+5 -2

helm/system-setup/Chart.lock

··· 2 2 - name: cloudnative-pg 3 3 repository: file://charts/cloudnative-pg 4 4 version: 0.26.0 5 5 - digest: sha256:d46807e0d885c76d3a39b218b34bef29e881a17ca47924f65020ae3616b22e3b 6 6 - generated: "2025-09-27T00:29:50.760394+02:00" 5 5 + - name: metrics-server 6 6 + repository: file://charts/metrics-server 7 7 + version: 3.13.0 8 8 + digest: sha256:a5b5d0681369d13bd43df164d0825e596f20f470055b010604efa81fc383ccb5 9 9 + generated: "2025-10-07T14:14:51.577283+02:00"

+3

helm/system-setup/Chart.yaml

··· 11 11 version: "0.26.0" 12 12 repository: "file://charts/cloudnative-pg" 13 13 condition: postgresql.enabled 14 14 + - name: metrics-server 15 15 + version: "3.x.x" 16 16 + repository: "file://charts/metrics-server"

+23

helm/system-setup/charts/metrics-server/.helmignore

··· 1 1 + # Patterns to ignore when building packages. 2 2 + # This supports shell glob matching, relative path matching, and 3 3 + # negation (prefixed with !). Only one pattern per line. 4 4 + .DS_Store 5 5 + # Common VCS dirs 6 6 + .git/ 7 7 + .gitignore 8 8 + .bzr/ 9 9 + .bzrignore 10 10 + .hg/ 11 11 + .hgignore 12 12 + .svn/ 13 13 + # Common backup files 14 14 + *.swp 15 15 + *.bak 16 16 + *.tmp 17 17 + *.orig 18 18 + *~ 19 19 + # Various IDEs 20 20 + .project 21 21 + .idea/ 22 22 + *.tmproj 23 23 + .vscode/

+181

helm/system-setup/charts/metrics-server/CHANGELOG.md

··· 1 1 + # Metrics Server Helm Chart Changelog 2 2 + 3 3 + > [!NOTE] 4 4 + > All notable changes to this project will be documented in this file; the format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). 5 5 + 6 6 + <!-- 7 7 + ### Added - For new features. 8 8 + ### Changed - For changes in existing functionality. 9 9 + ### Deprecated - For soon-to-be removed features. 10 10 + ### Removed - For now removed features. 11 11 + ### Fixed - For any bug fixes. 12 12 + ### Security - In case of vulnerabilities. 13 13 + --> 14 14 + 15 15 + ## [UNRELEASED] 16 16 + 17 17 + ## [3.13.0] - TBC 18 18 + 19 19 + ### Added 20 20 + 21 21 + - Add chart options to secure the connection between Metrics Server and the Kubernetes API Server. ([#1288](https://github.com/kubernetes-sigs/metrics-server/pull/1288)) _@mkilchhofer_ 22 22 + - Add `unhealthyPodEvictionPolicy` to the Metrics Server PDB as a user enabled feature. ([#1574](https://github.com/kubernetes-sigs/metrics-server/pull/1574)) @peterabarr 23 23 + 24 24 + ### Changed 25 25 + 26 26 + - Update the _Addon Resizer_ OCI image to [`1.8.23`](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.23). ([#1626](https://github.com/kubernetes-sigs/metrics-server/pull/1626)) _@stevehipwell_ 27 27 + - Update the _Metrics Server_ OCI image to [`0.8.0`](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.8.0). ([#1683](https://github.com/kubernetes-sigs/metrics-server/pull/1683)) _@stevehipwell_ 28 28 + 29 29 + ## [3.12.2] - 2024-10-07 30 30 + 31 31 + ### Added 32 32 + 33 33 + - Explicitly added the app protocol to the service. ([#1540](https://github.com/kubernetes-sigs/metrics-server/pull/1540)) _@ 34 34 + seankhliao_ 35 35 + 36 36 + ### Changed 37 37 + 38 38 + - Updated the _Metrics Server_ OCI image to [v0.7.2](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.2). ([#1568](https://github.com/kubernetes-sigs/metrics-server/pull/1568)) _@stevehipwell_ 39 39 + - Updated the _addonResizer_ OCI image to [1.8.21](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.21). ([#1504](https://github.com/kubernetes-sigs/metrics-server/pull/1504)) _@jimmy-ungerman_ 40 40 + 41 41 + ### Fixed 42 42 + 43 43 + - Fixed nanny's RoleBinding which contained a hard-coded namespace instead of the Helm's release namespace. ([#1479](https://github.com/kubernetes-sigs/metrics-server/pull/1479)) _@the-technat_ 44 44 + - Fixed the `ServiceMonitor` job label. ([#1568](https://github.com/kubernetes-sigs/metrics-server/pull/1568)) _@stevehipwell_ 45 45 + 46 46 + ## [3.12.1] - 2024-04-05 47 47 + 48 48 + ### Changed 49 49 + 50 50 + - Updated the _Metrics Server_ OCI image to [v0.7.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.1). ([#1461](https://github.com/kubernetes-sigs/metrics-server/pull/1461)) _@stevehipwell_ 51 51 + - Changed `Deployment` templating to ignore `schedulerName` when value is empty. ([#1475](https://github.com/kubernetes-sigs/metrics-server/pull/1475)) _@senges_ 52 52 + 53 53 + ## [3.12.0] - 2024-02-07 54 54 + 55 55 + ### Changed 56 56 + 57 57 + - Updated the _Metrics Server_ OCI image to [v0.7.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0). ([#1414](https://github.com/kubernetes-sigs/metrics-server/pull/1414)) [@stevehipwell](https://github.com/stevehipwell) 58 58 + - Updated the _addon-resizer_ OCI image to [v1.8.20](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.20). ([#1414](https://github.com/kubernetes-sigs/metrics-server/pull/1414)) [@stevehipwell](https://github.com/stevehipwell) 59 59 + 60 60 + ## [3.11.0] - 2023-08-03 61 61 + 62 62 + ### Added 63 63 + 64 64 + - Added default _Metrics Server_ resource requests. 65 65 + 66 66 + ### Changed 67 67 + 68 68 + - Updated the _Metrics Server_ OCI image to [v0.6.4](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.4). 69 69 + - Updated the _addon-resizer_ OCI image to [v1.8.19](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.19). 70 70 + 71 71 + ## [3.10.0] - 2023-04-12 72 72 + 73 73 + ### Added 74 74 + 75 75 + - Added support for running under PodSecurity restricted. 76 76 + 77 77 + ### Fixed 78 78 + 79 79 + - Fixed `auth-reader` role binding namespace to always use `kube-system`. 80 80 + - Fixed addon-resizer configuration. 81 81 + - Fixed container port default not having been updated to `10250`. 82 82 + 83 83 + ## [3.9.0] - 2023-03-28 84 84 + 85 85 + ### Added 86 86 + 87 87 + - Added autoscaling support via the addon-resizer. 88 88 + 89 89 + ### Changed 90 90 + 91 91 + - Updated the _Metrics Server_ OCI image to [v0.6.3](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3). 92 92 + 93 93 + ### Fixed 94 94 + 95 95 + - Fixed service labels/annotations. 96 96 + 97 97 + ## [3.8.4] - 2023-03-06 98 98 + 99 99 + ### Changed 100 100 + 101 101 + - Changed the image registry location to `registry.k8s.io`. 102 102 + 103 103 + ## [3.8.3] - 2022-12-08 104 104 + 105 105 + ### Added 106 106 + 107 107 + - Added support for topologySpreadConstraints. 108 108 + - Always set resource namespaces explicitly. 109 109 + - Allow configuring TLS on the APIService. 110 110 + - Enabled service monitor relabelling. 111 111 + - Added ability to set the scheduler name. 112 112 + - Added support for common labels. 113 113 + 114 114 + ### Changed 115 115 + 116 116 + - Updated the _Metrics Server_ OCI image to [v0.6.2](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2). 117 117 + 118 118 + ## [3.8.2] - 2022-02-23 119 119 + 120 120 + ### Changed 121 121 + 122 122 + - Changed chart to allow probes to be turned off completely (this is not advised unless you know what you're doing). 123 123 + 124 124 + ## [3.8.1] - 2022-02-09 125 125 + 126 126 + ### Changed 127 127 + 128 128 + - Updated the _Metrics Server_ OCI image to [v0.6.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1). 129 129 + 130 130 + ## [3.8.0] - 2022-02-08 131 131 + 132 132 + ### Added 133 133 + 134 134 + - Added support for unauthenticated access to the /metrics endpoint. 135 135 + - Added optional _Prometheus Operator_ `ServiceMonitor`. 136 136 + 137 137 + ### Changed 138 138 + 139 139 + - Updated the _Metrics Server_ OCI image to [v0.6.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.0). 140 140 + 141 141 + ## [3.7.0] - 2021-11-18 142 142 + 143 143 + ### Changed 144 144 + 145 145 + - Updated the _Metrics Server_ OCI image to [v0.5.2](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2). 146 146 + 147 147 + ## [3.6.0] - 2021-10-18 148 148 + 149 149 + ### Added 150 150 + 151 151 + - Added new `defaultArgs`` value to enable overriding the default arguments. 152 152 + 153 153 + ### Changed 154 154 + 155 155 + - Updated the _Metrics Server_ OCI image to [v0.5.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.1). 156 156 + 157 157 + ## [3.5.0] - 2021-10-07 158 158 + 159 159 + ### Added 160 160 + 161 161 + - Added initial Helm chart release from official repo. 162 162 + 163 163 + <!-- 164 164 + RELEASE LINKS 165 165 + --> 166 166 + [UNRELEASED]: https://github.com/kubernetes-sigs/metrics-server/tree/master/charts/metrics-server 167 167 + [3.13.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.13.0 168 168 + [3.12.2]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.12.2 169 169 + [3.12.1]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.12.1 170 170 + [3.12.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.12.0 171 171 + [3.11.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.11.0 172 172 + [3.10.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.10.0 173 173 + [3.9.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.9.0 174 174 + [3.8.4]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.4 175 175 + [3.8.3]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.3 176 176 + [3.8.2]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.2 177 177 + [3.8.1]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.1 178 178 + [3.8.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.0 179 179 + [3.7.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.7.0 180 180 + [3.6.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.6.0 181 181 + [3.5.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.5.0

+32

helm/system-setup/charts/metrics-server/Chart.yaml

··· 1 1 + annotations: 2 2 + artifacthub.io/changes: | 3 3 + - kind: added 4 4 + description: "Add chart options to secure the connection between Metrics Server and the Kubernetes API Server." 5 5 + - kind: added 6 6 + description: "Add `unhealthyPodEvictionPolicy` to the Metrics Server PDB as a user enabled feature." 7 7 + - kind: changed 8 8 + description: "Update the _Addon Resizer_ OCI image to [`1.8.23`](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.23)." 9 9 + - kind: changed 10 10 + description: "Update the _Metrics Server_ OCI image to [`0.8.0`](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.8.0)." 11 11 + apiVersion: v2 12 12 + appVersion: 0.8.0 13 13 + description: Metrics Server is a scalable, efficient source of container resource 14 14 + metrics for Kubernetes built-in autoscaling pipelines. 15 15 + home: https://github.com/kubernetes-sigs/metrics-server 16 16 + icon: https://avatars.githubusercontent.com/u/36015203?s=400&v=4 17 17 + keywords: 18 18 + - kubernetes 19 19 + - metrics-server 20 20 + - metrics 21 21 + maintainers: 22 22 + - name: stevehipwell 23 23 + url: https://github.com/stevehipwell 24 24 + - name: krmichel 25 25 + url: https://github.com/krmichel 26 26 + - name: endrec 27 27 + url: https://github.com/endrec 28 28 + name: metrics-server 29 29 + sources: 30 30 + - https://github.com/kubernetes-sigs/metrics-server 31 31 + type: application 32 32 + version: 3.13.0

+190

helm/system-setup/charts/metrics-server/README.md

··· 1 1 + # Kubernetes Metrics Server 2 2 + 3 3 + [Metrics Server](https://github.com/kubernetes-sigs/metrics-server/) is a scalable, efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines. 4 4 + 5 5 + ## Installing the Chart 6 6 + 7 7 + Before you can install the chart you will need to add the `metrics-server` repo to [Helm](https://helm.sh/). 8 8 + 9 9 + ```shell 10 10 + helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/ 11 11 + ``` 12 12 + 13 13 + After you've installed the repo you can install the chart. 14 14 + 15 15 + ```shell 16 16 + helm upgrade --install metrics-server metrics-server/metrics-server 17 17 + ``` 18 18 + 19 19 + ## Configuration 20 20 + 21 21 + The following table lists the configurable parameters of the _Metrics Server_ chart and their default values. 22 22 + 23 23 + | Parameter | Description | Default | 24 24 + | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | 25 25 + | `image.repository` | Image repository. | `registry.k8s.io/metrics-server/metrics-server` | 26 26 + | `image.tag` | Image tag, will override the default tag derived from the chart app version. | `""` | 27 27 + | `image.pullPolicy` | Image pull policy. | `IfNotPresent` | 28 28 + | `imagePullSecrets` | Image pull secrets. | `[]` | 29 29 + | `nameOverride` | Override the `name` of the chart. | `nil` | 30 30 + | `fullnameOverride` | Override the `fullname` of the chart. | `nil` | 31 31 + | `serviceAccount.create` | If `true`, create a new service account. | `true` | 32 32 + | `serviceAccount.annotations` | Annotations to add to the service account. | `{}` | 33 33 + | `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the full name template. | `nil` | 34 34 + | `serviceAccount.secrets` | The list of secrets mountable by this service account. See <https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets> | `[]` | 35 35 + | `rbac.create` | If `true`, create the RBAC resources. | `true` | 36 36 + | `rbac.pspEnabled` | If `true`, create a pod security policy resource, unless Kubernetes version is 1.25 or later. | `false` | 37 37 + | `apiService.create` | If `true`, create the `v1beta1.metrics.k8s.io` API service. You typically want this enabled! If you disable API service creation you have to manage it outside of this chart for e.g horizontal pod autoscaling to work with this release. | `true` | 38 38 + | `apiService.annotations` | Annotations to add to the API service | `{}` | 39 39 + | `apiService.insecureSkipTLSVerify` | Specifies whether to skip TLS verification (NOTE: this setting is not a proxy for the `--kubelet-insecure-tls` metrics-server flag) | `true` | 40 40 + | `apiService.caBundle` | The PEM encoded CA bundle for TLS verification | `""` | 41 41 + | `commonLabels` | Labels to add to each object of the chart. | `{}` | 42 42 + | `podLabels` | Labels to add to the pod. | `{}` | 43 43 + | `podAnnotations` | Annotations to add to the pod. | `{}` | 44 44 + | `podSecurityContext` | Security context for the pod. | `{}` | 45 45 + | `securityContext` | Security context for the _metrics-server_ container. | _See values.yaml_ | 46 46 + | `priorityClassName` | Priority class name to use. | `system-cluster-critical` | 47 47 + | `containerPort` | port for the _metrics-server_ container. | `10250` | 48 48 + | `hostNetwork.enabled` | If `true`, start _metric-server_ in hostNetwork mode. You would require this enabled if you use alternate overlay networking for pods and API server unable to communicate with metrics-server. As an example, this is required if you use Weave network on EKS. | `false` | 49 49 + | `replicas` | Number of replicas to run. | `1` | 50 50 + | `revisionHistoryLimit` | Number of revisions to keep. | `nil` | 51 51 + | `updateStrategy` | Customise the default update strategy. | `{}` | 52 52 + | `podDisruptionBudget.enabled` | If `true`, create `PodDisruptionBudget` resource. | `{}` | 53 53 + | `podDisruptionBudget.minAvailable` | Set the `PodDisruptionBudget` minimum available pods. | `nil` | 54 54 + | `podDisruptionBudget.maxUnavailable` | Set the `PodDisruptionBudget` maximum unavailable pods. | `nil` | 55 55 + | `podDisruptionBudget.maxUnavailable` | Set the `PodDisruptionBudget` maximum unavailable pods. | `nil` | 56 56 + | `podDisruptionBudget.unhealthyPodEvictionPolicy` | Unhealthy pod eviction policy for the PDB. | `nil` | 57 57 + | `defaultArgs` | Default arguments to pass to the _metrics-server_ command. | See _values.yaml_ | 58 58 + | `args` | Additional arguments to pass to the _metrics-server_ command. | `[]` | 59 59 + | `livenessProbe` | Liveness probe. | See _values.yaml_ | 60 60 + | `readinessProbe` | Readiness probe. | See _values.yaml_ | 61 61 + | `service.type` | Service type. | `ClusterIP` | 62 62 + | `service.port` | Service port. | `443` | 63 63 + | `service.annotations` | Annotations to add to the service. | `{}` | 64 64 + | `service.labels` | Labels to add to the service. | `{}` | 65 65 + | `addonResizer.enabled` | If `true`, run the addon-resizer as a sidecar to automatically scale resource requests with cluster size. | `false` | 66 66 + | `addonResizer.securityContext` | Security context for the _metrics_server_container. | _See values.yaml | 67 67 + | `addonResizer.image.repository` | addon-resizer image repository | `registry.k8s.io/autoscaling/addon-resizer` | 68 68 + | `addonResizer.image.tag` | addon-resizer image tag | `1.8.23` | 69 69 + | `addonResizer.resources` | Resource requests and limits for the _nanny_ container. | `{ requests: { cpu: 40m, memory: 25Mi }, limits: { cpu: 40m, memory: 25Mi } }` | 70 70 + | `addonResizer.nanny.cpu` | The base CPU requirement. | `0m` | 71 71 + | `addonResizer.nanny.extraCPU` | The amount of CPU to add per node. | `1m` | 72 72 + | `addonResizer.nanny.memory` | The base memory requirement. | `0Mi` | 73 73 + | `addonResizer.nanny.extraMemory` | The amount of memory to add per node. | `2Mi` | 74 74 + | `addonResizer.nanny.minClusterSize` | Specifies the smallest number of nodes resources will be scaled to. | `100` | 75 75 + | `addonResizer.nanny.pollPeriod` | The time, in milliseconds, to poll the dependent container. | `300000` | 76 76 + | `addonResizer.nanny.threshold` | A number between 0-100. The dependent's resources are rewritten when they deviate from expected by more than threshold. | `5` | 77 77 + | `metrics.enabled` | If `true`, allow unauthenticated access to `/metrics`. | `false` | 78 78 + | `serviceMonitor.enabled` | If `true`, create a _Prometheus_ service monitor. This needs `metrics.enabled` to be `true`. | `false` | 79 79 + | `serviceMonitor.additionalLabels` | Additional labels to be set on the ServiceMonitor. | `{}` | 80 80 + | `serviceMonitor.metricRelabelings` | _Prometheus_ metric relabeling. | `[]` | 81 81 + | `serviceMonitor.relabelings` | _Prometheus_ relabeling. | `[]` | 82 82 + | `serviceMonitor.interval` | _Prometheus_ scrape frequency. | `1m` | 83 83 + | `serviceMonitor.scrapeTimeout` | _Prometheus_ scrape timeout. | `10s` | 84 84 + | `resources` | Resource requests and limits for the _metrics-server_ container. See <https://github.com/kubernetes-sigs/metrics-server#scaling> | `{ requests: { cpu: 100m, memory: 200Mi }}` | 85 85 + | `extraVolumeMounts` | Additional volume mounts for the _metrics-server_ container. | `[]` | 86 86 + | `extraVolumes` | Additional volumes for the pod. | `[]` | 87 87 + | `nodeSelector` | Node labels for pod assignment. | `{}` | 88 88 + | `tolerations` | Tolerations for pod assignment. | `[]` | 89 89 + | `affinity` | Affinity for pod assignment. | `{}` | 90 90 + | `topologySpreadConstraints` | Pod Topology Spread Constraints. | `[]` | 91 91 + | `deploymentAnnotations` | Annotations to add to the deployment. | `{}` | 92 92 + | `schedulerName` | scheduler to set to the deployment. | `""` | 93 93 + | `dnsConfig` | Set the dns configuration options for the deployment. | `{}` | 94 94 + | `tmpVolume` | Volume to be mounted in Pods for temporary files. | `{"emptyDir":{}}` | 95 95 + | `tls.type` | TLS option to use. Either use `metrics-server` for self-signed certificates, `helm`, `cert-manager` or `existingSecret`. | `"metrics-server"` | 96 96 + | `tls.clusterDomain` | Kubernetes cluster domain. Used to configure Subject Alt Names for the certificate when using `tls.type` `helm` or `cert-manager`. | `"cluster.local"` | 97 97 + | `tls.certManager.addInjectorAnnotations` | Automatically add the cert-manager.io/inject-ca-from annotation to the APIService resource. | `true` | 98 98 + | `tls.certManager.existingIssuer.enabled` | Use an existing cert-manager issuer | `false` | 99 99 + | `tls.certManager.existingIssuer.kind` | Kind of the existing cert-manager issuer | `"Issuer"` | 100 100 + | `tls.certManager.existingIssuer.name` | Name of the existing cert-manager issuer | `"my-issuer"` | 101 101 + | `tls.certManager.duration` | Set the requested duration (i.e. lifetime) of the Certificate. | `""` | 102 102 + | `tls.certManager.renewBefore` | How long before the currently issued certificate’s expiry cert-manager should renew the certificate. | `""` | 103 103 + | `tls.certManager.annotations` | Add extra annotations to the Certificate resource | `{}` | 104 104 + | `tls.certManager.labels` | Add extra labels to the Certificate resource | `{}` | 105 105 + | `tls.helm.certDurationDays` | Cert validity duration in days | `365` | 106 106 + | `tls.helm.lookup` | Use helm lookup function to reuse Secret created in previous helm install | `true` | 107 107 + | `tls.existingSecret.lookup` | Use helm lookup function to provision `apiService.caBundle` | `true` | 108 108 + | `tls.existingSecret.name` | Name of the existing Secret to use for TLS | `""` | 109 109 + 110 110 + ## Hardening metrics-server 111 111 + 112 112 + By default, metrics-server is using a self-signed certificate which is generated during startup. The `APIservice` resource is registered with `.spec.insecureSkipTLSVerify` set to `true` as you can see here: 113 113 + 114 114 + ```yaml 115 115 + apiVersion: apiregistration.k8s.io/v1 116 116 + kind: APIService 117 117 + metadata: 118 118 + name: v1beta1.metrics.k8s.io 119 119 + spec: 120 120 + #.. 121 121 + insecureSkipTLSVerify: true # <-- see here 122 122 + service: 123 123 + name: metrics-server 124 124 + #.. 125 125 + ``` 126 126 + 127 127 + To harden metrics-server, you have these options described in the following section. 128 128 + 129 129 + ### Option 1: Let helm generate a self-signed certificate 130 130 + 131 131 + This option is probably the easiest solution for you. We delegate the process to generate a self-signed certificate to helm. 132 132 + As helm generates them during deploy time, helm can also inject the `apiService.caBundle` for you. 133 133 + 134 134 + **The only disadvantage of using this method is that it is not GitOps friendly** (e.g. Argo CD). If you are using one of these 135 135 + GitOps tools with drift detection, it will always detect changes. However if you are deploying the helm chart via Terraform 136 136 + for example (or maybe even Flux), this method is perfectly fine. 137 137 + 138 138 + To use this method, please setup your values file like this: 139 139 + 140 140 + ```yaml 141 141 + apiService: 142 142 + insecureSkipTLSVerify: false 143 143 + tls: 144 144 + type: helm 145 145 + ``` 146 146 + 147 147 + ### Option 2: Use cert-manager 148 148 + 149 149 + > **Requirement:** cert-manager needs to be installed before you install metrics-server 150 150 + 151 151 + To use this method, please setup your values file like this: 152 152 + 153 153 + ```yaml 154 154 + apiService: 155 155 + insecureSkipTLSVerify: false 156 156 + tls: 157 157 + type: cert-manager 158 158 + ``` 159 159 + 160 160 + There are other optional parameters, if you want to customize the behavior of the certificate even more. 161 161 + 162 162 + ### Option 3: Use existing Secret 163 163 + 164 164 + This option allows you to reuse an existing Secret. This Secrets can have an arbitrary origin, e.g. 165 165 + 166 166 + - Created via kubectl / Terraform / etc. 167 167 + - Synced from a secret management solution like AWS Secrets Manager, HashiCorp Vault, etc. 168 168 + 169 169 + When using this type of TLS option, the keys `tls.key` and the `tls.crt` key must be provided in the data field of the 170 170 + existing Secret. 171 171 + 172 172 + You need to pass the certificate of the issuing CA (or the certificate itself) via `apiService.caBundle` to ensure 173 173 + proper configuration of the `APIservice` resource. Otherwise you cannot set `apiService.insecureSkipTLSVerify` to 174 174 + `false`. 175 175 + 176 176 + To use this method, please setup your values file like this: 177 177 + 178 178 + ```yaml 179 179 + apiService: 180 180 + insecureSkipTLSVerify: false 181 181 + caBundle: | 182 182 + -----BEGIN CERTIFICATE----- 183 183 + ... 184 184 + -----END CERTIFICATE----- 185 185 + 186 186 + tls: 187 187 + type: existingSecret 188 188 + existingSecret: 189 189 + name: metrics-server-existing 190 190 + ```

+9

helm/system-setup/charts/metrics-server/RELEASE.md

··· 1 1 + ### Added 2 2 + 3 3 + - Add chart options to secure the connection between Metrics Server and the Kubernetes API Server. ([#1288](https://github.com/kubernetes-sigs/metrics-server/pull/1288)) _@mkilchhofer_ 4 4 + - Add `unhealthyPodEvictionPolicy` to the Metrics Server PDB as a user enabled feature. ([#1574](https://github.com/kubernetes-sigs/metrics-server/pull/1574)) @peterabarr 5 5 + 6 6 + ### Changed 7 7 + 8 8 + - Update the _Addon Resizer_ OCI image to [`1.8.23`](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.23). ([#1626](https://github.com/kubernetes-sigs/metrics-server/pull/1626)) _@stevehipwell_ 9 9 + - Update the _Metrics Server_ OCI image to [`0.8.0`](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.8.0). ([#1683](https://github.com/kubernetes-sigs/metrics-server/pull/1683)) _@stevehipwell_

+2

helm/system-setup/charts/metrics-server/ci/ci-values.yaml

··· 1 1 + args: 2 2 + - --kubelet-insecure-tls

+8

helm/system-setup/charts/metrics-server/ci/tls-certManager-values.yaml

··· 1 1 + args: 2 2 + - --kubelet-insecure-tls 3 3 + 4 4 + apiService: 5 5 + insecureSkipTLSVerify: false 6 6 + 7 7 + tls: 8 8 + type: cert-manager

+12

helm/system-setup/charts/metrics-server/ci/tls-existingSecret-values.yaml

··· 1 1 + args: 2 2 + - --kubelet-insecure-tls 3 3 + 4 4 + ## Set via GH action (step "Prepare existing secret test scenario") 5 5 + # apiService: 6 6 + # insecureSkipTLSVerify: false 7 7 + # caBundle: | 8 8 + 9 9 + tls: 10 10 + type: existingSecret 11 11 + existingSecret: 12 12 + name: metrics-server-existing

+8

helm/system-setup/charts/metrics-server/ci/tls-helm-values.yaml

··· 1 1 + args: 2 2 + - --kubelet-insecure-tls 3 3 + 4 4 + apiService: 5 5 + insecureSkipTLSVerify: false 6 6 + 7 7 + tls: 8 8 + type: helm

+7

helm/system-setup/charts/metrics-server/templates/NOTES.txt

··· 1 1 + *********************************************************************** 2 2 + * Metrics Server * 3 3 + *********************************************************************** 4 4 + Chart version: {{ .Chart.Version }} 5 5 + App version: {{ .Chart.AppVersion }} 6 6 + Image tag: {{ include "metrics-server.image" . }} 7 7 + ***********************************************************************

+102

helm/system-setup/charts/metrics-server/templates/_helpers.tpl

··· 1 1 + {{/* 2 2 + Expand the name of the chart. 3 3 + */}} 4 4 + {{- define "metrics-server.name" -}} 5 5 + {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} 6 6 + {{- end }} 7 7 + 8 8 + {{/* 9 9 + Create a default fully qualified app name. 10 10 + We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). 11 11 + If release name contains chart name it will be used as a full name. 12 12 + */}} 13 13 + {{- define "metrics-server.fullname" -}} 14 14 + {{- if .Values.fullnameOverride }} 15 15 + {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} 16 16 + {{- else }} 17 17 + {{- $name := default .Chart.Name .Values.nameOverride }} 18 18 + {{- if contains $name .Release.Name }} 19 19 + {{- .Release.Name | trunc 63 | trimSuffix "-" }} 20 20 + {{- else }} 21 21 + {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} 22 22 + {{- end }} 23 23 + {{- end }} 24 24 + {{- end }} 25 25 + 26 26 + {{/* 27 27 + Create chart name and version as used by the chart label. 28 28 + */}} 29 29 + {{- define "metrics-server.chart" -}} 30 30 + {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} 31 31 + {{- end }} 32 32 + 33 33 + {{/* 34 34 + Common labels 35 35 + */}} 36 36 + {{- define "metrics-server.labels" -}} 37 37 + helm.sh/chart: {{ include "metrics-server.chart" . }} 38 38 + {{ include "metrics-server.selectorLabels" . }} 39 39 + {{- if .Chart.AppVersion }} 40 40 + app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} 41 41 + {{- end }} 42 42 + app.kubernetes.io/managed-by: {{ .Release.Service }} 43 43 + {{- if .Values.commonLabels }} 44 44 + {{ toYaml .Values.commonLabels }} 45 45 + {{- end }} 46 46 + {{- end }} 47 47 + 48 48 + {{/* 49 49 + Selector labels 50 50 + */}} 51 51 + {{- define "metrics-server.selectorLabels" -}} 52 52 + app.kubernetes.io/name: {{ include "metrics-server.name" . }} 53 53 + app.kubernetes.io/instance: {{ .Release.Name }} 54 54 + {{- end }} 55 55 + 56 56 + {{/* 57 57 + Create the name of the service account to use 58 58 + */}} 59 59 + {{- define "metrics-server.serviceAccountName" -}} 60 60 + {{- if .Values.serviceAccount.create }} 61 61 + {{- default (include "metrics-server.fullname" .) .Values.serviceAccount.name }} 62 62 + {{- else }} 63 63 + {{- default "default" .Values.serviceAccount.name }} 64 64 + {{- end }} 65 65 + {{- end }} 66 66 + 67 67 + {{/* 68 68 + The image to use 69 69 + */}} 70 70 + {{- define "metrics-server.image" -}} 71 71 + {{- printf "%s:%s" .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) }} 72 72 + {{- end }} 73 73 + 74 74 + {{/* 75 75 + The image to use for the addon resizer 76 76 + */}} 77 77 + {{- define "metrics-server.addonResizer.image" -}} 78 78 + {{- printf "%s:%s" .Values.addonResizer.image.repository .Values.addonResizer.image.tag }} 79 79 + {{- end }} 80 80 + 81 81 + {{/* 82 82 + ConfigMap name of addon resizer 83 83 + */}} 84 84 + {{- define "metrics-server.addonResizer.configMap" -}} 85 85 + {{- printf "%s-%s" (include "metrics-server.fullname" .) "nanny-config" }} 86 86 + {{- end }} 87 87 + 88 88 + {{/* 89 89 + Role name of addon resizer 90 90 + */}} 91 91 + {{- define "metrics-server.addonResizer.role" -}} 92 92 + {{ printf "system:%s-nanny" (include "metrics-server.fullname" .) }} 93 93 + {{- end }} 94 94 + 95 95 + {{/* Get PodDisruptionBudget API Version */}} 96 96 + {{- define "metrics-server.pdb.apiVersion" -}} 97 97 + {{- if and (.Capabilities.APIVersions.Has "policy/v1") (semverCompare ">= 1.21-0" .Capabilities.KubeVersion.Version) -}} 98 98 + {{- print "policy/v1" -}} 99 99 + {{- else -}} 100 100 + {{- print "policy/v1beta1" -}} 101 101 + {{- end -}} 102 102 + {{- end -}}

+71

helm/system-setup/charts/metrics-server/templates/apiservice.yaml

··· 1 1 + {{- $altNames := list }} 2 2 + {{- $certs := dict }} 3 3 + {{- $previous := dict }} 4 4 + 5 5 + {{- if eq .Values.tls.type "helm" }} 6 6 + {{- $previous = lookup "v1" "Secret" .Release.Namespace (include "metrics-server.fullname" .) }} 7 7 + {{- $commonName := include "metrics-server.fullname" . }} 8 8 + {{- $ns := .Release.Namespace }} 9 9 + {{- $altNames = append $altNames (printf "%s.%s" $commonName $ns) }} 10 10 + {{- $altNames = append $altNames (printf "%s.%s.svc" $commonName $ns) }} 11 11 + {{- $altNames = append $altNames (printf "%s.%s.svc.%s" $commonName $ns .Values.tls.clusterDomain) }} 12 12 + {{- $certs = genSelfSignedCert $commonName nil $altNames (int .Values.tls.helm.certDurationDays) }} 13 13 + apiVersion: v1 14 14 + kind: Secret 15 15 + metadata: 16 16 + name: {{ include "metrics-server.fullname" . }} 17 17 + labels: 18 18 + {{- include "metrics-server.labels" . | nindent 4 }} 19 19 + type: Opaque 20 20 + data: 21 21 + {{- if and $previous .Values.tls.helm.lookup }} 22 22 + tls.crt: {{ index $previous.data "tls.crt" }} 23 23 + tls.key: {{ index $previous.data "tls.key" }} 24 24 + {{- else }} 25 25 + tls.crt: {{ $certs.Cert| b64enc | quote }} 26 26 + tls.key: {{ $certs.Key | b64enc | quote }} 27 27 + {{- end }} 28 28 + {{- end }} 29 29 + --- 30 30 + {{- $existing := dict }} 31 31 + {{- if .Values.apiService.create }} 32 32 + {{- if and (eq .Values.tls.type "existingSecret") .Values.tls.existingSecret.lookup }} 33 33 + {{- $existing := lookup "v1" "Secret" .Release.Namespace .Values.tls.existingSecret.name }} 34 34 + {{- end }} 35 35 + apiVersion: apiregistration.k8s.io/v1 36 36 + kind: APIService 37 37 + metadata: 38 38 + name: v1beta1.metrics.k8s.io 39 39 + labels: 40 40 + {{- include "metrics-server.labels" . | nindent 4 }} 41 41 + {{- if or .Values.apiService.annotations .Values.tls.certManager.addInjectorAnnotations }} 42 42 + annotations: 43 43 + {{- if and (eq .Values.tls.type "cert-manager") .Values.tls.certManager.addInjectorAnnotations }} 44 44 + cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "metrics-server.fullname" . }} 45 45 + {{- end }} 46 46 + {{- with .Values.apiService.annotations }} 47 47 + {{- toYaml . | nindent 4 }} 48 48 + {{- end }} 49 49 + {{- end }} 50 50 + spec: 51 51 + {{- if eq .Values.tls.type "helm" }} 52 52 + {{- if and $previous .Values.tls.helm.lookup }} 53 53 + caBundle: {{ index $previous.data "tls.crt" }} 54 54 + {{- else }} 55 55 + caBundle: {{ $certs.Cert | b64enc }} 56 56 + {{- end }} 57 57 + {{- else if $existing }} 58 58 + caBundle: {{ index $existing.data "tls.crt" }} 59 59 + {{- else if and .Values.apiService.caBundle (ne .Values.tls.type "cert-manager") }} 60 60 + caBundle: {{ .Values.apiService.caBundle | b64enc }} 61 61 + {{- end }} 62 62 + group: metrics.k8s.io 63 63 + groupPriorityMinimum: 100 64 64 + insecureSkipTLSVerify: {{ .Values.apiService.insecureSkipTLSVerify }} 65 65 + service: 66 66 + name: {{ include "metrics-server.fullname" . }} 67 67 + namespace: {{ .Release.Namespace }} 68 68 + port: {{ .Values.service.port }} 69 69 + version: v1beta1 70 70 + versionPriority: 100 71 71 + {{- end }}

+47

helm/system-setup/charts/metrics-server/templates/certificate.yaml

··· 1 1 + {{- if eq .Values.tls.type "cert-manager" }} 2 2 + {{- if not .Values.tls.certManager.existingIssuer.enabled }} 3 3 + apiVersion: cert-manager.io/v1 4 4 + kind: Issuer 5 5 + metadata: 6 6 + annotations: 7 7 + {{- toYaml .Values.additionalAnnotations | nindent 4 }} 8 8 + name: {{ include "metrics-server.fullname" . }}-issuer 9 9 + namespace: {{ .Release.Namespace }} 10 10 + spec: 11 11 + selfSigned: {} 12 12 + {{- end }} 13 13 + --- 14 14 + apiVersion: cert-manager.io/v1 15 15 + kind: Certificate 16 16 + metadata: 17 17 + name: {{ include "metrics-server.fullname" . }} 18 18 + namespace: {{ .Release.Namespace }} 19 19 + spec: 20 20 + commonName: {{ include "metrics-server.fullname" . }} 21 21 + dnsNames: 22 22 + - {{ include "metrics-server.fullname" . }}.{{ .Release.Namespace }} 23 23 + - {{ include "metrics-server.fullname" . }}.{{ .Release.Namespace }}.svc 24 24 + - {{ include "metrics-server.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.tls.clusterDomain }} 25 25 + secretName: {{ include "metrics-server.fullname" . }} 26 26 + usages: 27 27 + - server auth 28 28 + - client auth 29 29 + privateKey: 30 30 + algorithm: RSA 31 31 + size: 2048 32 32 + {{- with .Values.tls.certManager.duration }} 33 33 + duration: {{ . }} 34 34 + {{- end }} 35 35 + {{- with .Values.tls.certManager.renewBefore }} 36 36 + renewBefore: {{ . }} 37 37 + {{- end }} 38 38 + issuerRef: 39 39 + {{- if .Values.tls.certManager.existingIssuer.enabled }} 40 40 + name: {{ .Values.tls.certManager.existingIssuer.name }} 41 41 + kind: {{ .Values.tls.certManager.existingIssuer.kind }} 42 42 + {{- else }} 43 43 + name: {{ include "metrics-server.fullname" . }}-issuer 44 44 + kind: Issuer 45 45 + {{- end }} 46 46 + group: cert-manager.io 47 47 + {{- end }}

+21

helm/system-setup/charts/metrics-server/templates/clusterrole-aggregated-reader.yaml

··· 1 1 + {{- if .Values.rbac.create -}} 2 2 + apiVersion: rbac.authorization.k8s.io/v1 3 3 + kind: ClusterRole 4 4 + metadata: 5 5 + name: {{ printf "system:%s-aggregated-reader" (include "metrics-server.name" .) }} 6 6 + labels: 7 7 + {{- include "metrics-server.labels" . | nindent 4 }} 8 8 + rbac.authorization.k8s.io/aggregate-to-admin: "true" 9 9 + rbac.authorization.k8s.io/aggregate-to-edit: "true" 10 10 + rbac.authorization.k8s.io/aggregate-to-view: "true" 11 11 + rules: 12 12 + - apiGroups: 13 13 + - metrics.k8s.io 14 14 + resources: 15 15 + - pods 16 16 + - nodes 17 17 + verbs: 18 18 + - get 19 19 + - list 20 20 + - watch 21 21 + {{- end -}}

+13

helm/system-setup/charts/metrics-server/templates/clusterrole-nanny.yaml

··· 1 1 + {{- if and .Values.rbac.create .Values.addonResizer.enabled -}} 2 2 + apiVersion: rbac.authorization.k8s.io/v1 3 3 + kind: ClusterRole 4 4 + metadata: 5 5 + name: {{ printf "system:%s-nanny" (include "metrics-server.fullname" .) }} 6 6 + labels: 7 7 + {{- include "metrics-server.labels" . | nindent 4 }} 8 8 + rules: 9 9 + - nonResourceURLs: 10 10 + - /metrics 11 11 + verbs: 12 12 + - get 13 13 + {{- end -}}

+37

helm/system-setup/charts/metrics-server/templates/clusterrole.yaml

··· 1 1 + {{- if .Values.rbac.create -}} 2 2 + apiVersion: rbac.authorization.k8s.io/v1 3 3 + kind: ClusterRole 4 4 + metadata: 5 5 + name: {{ printf "system:%s" (include "metrics-server.fullname" .) }} 6 6 + labels: 7 7 + {{- include "metrics-server.labels" . | nindent 4 }} 8 8 + rules: 9 9 + - apiGroups: 10 10 + - "" 11 11 + resources: 12 12 + - nodes/metrics 13 13 + verbs: 14 14 + - get 15 15 + - apiGroups: 16 16 + - "" 17 17 + resources: 18 18 + - pods 19 19 + - nodes 20 20 + - namespaces 21 21 + - configmaps 22 22 + verbs: 23 23 + - get 24 24 + - list 25 25 + - watch 26 26 + {{- if .Values.rbac.pspEnabled }} 27 27 + - apiGroups: 28 28 + - extensions 29 29 + - policy 30 30 + resources: 31 31 + - podsecuritypolicies 32 32 + resourceNames: 33 33 + - {{ printf "privileged-%s" (include "metrics-server.fullname" .) }} 34 34 + verbs: 35 35 + - use 36 36 + {{- end -}} 37 37 + {{- end -}}

+16

helm/system-setup/charts/metrics-server/templates/clusterrolebinding-auth-delegator.yaml

··· 1 1 + {{- if .Values.rbac.create -}} 2 2 + apiVersion: rbac.authorization.k8s.io/v1 3 3 + kind: ClusterRoleBinding 4 4 + metadata: 5 5 + name: {{ printf "%s:system:auth-delegator" (include "metrics-server.fullname" .) }} 6 6 + labels: 7 7 + {{- include "metrics-server.labels" . | nindent 4 }} 8 8 + roleRef: 9 9 + apiGroup: rbac.authorization.k8s.io 10 10 + kind: ClusterRole 11 11 + name: system:auth-delegator 12 12 + subjects: 13 13 + - kind: ServiceAccount 14 14 + name: {{ include "metrics-server.serviceAccountName" . }} 15 15 + namespace: {{ .Release.Namespace }} 16 16 + {{- end -}}

+18

helm/system-setup/charts/metrics-server/templates/clusterrolebinding-nanny.yaml

··· 1 1 + {{- if .Values.rbac.create -}} 2 2 + {{- if .Values.addonResizer.enabled -}} 3 3 + apiVersion: rbac.authorization.k8s.io/v1 4 4 + kind: ClusterRoleBinding 5 5 + metadata: 6 6 + name: {{ printf "system:%s-nanny" (include "metrics-server.fullname" .) }} 7 7 + labels: 8 8 + {{- include "metrics-server.labels" . | nindent 4 }} 9 9 + roleRef: 10 10 + apiGroup: rbac.authorization.k8s.io 11 11 + kind: ClusterRole 12 12 + name: system:{{ template "metrics-server.fullname" . }}-nanny 13 13 + subjects: 14 14 + - kind: ServiceAccount 15 15 + name: {{ include "metrics-server.serviceAccountName" . }} 16 16 + namespace: {{ .Release.Namespace }} 17 17 + {{- end -}} 18 18 + {{- end -}}

+16

helm/system-setup/charts/metrics-server/templates/clusterrolebinding.yaml

··· 1 1 + {{- if .Values.rbac.create -}} 2 2 + apiVersion: rbac.authorization.k8s.io/v1 3 3 + kind: ClusterRoleBinding 4 4 + metadata: 5 5 + name: {{ printf "system:%s" (include "metrics-server.fullname" .) }} 6 6 + labels: 7 7 + {{- include "metrics-server.labels" . | nindent 4 }} 8 8 + roleRef: 9 9 + apiGroup: rbac.authorization.k8s.io 10 10 + kind: ClusterRole 11 11 + name: system:{{ template "metrics-server.fullname" . }} 12 12 + subjects: 13 13 + - kind: ServiceAccount 14 14 + name: {{ include "metrics-server.serviceAccountName" . }} 15 15 + namespace: {{ .Release.Namespace }} 16 16 + {{- end -}}

+17

helm/system-setup/charts/metrics-server/templates/configmaps-nanny.yaml

··· 1 1 + {{- if .Values.addonResizer.enabled -}} 2 2 + apiVersion: v1 3 3 + kind: ConfigMap 4 4 + metadata: 5 5 + name: {{ include "metrics-server.addonResizer.configMap" . }} 6 6 + namespace: {{ .Release.Namespace }} 7 7 + labels: 8 8 + {{- include "metrics-server.labels" . | nindent 4 }} 9 9 + data: 10 10 + NannyConfiguration: |- 11 11 + apiVersion: nannyconfig/v1alpha1 12 12 + kind: NannyConfiguration 13 13 + baseCPU: {{ .Values.addonResizer.nanny.cpu }} 14 14 + cpuPerNode: {{ .Values.addonResizer.nanny.extraCpu }} 15 15 + baseMemory: {{ .Values.addonResizer.nanny.memory }} 16 16 + memoryPerNode: {{ .Values.addonResizer.nanny.extraMemory }} 17 17 + {{- end -}}

+177

helm/system-setup/charts/metrics-server/templates/deployment.yaml

··· 1 1 + apiVersion: apps/v1 2 2 + kind: Deployment 3 3 + metadata: 4 4 + name: {{ include "metrics-server.fullname" . }} 5 5 + namespace: {{ .Release.Namespace }} 6 6 + labels: 7 7 + {{- include "metrics-server.labels" . | nindent 4 }} 8 8 + {{- with .Values.deploymentAnnotations }} 9 9 + annotations: 10 10 + {{- toYaml . | nindent 4 }} 11 11 + {{- end }} 12 12 + spec: 13 13 + replicas: {{ .Values.replicas }} 14 14 + {{- if not (has (quote .Values.revisionHistoryLimit) (list "" (quote ""))) }} 15 15 + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} 16 16 + {{- end }} 17 17 + {{- with .Values.updateStrategy }} 18 18 + strategy: 19 19 + {{- toYaml . | nindent 4 }} 20 20 + {{- end }} 21 21 + selector: 22 22 + matchLabels: 23 23 + {{- include "metrics-server.selectorLabels" . | nindent 6 }} 24 24 + template: 25 25 + metadata: 26 26 + labels: 27 27 + {{- include "metrics-server.selectorLabels" . | nindent 8 }} 28 28 + {{- with .Values.podLabels }} 29 29 + {{- toYaml . | nindent 8 }} 30 30 + {{- end }} 31 31 + {{- with .Values.podAnnotations }} 32 32 + annotations: 33 33 + {{- toYaml . | nindent 8 }} 34 34 + {{- end }} 35 35 + spec: 36 36 + {{- with .Values.schedulerName }} 37 37 + schedulerName: {{ . }} 38 38 + {{- end }} 39 39 + {{- with .Values.imagePullSecrets }} 40 40 + imagePullSecrets: 41 41 + {{- toYaml . | nindent 8 }} 42 42 + {{- end }} 43 43 + serviceAccountName: {{ include "metrics-server.serviceAccountName" . }} 44 44 + {{- with .Values.podSecurityContext }} 45 45 + securityContext: 46 46 + {{- toYaml . | nindent 8 }} 47 47 + {{- end }} 48 48 + {{- with .Values.priorityClassName }} 49 49 + priorityClassName: {{ . | quote }} 50 50 + {{- end }} 51 51 + {{- if .Values.hostNetwork.enabled }} 52 52 + hostNetwork: true 53 53 + {{- end }} 54 54 + {{- with .Values.dnsConfig }} 55 55 + dnsConfig: 56 56 + {{- toYaml . | nindent 8 }} 57 57 + {{- end }} 58 58 + containers: 59 59 + - name: metrics-server 60 60 + {{- with .Values.securityContext }} 61 61 + securityContext: 62 62 + {{- toYaml . | nindent 12 }} 63 63 + {{- end }} 64 64 + image: {{ include "metrics-server.image" . }} 65 65 + imagePullPolicy: {{ .Values.image.pullPolicy }} 66 66 + args: 67 67 + - {{ printf "--secure-port=%d" (int .Values.containerPort) }} 68 68 + {{- range .Values.defaultArgs }} 69 69 + - {{ . }} 70 70 + {{- end }} 71 71 + {{- if .Values.metrics.enabled }} 72 72 + - --authorization-always-allow-paths=/metrics 73 73 + {{- end }} 74 74 + {{- if ne .Values.tls.type "metrics-server" }} 75 75 + - --tls-cert-file=/tmp/tls-certs/tls.crt 76 76 + - --tls-private-key-file=/tmp/tls-certs/tls.key 77 77 + {{- end }} 78 78 + {{- range .Values.args }} 79 79 + - {{ . }} 80 80 + {{- end }} 81 81 + ports: 82 82 + - name: https 83 83 + protocol: TCP 84 84 + containerPort: {{ .Values.containerPort }} 85 85 + {{- with .Values.livenessProbe }} 86 86 + livenessProbe: 87 87 + {{- toYaml . | nindent 12 }} 88 88 + {{- end }} 89 89 + {{- with .Values.readinessProbe }} 90 90 + readinessProbe: 91 91 + {{- toYaml . | nindent 12 }} 92 92 + {{- end }} 93 93 + volumeMounts: 94 94 + - name: tmp 95 95 + mountPath: /tmp 96 96 + {{- if ne .Values.tls.type "metrics-server" }} 97 97 + - mountPath: /tmp/tls-certs 98 98 + name: certs 99 99 + readOnly: true 100 100 + {{- end }} 101 101 + {{- with .Values.extraVolumeMounts }} 102 102 + {{- toYaml . | nindent 12 }} 103 103 + {{- end }} 104 104 + {{- with .Values.resources }} 105 105 + resources: 106 106 + {{- toYaml . | nindent 12 }} 107 107 + {{- end }} 108 108 + {{- if .Values.addonResizer.enabled }} 109 109 + - name: metrics-server-nanny 110 110 + {{- with .Values.addonResizer.securityContext }} 111 111 + securityContext: 112 112 + {{- toYaml . | nindent 12 }} 113 113 + {{- end }} 114 114 + image: {{ include "metrics-server.addonResizer.image" . }} 115 115 + env: 116 116 + - name: MY_POD_NAME 117 117 + valueFrom: 118 118 + fieldRef: 119 119 + fieldPath: metadata.name 120 120 + - name: MY_POD_NAMESPACE 121 121 + valueFrom: 122 122 + fieldRef: 123 123 + fieldPath: metadata.namespace 124 124 + command: 125 125 + - /pod_nanny 126 126 + - --config-dir=/etc/config 127 127 + - --deployment={{ include "metrics-server.fullname" . }} 128 128 + - --container=metrics-server 129 129 + - --threshold={{ .Values.addonResizer.nanny.threshold }} 130 130 + - --poll-period={{ .Values.addonResizer.nanny.pollPeriod }} 131 131 + - --estimator=exponential 132 132 + - --minClusterSize={{ .Values.addonResizer.nanny.minClusterSize }} 133 133 + - --use-metrics=true 134 134 + volumeMounts: 135 135 + - name: nanny-config-volume 136 136 + mountPath: /etc/config 137 137 + {{- with .Values.addonResizer.resources }} 138 138 + resources: 139 139 + {{- toYaml . | nindent 12 }} 140 140 + {{- end }} 141 141 + {{- end }} 142 142 + volumes: 143 143 + - name: tmp 144 144 + {{- toYaml .Values.tmpVolume | nindent 10 }} 145 145 + {{- if .Values.addonResizer.enabled }} 146 146 + - name: nanny-config-volume 147 147 + configMap: 148 148 + name: {{ include "metrics-server.addonResizer.configMap" . }} 149 149 + {{- end }} 150 150 + {{- if ne .Values.tls.type "metrics-server" }} 151 151 + - name: certs 152 152 + secret: 153 153 + {{- if and (eq .Values.tls.type "existingSecret") .Values.tls.existingSecret.name }} 154 154 + secretName: {{ .Values.tls.existingSecret.name }} 155 155 + {{- else }} 156 156 + secretName: {{ include "metrics-server.fullname" . }} 157 157 + {{- end }} 158 158 + {{- end }} 159 159 + {{- with .Values.extraVolumes }} 160 160 + {{- toYaml . | nindent 8 }} 161 161 + {{- end }} 162 162 + {{- with .Values.nodeSelector }} 163 163 + nodeSelector: 164 164 + {{- toYaml . | nindent 8 }} 165 165 + {{- end }} 166 166 + {{- with .Values.affinity }} 167 167 + affinity: 168 168 + {{- toYaml . | nindent 8 }} 169 169 + {{- end }} 170 170 + {{- with .Values.tolerations }} 171 171 + tolerations: 172 172 + {{- toYaml . | nindent 8 }} 173 173 + {{- end }} 174 174 + {{- with .Values.topologySpreadConstraints }} 175 175 + topologySpreadConstraints: 176 176 + {{- toYaml . | nindent 8 }} 177 177 + {{- end }}

+25

helm/system-setup/charts/metrics-server/templates/pdb.yaml

··· 1 1 + {{- if .Values.podDisruptionBudget.enabled -}} 2 2 + apiVersion: {{ include "metrics-server.pdb.apiVersion" . }} 3 3 + kind: PodDisruptionBudget 4 4 + metadata: 5 5 + name: {{ include "metrics-server.fullname" . }} 6 6 + namespace: {{ .Release.Namespace }} 7 7 + labels: 8 8 + {{- include "metrics-server.labels" . | nindent 4 }} 9 9 + spec: 10 10 + {{- if .Values.podDisruptionBudget.minAvailable }} 11 11 + minAvailable: {{ .Values.podDisruptionBudget.minAvailable }} 12 12 + {{- end }} 13 13 + {{- if .Values.podDisruptionBudget.maxUnavailable }} 14 14 + maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} 15 15 + {{- end }} 16 16 + {{- if (semverCompare ">= 1.27-0" .Capabilities.KubeVersion.Version) }} 17 17 + {{- with .Values.podDisruptionBudget.unhealthyPodEvictionPolicy }} 18 18 + unhealthyPodEvictionPolicy: {{ . }} 19 19 + {{- end }} 20 20 + {{- end }} 21 21 + 22 22 + selector: 23 23 + matchLabels: 24 24 + {{- include "metrics-server.selectorLabels" . | nindent 6 }} 25 25 + {{- end -}}

+28

helm/system-setup/charts/metrics-server/templates/psp.yaml

··· 1 1 + {{- if and (.Values.rbac.pspEnabled) (semverCompare "<1.25-0" .Capabilities.KubeVersion.GitVersion) }} 2 2 + apiVersion: policy/v1beta1 3 3 + kind: PodSecurityPolicy 4 4 + metadata: 5 5 + name: {{ printf "privileged-%s" (include "metrics-server.fullname" .) }} 6 6 + labels: 7 7 + {{- include "metrics-server.labels" . | nindent 4 }} 8 8 + spec: 9 9 + allowedCapabilities: 10 10 + - '*' 11 11 + fsGroup: 12 12 + rule: RunAsAny 13 13 + privileged: true 14 14 + runAsUser: 15 15 + rule: RunAsAny 16 16 + seLinux: 17 17 + rule: RunAsAny 18 18 + supplementalGroups: 19 19 + rule: RunAsAny 20 20 + volumes: 21 21 + - '*' 22 22 + hostPID: true 23 23 + hostIPC: true 24 24 + hostNetwork: true 25 25 + hostPorts: 26 26 + - min: 1 27 27 + max: 65536 28 28 + {{- end }}

+27

helm/system-setup/charts/metrics-server/templates/role-nanny.yaml

··· 1 1 + {{- if .Values.rbac.create -}} 2 2 + {{- if .Values.addonResizer.enabled -}} 3 3 + apiVersion: rbac.authorization.k8s.io/v1 4 4 + kind: Role 5 5 + metadata: 6 6 + name: {{ include "metrics-server.addonResizer.role" . }} 7 7 + namespace: {{ .Release.Namespace }} 8 8 + labels: 9 9 + {{- include "metrics-server.labels" . | nindent 4 }} 10 10 + rules: 11 11 + - apiGroups: 12 12 + - "" 13 13 + resources: 14 14 + - pods 15 15 + verbs: 16 16 + - get 17 17 + - apiGroups: 18 18 + - apps 19 19 + resources: 20 20 + - deployments 21 21 + resourceNames: 22 22 + - {{ include "metrics-server.fullname" . }} 23 23 + verbs: 24 24 + - get 25 25 + - patch 26 26 + {{- end -}} 27 27 + {{- end -}}

+19

helm/system-setup/charts/metrics-server/templates/rolebinding-nanny.yaml

··· 1 1 + {{- if .Values.rbac.create -}} 2 2 + {{- if .Values.addonResizer.enabled -}} 3 3 + apiVersion: rbac.authorization.k8s.io/v1 4 4 + kind: RoleBinding 5 5 + metadata: 6 6 + name: {{ printf "%s-nanny" (include "metrics-server.fullname" .) }} 7 7 + namespace: {{ .Release.Namespace }} 8 8 + labels: 9 9 + {{- include "metrics-server.labels" . | nindent 4 }} 10 10 + roleRef: 11 11 + apiGroup: rbac.authorization.k8s.io 12 12 + kind: Role 13 13 + name: {{ include "metrics-server.addonResizer.role" . }} 14 14 + subjects: 15 15 + - kind: ServiceAccount 16 16 + name: {{ include "metrics-server.serviceAccountName" . }} 17 17 + namespace: {{ .Release.Namespace }} 18 18 + {{- end -}} 19 19 + {{- end -}}

+17

helm/system-setup/charts/metrics-server/templates/rolebinding.yaml

··· 1 1 + {{- if .Values.rbac.create -}} 2 2 + apiVersion: rbac.authorization.k8s.io/v1 3 3 + kind: RoleBinding 4 4 + metadata: 5 5 + name: {{ printf "%s-auth-reader" (include "metrics-server.fullname" .) }} 6 6 + namespace: kube-system 7 7 + labels: 8 8 + {{- include "metrics-server.labels" . | nindent 4 }} 9 9 + roleRef: 10 10 + apiGroup: rbac.authorization.k8s.io 11 11 + kind: Role 12 12 + name: extension-apiserver-authentication-reader 13 13 + subjects: 14 14 + - kind: ServiceAccount 15 15 + name: {{ include "metrics-server.serviceAccountName" . }} 16 16 + namespace: {{ .Release.Namespace }} 17 17 + {{- end -}}

+24

helm/system-setup/charts/metrics-server/templates/service.yaml

··· 1 1 + apiVersion: v1 2 2 + kind: Service 3 3 + metadata: 4 4 + name: {{ include "metrics-server.fullname" . }} 5 5 + namespace: {{ .Release.Namespace }} 6 6 + labels: 7 7 + {{- include "metrics-server.labels" . | nindent 4 }} 8 8 + {{- with .Values.service.labels -}} 9 9 + {{- toYaml . | nindent 4 }} 10 10 + {{- end }} 11 11 + {{- with .Values.service.annotations }} 12 12 + annotations: 13 13 + {{- toYaml . | nindent 4 }} 14 14 + {{- end }} 15 15 + spec: 16 16 + type: {{ .Values.service.type }} 17 17 + ports: 18 18 + - name: https 19 19 + port: {{ .Values.service.port }} 20 20 + protocol: TCP 21 21 + targetPort: https 22 22 + appProtocol: https 23 23 + selector: 24 24 + {{- include "metrics-server.selectorLabels" . | nindent 4 }}

+17

helm/system-setup/charts/metrics-server/templates/serviceaccount.yaml

··· 1 1 + {{- if .Values.serviceAccount.create -}} 2 2 + apiVersion: v1 3 3 + kind: ServiceAccount 4 4 + metadata: 5 5 + name: {{ template "metrics-server.serviceAccountName" . }} 6 6 + namespace: {{ .Release.Namespace }} 7 7 + labels: 8 8 + {{- include "metrics-server.labels" . | nindent 4 }} 9 9 + {{- with .Values.serviceAccount.annotations }} 10 10 + annotations: 11 11 + {{- toYaml . | nindent 4 }} 12 12 + {{- end }} 13 13 + {{- with .Values.serviceAccount.secrets }} 14 14 + secrets: 15 15 + {{- toYaml . | nindent 2 }} 16 16 + {{- end }} 17 17 + {{- end -}}

+40

helm/system-setup/charts/metrics-server/templates/servicemonitor.yaml

··· 1 1 + {{- if and .Values.serviceMonitor.enabled .Values.metrics.enabled -}} 2 2 + apiVersion: monitoring.coreos.com/v1 3 3 + kind: ServiceMonitor 4 4 + metadata: 5 5 + name: {{ include "metrics-server.fullname" . }} 6 6 + namespace: {{ .Release.Namespace }} 7 7 + labels: 8 8 + {{- include "metrics-server.labels" . | nindent 4 }} 9 9 + {{- with .Values.serviceMonitor.additionalLabels }} 10 10 + {{- toYaml . | nindent 4 }} 11 11 + {{- end }} 12 12 + spec: 13 13 + jobLabel: app.kubernetes.io/instance 14 14 + namespaceSelector: 15 15 + matchNames: 16 16 + - {{ .Release.Namespace }} 17 17 + selector: 18 18 + matchLabels: 19 19 + {{- include "metrics-server.selectorLabels" . | nindent 6 }} 20 20 + endpoints: 21 21 + - port: https 22 22 + path: /metrics 23 23 + scheme: https 24 24 + tlsConfig: 25 25 + insecureSkipVerify: true 26 26 + {{- with .Values.serviceMonitor.interval }} 27 27 + interval: {{ . }} 28 28 + {{- end }} 29 29 + {{- with .Values.serviceMonitor.scrapeTimeout }} 30 30 + scrapeTimeout: {{ . }} 31 31 + {{- end }} 32 32 + {{- with .Values.serviceMonitor.metricRelabelings }} 33 33 + metricRelabelings: 34 34 + {{- toYaml . | nindent 8 }} 35 35 + {{- end }} 36 36 + {{- with .Values.serviceMonitor.relabelings }} 37 37 + relabelings: 38 38 + {{- toYaml . | nindent 8 }} 39 39 + {{- end }} 40 40 + {{- end -}}

+245

helm/system-setup/charts/metrics-server/values.yaml

··· 1 1 + # Default values for metrics-server. 2 2 + # This is a YAML-formatted file. 3 3 + # Declare variables to be passed into your templates. 4 4 + 5 5 + image: 6 6 + repository: registry.k8s.io/metrics-server/metrics-server 7 7 + # Overrides the image tag whose default is v{{ .Chart.AppVersion }} 8 8 + tag: "" 9 9 + pullPolicy: IfNotPresent 10 10 + 11 11 + imagePullSecrets: [] 12 12 + # - name: registrySecretName 13 13 + 14 14 + nameOverride: "" 15 15 + fullnameOverride: "" 16 16 + 17 17 + serviceAccount: 18 18 + # Specifies whether a service account should be created 19 19 + create: true 20 20 + # Annotations to add to the service account 21 21 + annotations: {} 22 22 + # The name of the service account to use. 23 23 + # If not set and create is true, a name is generated using the fullname template 24 24 + name: "" 25 25 + # The list of secrets mountable by this service account. 26 26 + # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets 27 27 + secrets: [] 28 28 + 29 29 + rbac: 30 30 + # Specifies whether RBAC resources should be created 31 31 + create: true 32 32 + # Note: PodSecurityPolicy will not be created when Kubernetes version is 1.25 or later. 33 33 + pspEnabled: false 34 34 + 35 35 + apiService: 36 36 + # Specifies if the v1beta1.metrics.k8s.io API service should be created. 37 37 + # 38 38 + # You typically want this enabled! If you disable API service creation you have to 39 39 + # manage it outside of this chart for e.g horizontal pod autoscaling to 40 40 + # work with this release. 41 41 + create: true 42 42 + # Annotations to add to the API service 43 43 + annotations: {} 44 44 + # Specifies whether to skip TLS verification 45 45 + insecureSkipTLSVerify: true 46 46 + # The PEM encoded CA bundle for TLS verification 47 47 + caBundle: "" 48 48 + 49 49 + commonLabels: {} 50 50 + podLabels: {} 51 51 + podAnnotations: {} 52 52 + 53 53 + podSecurityContext: {} 54 54 + 55 55 + securityContext: 56 56 + allowPrivilegeEscalation: false 57 57 + readOnlyRootFilesystem: true 58 58 + runAsNonRoot: true 59 59 + runAsUser: 1000 60 60 + seccompProfile: 61 61 + type: RuntimeDefault 62 62 + capabilities: 63 63 + drop: 64 64 + - ALL 65 65 + 66 66 + priorityClassName: system-cluster-critical 67 67 + 68 68 + containerPort: 10250 69 69 + 70 70 + hostNetwork: 71 71 + # Specifies if metrics-server should be started in hostNetwork mode. 72 72 + # 73 73 + # You would require this enabled if you use alternate overlay networking for pods and 74 74 + # API server unable to communicate with metrics-server. As an example, this is required 75 75 + # if you use Weave network on EKS 76 76 + enabled: false 77 77 + 78 78 + replicas: 1 79 79 + 80 80 + revisionHistoryLimit: 81 81 + 82 82 + updateStrategy: {} 83 83 + # type: RollingUpdate 84 84 + # rollingUpdate: 85 85 + # maxSurge: 0 86 86 + # maxUnavailable: 1 87 87 + 88 88 + podDisruptionBudget: 89 89 + # https://kubernetes.io/docs/tasks/run-application/configure-pdb/ 90 90 + enabled: false 91 91 + minAvailable: 92 92 + maxUnavailable: 93 93 + unhealthyPodEvictionPolicy: 94 94 + 95 95 + defaultArgs: 96 96 + - --cert-dir=/tmp 97 97 + - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname 98 98 + - --kubelet-use-node-status-port 99 99 + - --metric-resolution=15s 100 100 + 101 101 + args: [] 102 102 + 103 103 + livenessProbe: 104 104 + httpGet: 105 105 + path: /livez 106 106 + port: https 107 107 + scheme: HTTPS 108 108 + initialDelaySeconds: 0 109 109 + periodSeconds: 10 110 110 + failureThreshold: 3 111 111 + 112 112 + readinessProbe: 113 113 + httpGet: 114 114 + path: /readyz 115 115 + port: https 116 116 + scheme: HTTPS 117 117 + initialDelaySeconds: 20 118 118 + periodSeconds: 10 119 119 + failureThreshold: 3 120 120 + 121 121 + service: 122 122 + type: ClusterIP 123 123 + port: 443 124 124 + annotations: {} 125 125 + labels: {} 126 126 + # Add these labels to have metrics-server show up in `kubectl cluster-info` 127 127 + # kubernetes.io/cluster-service: "true" 128 128 + # kubernetes.io/name: "Metrics-server" 129 129 + 130 130 + addonResizer: 131 131 + enabled: false 132 132 + image: 133 133 + repository: registry.k8s.io/autoscaling/addon-resizer 134 134 + tag: 1.8.23 135 135 + securityContext: 136 136 + allowPrivilegeEscalation: false 137 137 + readOnlyRootFilesystem: true 138 138 + runAsNonRoot: true 139 139 + runAsUser: 1000 140 140 + seccompProfile: 141 141 + type: RuntimeDefault 142 142 + capabilities: 143 143 + drop: 144 144 + - ALL 145 145 + resources: 146 146 + requests: 147 147 + cpu: 40m 148 148 + memory: 25Mi 149 149 + limits: 150 150 + cpu: 40m 151 151 + memory: 25Mi 152 152 + nanny: 153 153 + cpu: 0m 154 154 + extraCpu: 1m 155 155 + memory: 0Mi 156 156 + extraMemory: 2Mi 157 157 + minClusterSize: 100 158 158 + pollPeriod: 300000 159 159 + threshold: 5 160 160 + 161 161 + metrics: 162 162 + enabled: false 163 163 + 164 164 + serviceMonitor: 165 165 + enabled: false 166 166 + additionalLabels: {} 167 167 + interval: 1m 168 168 + scrapeTimeout: 10s 169 169 + metricRelabelings: [] 170 170 + relabelings: [] 171 171 + 172 172 + # See https://github.com/kubernetes-sigs/metrics-server#scaling 173 173 + resources: 174 174 + requests: 175 175 + cpu: 100m 176 176 + memory: 200Mi 177 177 + # limits: 178 178 + # cpu: 179 179 + # memory: 180 180 + 181 181 + extraVolumeMounts: [] 182 182 + 183 183 + extraVolumes: [] 184 184 + 185 185 + nodeSelector: {} 186 186 + 187 187 + tolerations: [] 188 188 + 189 189 + affinity: {} 190 190 + 191 191 + topologySpreadConstraints: [] 192 192 + 193 193 + dnsConfig: {} 194 194 + 195 195 + # Annotations to add to the deployment 196 196 + deploymentAnnotations: {} 197 197 + 198 198 + schedulerName: "" 199 199 + 200 200 + tmpVolume: 201 201 + emptyDir: {} 202 202 + 203 203 + tls: 204 204 + # Set the TLS method to use. Supported values: 205 205 + # - `metrics-server` : Metrics-server will generate a self-signed certificate 206 206 + # - `helm` : Helm will generate a self-signed certificate 207 207 + # - `cert-manager` : Use cert-manager.io to create and maintain the certificate 208 208 + # - `existingSecret` : Reuse an existing secret. No new secret will be created 209 209 + type: "metrics-server" 210 210 + # Kubernetes cluster domain. Used to configure Subject Alt Names for the certificate 211 211 + clusterDomain: cluster.local 212 212 + 213 213 + certManager: 214 214 + # Automatically add the cert-manager.io/inject-ca-from annotation to the APIService resource. 215 215 + # See https://cert-manager.io/docs/concepts/ca-injector 216 216 + addInjectorAnnotations: true 217 217 + existingIssuer: 218 218 + # Use an existing cert-manager issuer 219 219 + enabled: false 220 220 + # Kind of the existing cert-manager issuer 221 221 + kind: "Issuer" 222 222 + # Name of the existing cert-manager issuer 223 223 + name: "my-issuer" 224 224 + # Set the requested duration (i.e. lifetime) of the Certificate. 225 225 + # See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec 226 226 + duration: "" 227 227 + # How long before the currently issued certificate’s expiry cert-manager should renew the certificate. 228 228 + # See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec 229 229 + renewBefore: "" 230 230 + # Add extra annotations to the Certificate resource 231 231 + annotations: {} 232 232 + # Add extra labels to the Certificate resource 233 233 + labels: {} 234 234 + 235 235 + helm: 236 236 + # Use helm lookup function to reuse Secret created in previous helm install 237 237 + lookup: true 238 238 + # Cert validity duration in days 239 239 + certDurationDays: 365 240 240 + 241 241 + existingSecret: 242 242 + # Name of the existing Secret to use for TLS 243 243 + name: "" 244 244 + # Use helm lookup function to provision `apiService.caBundle` 245 245 + lookup: true

+4

helm/system-setup/values.yaml

··· 2 2 enabled: true 3 3 fluvio: 4 4 enabled: true 5 5 + 6 6 + metrics-server: 7 7 + args: 8 8 + - --kubelet-insecure-tls