when installing the chart, so subsequent overrides aren’t merged with existing values: they simply replace them. This means that if you set any of these keys in your overrides, you must include all the existing values you wish to keep from Big Bang’s overrides in addition to your own.
addons.keycloak.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.vault¶
Type: object
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: MutatingWebhookConfiguration
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/vault.git
tag: 0.34.1-bb.0
helmRepo:
chartName: vault
repoName: registry1
tag: 0.34.1-bb.0
ingress:
cert: ''
gateway: ''
key: ''
postRenderers: []
sourceType: git
values: {}
Description: Vault package configuration.
addons.vault.enabled¶
Type: bool
false
Description: Toggle deployment of Vault.
addons.vault.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.vault.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: MutatingWebhookConfiguration
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Vault Package
addons.vault.ingress¶
Type: object
cert: ''
gateway: ''
key: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.vault.ingress.key¶
Type: string
""
Description: Certificate/Key pair to use as the certificate for exposing Vault Setting the ingress cert here will automatically create the volume and volumemounts in the Vault package chart
addons.vault.values¶
Type: object
{}
Description: Values to passthrough to the vault chart: https://repo1.dso.mil/big-bang/product/packages/vault.git
addons.vault.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.metricsServer¶
Type: object
automountServiceAccountToken: true
enabled: auto
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/metrics-server.git
tag: 3.13.1-bb.1
helmRepo:
chartName: metrics-server
repoName: registry1
tag: 3.13.1-bb.1
namespace:
annotations: {}
create: false
labels: {}
name: kube-system
postRenderers: []
sourceType: git
values: {}
Description: Metrics Server package configuration.
addons.metricsServer.enabled¶
Type: string
"auto"
Description: Toggle deployment of metrics server Acceptable options are enabled: true, enabled: false, enabled: auto true = enabled / false = disabled / auto = automatic (Installs only if metrics API endpoint is not present)
addons.metricsServer.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.metricsServer.automountServiceAccountToken¶
Type: bool
true
Description: Enabled automount Service Account Token so that metrics-server fetches resource metrics from the kubelets
addons.metricsServer.namespace¶
Type: object
annotations: {}
create: false
labels: {}
name: kube-system
Description: Namespace settings for metrics-server. The default target namespace is kube-system; set namespace.name and namespace.create=true to deploy to and create a custom namespace.
addons.metricsServer.namespace.name¶
Type: string
"kube-system"
Description: Namespace to deploy metrics-server resources to.
addons.metricsServer.namespace.create¶
Type: bool
false
Description: Create the target namespace. Keep false when using an existing namespace such as kube-system.
addons.metricsServer.namespace.labels¶
Type: object
{}
Description: Labels to add to or override on the created namespace when namespace.create=true.
addons.metricsServer.namespace.annotations¶
Type: object
{}
Description: Annotations to add to the created namespace when namespace.create=true.
addons.metricsServer.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the metrics server Package
addons.metricsServer.values¶
Type: object
{}
Description: Values to passthrough to the metrics server chart: https://repo1.dso.mil/big-bang/product/packages/metrics-server.git
addons.metricsServer.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.harbor¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/harbor.git
tag: 1.19.2-bb.0
helmRepo:
chartName: harbor
repoName: registry1
tag: 1.19.2-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
values: {}
Description: Harbor package configuration.
addons.harbor.enabled¶
Type: bool
false
Description: Toggle deployment of harbor
addons.harbor.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.harbor.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Harbor Package
addons.harbor.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.harbor.values¶
Type: object
{}
Description: Values to pass through to Harbor chart: https://repo1.dso.mil/big-bang/product/packages/harbor.git
addons.harbor.postRenderers¶
Type: list
[]
Description: Post Renderers. See docs/postrenders.md
addons.thanos¶
Type: object
enabled: false
flux:
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/thanos.git
tag: 17.6.0-bb.0
helmRepo:
chartName: thanos
repoName: registry1
tag: 17.6.0-bb.0
ingress:
gateway: ''
objectStorage:
accessKey: ''
accessSecret: ''
bucket: ''
endpoint: ''
insecure: false
region: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
Description: Thanos package configuration.
addons.thanos.enabled¶
Type: bool
false
Description: Toggle deployment of thanos
addons.thanos.sso.enabled¶
Type: bool
false
Description: Toggle SSO for Thanos on and off
addons.thanos.sso.client_id¶
Type: string
""
Description: OIDC Client ID to use for Thanos
addons.thanos.sso.client_secret¶
Type: string
""
Description: OIDC Client Secret to use for Thanos
addons.thanos.objectStorage.endpoint¶
Type: string
""
Description: S3 compatible endpoint to use for connection information. examples: “s3.amazonaws.com” “s3.us-gov-west-1.amazonaws.com” “minio.minio.svc.cluster.local:9000” Note: Thanos does not require protocol prefix for URL.
addons.thanos.objectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
addons.thanos.objectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint.
addons.thanos.objectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. Unencoded string data. This should be placed in the secret values and then encrypted
addons.thanos.objectStorage.bucket¶
Type: string
""
Description: Bucket Name for Thanos examples: “Thanos-metrics”
addons.thanos.objectStorage.insecure¶
Type: bool
false
Description: Whether or not objectStorage connection should require HTTPS, if connecting to in-cluster object
addons.thanos.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.thanos.flux¶
Type: object
driftDetection:
ignore:
- paths:
- ''
target:
kind: Tenant
- paths:
- ''
target:
kind: Job
- paths:
- ''
target:
kind: StatefulSet
Description: Flux reconciliation overrides specifically for the Thanos Package
addons.thanos.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.externalSecrets.enabled¶
Type: bool
false
Description: Toggle deployment of external secrets
addons.externalSecrets.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.externalSecrets.flux¶
Type: object
{}
Description: Override flux settings for this package
addons.externalSecrets.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.mimir.enabled¶
Type: bool
false
Description: Toggle deployment of Mimir
addons.mimir.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.mimir.enterprise¶
Type: object
enabled: false
Description: Enable Mimir Enterprise
addons.mimir.minioObjectStorage¶
Type: object
bucketName: mimir
configSecret:
accessKey: minio
secretKey: minio123
defaultUserCredentials:
password: supersecret
username: mimir-user
enabled: false
Description: Enable Big Bang MinIO dependency chart for Mimir
addons.mimir.minioObjectStorage.configSecret¶
Type: object
accessKey: minio
secretKey: minio123
Description: MinIO root credentials
addons.mimir.minioObjectStorage.bucketName¶
Type: string
"mimir"
Description: Bucket name for the Mimir MinIO tenant bucket
addons.mimir.s3ObjectStorage¶
Type: object
accessKey: ''
accessSecret: ''
bucketName: ''
enabled: false
endpoint: ''
insecure: false
region: ''
Description: Configure Mimir to use S3 bucket
addons.mimir.s3ObjectStorage.region¶
Type: string
""
Description: S3 compatible region to use for connection information.
addons.mimir.s3ObjectStorage.accessKey¶
Type: string
""
Description: Access key for connecting to object storage endpoint. If using IRSA annotation this should be left blank.
addons.mimir.s3ObjectStorage.accessSecret¶
Type: string
""
Description: Secret key for connecting to object storage endpoint. If using IRSA annotation this should be left blank. Unencoded string data. This should be placed in the secret values and then encrypted
addons.mimir.s3ObjectStorage.bucketName¶
Type: string
""
Description: Bucket name for the Mimir bucket.
addons.mimir.s3ObjectStorage.insecure¶
Type: bool
false
Description: Whether or not objectStorage connection should require HTTPS, if connecting to in-cluster object
addons.mimir.kafkaIngestStorage¶
Type: object
brokerClusterDomain: ''
brokerHost: ''
brokerNetworkCIDR: ''
brokerPort: 9092
enabled: false
topic: mimir-ingest
Description: Configure Mimir to use external Kafka for ingest storage (Mimir 6.x+) When enabled, disables the classic gRPC push path and enables the Kafka-backed ingest storage path. For production, use a cloud-managed Kafka service (Amazon MSK, Confluent Cloud, Azure Event Hubs). The bundled kafka-native image in the mimir chart is for testing only and is not used here.
addons.mimir.kafkaIngestStorage.brokerHost¶
Type: string
""
Description: Kafka broker hostname (bootstrap broker). Examples: “b-1.cluster.kafka.us-east-1.amazonaws.com” (Amazon MSK), “pkc-xxxxx.us-east-1.aws.confluent.cloud” (Confluent Cloud)
addons.mimir.kafkaIngestStorage.brokerPort¶
Type: int
9092
Description: Kafka broker port. Use 9092 for plaintext, 9093 for TLS. For auth (SASL, IAM) or TLS client config, use values.upstream.mimir.structuredConfig.ingest_storage.kafka directly.
addons.mimir.kafkaIngestStorage.topic¶
Type: string
"mimir-ingest"
Description: Kafka topic name for Mimir ingest storage.
addons.mimir.kafkaIngestStorage.brokerNetworkCIDR¶
Type: string
""
Description: CIDR block of the network where Kafka brokers reside. When empty (default), no Kafka egress NetworkPolicy is rendered. When set, renders a scoped NetworkPolicy egress rule for distributor and ingester pods. Examples: “172.31.0.0/16” (MSK in a specific VPC), “10.0.0.0/8” (private cloud)
addons.mimir.kafkaIngestStorage.brokerClusterDomain¶
Type: string
""
Description: Cluster domain covering all Kafka brokers (builds a wildcard Istio ServiceEntry). Required when Istio REGISTRY_ONLY is enabled: MSK/Kafka redirects clients to multiple broker addresses after bootstrap, all of which must be registered. Strip the “b-N.” prefix from any broker FQDN to get this value. Example: “mimir-kafka-test.
addons.mimir.serviceAccountAnnotations¶
Type: object
{}
Description: Mimir Service Account Annotations
addons.mimir.flux¶
Type: object
{}
Description: Flux reconciliation overrides specifically for the Mimir Package
addons.headlamp¶
Type: object
enabled: false
flux: {}
git:
path: ./chart
repo: https://repo1.dso.mil/big-bang/product/packages/headlamp.git
tag: 0.44.0-bb.0
helmRepo:
chartName: headlamp
repoName: registry1
tag: 0.44.0-bb.0
ingress:
gateway: ''
postRenderers: []
sourceType: git
sso:
client_id: ''
client_secret: ''
enabled: false
values: {}
Description: Headlamp package configuration.
addons.headlamp.enabled¶
Type: bool
false
Description: Toggle deployment of headlamp
addons.headlamp.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
addons.headlamp.flux¶
Type: object
{}
Description: Override flux settings for this package
addons.headlamp.ingress¶
Type: object
gateway: ''
Description: Redirect the package ingress to a specific Istio Gateway (listed in istioGateway.values.gateways). The default is “public”.
addons.headlamp.sso.enabled¶
Type: bool
false
Description: Toggle OIDC SSO for Headlamp on and off. Enabling this option will auto-create any required secrets.
addons.headlamp.sso.client_id¶
Type: string
""
Description: Headlamp OIDC client ID
addons.headlamp.sso.client_secret¶
Type: string
""
Description: Headlamp OIDC client secret
wrapper¶
Type: object
git:
path: chart
repo: https://repo1.dso.mil/big-bang/product/packages/wrapper.git
tag: 0.4.15
helmRepo:
chartName: wrapper
repoName: registry1
tag: 0.4.15
sourceType: git
Description: Wrapper chart for integrating Big Bang components alongside a package
wrapper.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
wrapper.helmRepo.repoName¶
Type: string
"registry1"
Description: Repository holding OCI chart, corresponding to helmRepositories name
wrapper.helmRepo.chartName¶
Type: string
"wrapper"
Description: Name of the OCI chart in repo
wrapper.helmRepo.tag¶
Type: string
"0.4.15"
Description: Tag of the OCI chart in repo
wrapper.git.repo¶
Type: string
"https://repo1.dso.mil/big-bang/product/packages/wrapper.git"
Description: Git repo holding the wrapper helm chart, example: https://repo1.dso.mil/big-bang/product/packages/wrapper
wrapper.git.path¶
Type: string
"chart"
Description: Path inside of the git repo to find the helm chart, example: chart
wrapper.git.tag¶
Type: string
"0.4.15"
Description: Git tag to check out. Takes precedence over branch. More info, example: 0.0.2
packageConfiguration¶
Type: object
{}
Description: Select the package configuration contract. Leave version unset to retain the Big Bang 3.x custom-package behavior for every entry under packages. Set version: v1 to opt into canonical built-in package names in 3.x. The v1 discriminator remains part of the public contract and becomes the default in 4.x.
packages.sample¶
Type: object
bbCommonValues: true
configMaps: {}
dependsOn: []
enabled: false
flux: {}
git:
branch: null
commit: null
credentials:
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
existingSecret: ''
path: null
repo: null
semver: null
tag: null
helmRepo:
chartName: null
repoName: null
tag: null
includeDefaultDependsOn: true
istio: {}
kustomize: false
monitor: {}
namespace: {}
network: {}
passBigBangValues: false
postRenderers: []
secrets: {}
sourceType: git
values: {}
wrapper:
enabled: false
postRenderers: []
Description: Package name. Each package will be independently wrapped for Big Bang integration.
packages.sample.namespace¶
Type: object
{}
Description: Namespace settings for this package. Use namespace.labels to add custom labels or override labels rendered by Big Bang for this package namespace.
packages.sample.sourceType¶
Type: string
"git"
Description: Choose source type of “git” or “helmRepo”
packages.sample.wrapper.postRenderers¶
Type: list
[]
Description: After deployment, patch wrapper resources. More info
packages.sample.kustomize¶
Type: bool
false
Description: Use a kustomize deployment rather than Helm
packages.sample.helmRepo¶
Type: object
chartName: null
repoName: null
tag: null
Description: HelmRepo source is supported as an option for Helm deployments and is selected with sourceType: helmRepo.
packages.sample.helmRepo.tag¶
Type: string
nil
Description: Tag of the chart in the Helm repo, required
packages.sample.git¶
Type: object
branch: null
commit: null
credentials:
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
existingSecret: ''
path: null
repo: null
semver: null
tag: null
Description: Git source is supported for both Helm and Kustomize deployments and is selected with sourceType: git.
packages.sample.git.repo¶
Type: string
nil
Description: Git repo URL holding the helm chart for this package, required if using git
packages.sample.git.commit¶
Type: string
nil
Description: Git commit to check out. Takes precedence over semver, tag, and branch. More info
packages.sample.git.semver¶
Type: string
nil
Description: Git semVer tag expression to check out. Takes precedence over tag. More info
packages.sample.git.tag¶
Type: string
nil
Description: Git tag to check out. Takes precedence over branch. More info
packages.sample.git.existingSecret¶
Type: string
""
Description: Optional, alternative existing secret to use for git credentials, must be in the appropriate format: https://toolkit.fluxcd.io/components/source/gitrepositories/#https-authentication
packages.sample.git.credentials¶
Type: object
caFile: ''
knownHosts: ''
password: ''
privateKey: ''
publicKey: ''
username: ''
Description: Optional, alternative Chart created secrets with user defined values
packages.sample.git.credentials.username¶
Type: string
""
Description: HTTP git credentials, both username and password must be provided
packages.sample.git.credentials.caFile¶
Type: string
""
Description: HTTPS certificate authority file. Required for any repo with a self signed certificate
packages.sample.git.credentials.privateKey¶
Type: string
""
Description: SSH git credentials, privateKey, publicKey, and knownHosts must be provided
packages.sample.flux¶
Type: object
{}
Description: Override flux settings for this package
packages.sample.postRenderers¶
Type: list
[]
Description: After deployment, patch package resources. More info
packages.sample.dependsOn¶
Type: list
[]
Description: Specify dependencies for the package. Only used for HelmRelease, does not affect Kustomization. See here for a reference.
packages.sample.includeDefaultDependsOn¶
Type: bool
true
Description: Include default Big Bang package HelmRelease dependencies (gatekeeper, kyverno-policies, istio where applicable).
packages.sample.istio¶
Type: object
{}
Description: Package details for Istio. See wrapper values for settings.
packages.sample.monitor¶
Type: object
{}
Description: Package details for monitoring. See wrapper values for settings.
packages.sample.network¶
Type: object
{}
Description: Package details for network policies. See wrapper values for settings.
packages.sample.secrets¶
Type: object
{}
Description: Secrets that should be created prior to package installation. See wrapper values for settings.
packages.sample.configMaps¶
Type: object
{}
Description: ConfigMaps that should be created prior to package installation. See wrapper values for settings.
packages.sample.values¶
Type: object
{}
Description: Values to pass through to package Helm chart