From 3eb30f028e6c20f0b853c71326465857af348657 Mon Sep 17 00:00:00 2001 From: Jessie Lin Date: Thu, 7 Oct 2021 15:08:06 +1300 Subject: [PATCH] add helm chart --- README.md | 10 +++ charts/hairpin-proxy/.helmignore | 23 ++++++ charts/hairpin-proxy/Chart.yaml | 9 +++ charts/hairpin-proxy/files/haproxy.cfg | 20 +++++ charts/hairpin-proxy/templates/NOTES.txt | 11 +++ charts/hairpin-proxy/templates/_helpers.tpl | 62 ++++++++++++++++ .../hairpin-proxy/templates/clusterrole.yaml | 19 +++++ .../templates/clusterrolebinding.yaml | 16 ++++ charts/hairpin-proxy/templates/configmap.yaml | 9 +++ .../templates/controller-deployment.yaml | 57 +++++++++++++++ .../templates/haproxy-deployment.yaml | 73 +++++++++++++++++++ charts/hairpin-proxy/templates/psp-role.yaml | 14 ++++ .../templates/psp-rolebinding.yaml | 17 +++++ charts/hairpin-proxy/templates/psp.yaml | 43 +++++++++++ charts/hairpin-proxy/templates/role.yaml | 19 +++++ .../hairpin-proxy/templates/rolebinding.yaml | 17 +++++ charts/hairpin-proxy/templates/service.yaml | 21 ++++++ .../templates/serviceaccount.yaml | 12 +++ charts/hairpin-proxy/values.yaml | 67 +++++++++++++++++ 19 files changed, 519 insertions(+) create mode 100644 charts/hairpin-proxy/.helmignore create mode 100644 charts/hairpin-proxy/Chart.yaml create mode 100644 charts/hairpin-proxy/files/haproxy.cfg create mode 100644 charts/hairpin-proxy/templates/NOTES.txt create mode 100644 charts/hairpin-proxy/templates/_helpers.tpl create mode 100644 charts/hairpin-proxy/templates/clusterrole.yaml create mode 100644 charts/hairpin-proxy/templates/clusterrolebinding.yaml create mode 100644 charts/hairpin-proxy/templates/configmap.yaml create mode 100644 charts/hairpin-proxy/templates/controller-deployment.yaml create mode 100644 charts/hairpin-proxy/templates/haproxy-deployment.yaml create mode 100644 charts/hairpin-proxy/templates/psp-role.yaml create mode 100644 charts/hairpin-proxy/templates/psp-rolebinding.yaml create mode 100644 charts/hairpin-proxy/templates/psp.yaml create mode 100644 charts/hairpin-proxy/templates/role.yaml create mode 100644 charts/hairpin-proxy/templates/rolebinding.yaml create mode 100644 charts/hairpin-proxy/templates/service.yaml create mode 100644 charts/hairpin-proxy/templates/serviceaccount.yaml create mode 100644 charts/hairpin-proxy/values.yaml diff --git a/README.md b/README.md index 576610e..104645d 100644 --- a/README.md +++ b/README.md @@ -131,3 +131,13 @@ To install this DaemonSet: ```shell kubectl apply -f https://raw.githubusercontent.com/compumike/hairpin-proxy/v0.2.1/deploy-etchosts-daemonset.yml ``` + +### Alternatively install via helm chart + +The helm chart installs both the controller and haproxy at one go. + +The chart creates a configMap for `haproxy.cfg` and mount it at `/usr/local/etc/haproxy/haproxy.cfg`. You might want to update the value of `haproxy.targetServer` to point to the correct ingress controller endpoint for your deployment. + +```shell +helm --namespace hairpin-proxy install --create-namespace hairpin-proxy charts/hairpin-proxy +``` diff --git a/charts/hairpin-proxy/.helmignore b/charts/hairpin-proxy/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/hairpin-proxy/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/hairpin-proxy/Chart.yaml b/charts/hairpin-proxy/Chart.yaml new file mode 100644 index 0000000..d0b175c --- /dev/null +++ b/charts/hairpin-proxy/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +name: hairpin-proxy +description: Chart for the hairpin-proxy traffic reflector +type: application +version: 0.1.0 +appVersion: 0.2.1 +home: https://github.com/compumike/hairpin-proxy +sources: + - https://github.com/compumike/hairpin-proxy diff --git a/charts/hairpin-proxy/files/haproxy.cfg b/charts/hairpin-proxy/files/haproxy.cfg new file mode 100644 index 0000000..f7727d6 --- /dev/null +++ b/charts/hairpin-proxy/files/haproxy.cfg @@ -0,0 +1,20 @@ +defaults +timeout connect 5000ms +timeout client 60000ms +timeout server 60000ms + +frontend fe_8080 +bind *:8080 +mode tcp +use_backend be_ingress_80 +backend be_ingress_80 +mode tcp +server my_server "${TARGET_SERVER}:80" send-proxy + +frontend fe_8443 +bind *:8443 +mode tcp +use_backend be_ingress_443 +backend be_ingress_443 +mode tcp +server my_server "${TARGET_SERVER}:443" send-proxy diff --git a/charts/hairpin-proxy/templates/NOTES.txt b/charts/hairpin-proxy/templates/NOTES.txt new file mode 100644 index 0000000..4f8ae78 --- /dev/null +++ b/charts/hairpin-proxy/templates/NOTES.txt @@ -0,0 +1,11 @@ +1. Get the application URL by running these commands: +{{- if contains "NodePort" .Values.haproxy.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "hairpin-proxy.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "ClusterIP" .Values.haproxy.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "hairpin-proxy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/charts/hairpin-proxy/templates/_helpers.tpl b/charts/hairpin-proxy/templates/_helpers.tpl new file mode 100644 index 0000000..d523ee1 --- /dev/null +++ b/charts/hairpin-proxy/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "hairpin-proxy.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "hairpin-proxy.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "hairpin-proxy.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "hairpin-proxy.labels" -}} +helm.sh/chart: {{ include "hairpin-proxy.chart" . }} +{{ include "hairpin-proxy.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "hairpin-proxy.selectorLabels" -}} +app.kubernetes.io/name: {{ include "hairpin-proxy.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "hairpin-proxy.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "hairpin-proxy.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/hairpin-proxy/templates/clusterrole.yaml b/charts/hairpin-proxy/templates/clusterrole.yaml new file mode 100644 index 0000000..f4ade1f --- /dev/null +++ b/charts/hairpin-proxy/templates/clusterrole.yaml @@ -0,0 +1,19 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "hairpin-proxy.fullname" . }} + labels: + {{- include "hairpin-proxy.labels" . | nindent 4 }} +rules: + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - watch +{{- end }} + diff --git a/charts/hairpin-proxy/templates/clusterrolebinding.yaml b/charts/hairpin-proxy/templates/clusterrolebinding.yaml new file mode 100644 index 0000000..3d0f3a9 --- /dev/null +++ b/charts/hairpin-proxy/templates/clusterrolebinding.yaml @@ -0,0 +1,16 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "hairpin-proxy.fullname" . }} + labels: + {{- include "hairpin-proxy.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "hairpin-proxy.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "hairpin-proxy.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/hairpin-proxy/templates/configmap.yaml b/charts/hairpin-proxy/templates/configmap.yaml new file mode 100644 index 0000000..9d0d317 --- /dev/null +++ b/charts/hairpin-proxy/templates/configmap.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "hairpin-proxy.fullname" . }} + labels: + app.kubernetes.io/component: haproxy + {{- include "hairpin-proxy.labels" . | nindent 4 }} +data: +{{ (.Files.Glob "files/*").AsConfig | indent 2 }} diff --git a/charts/hairpin-proxy/templates/controller-deployment.yaml b/charts/hairpin-proxy/templates/controller-deployment.yaml new file mode 100644 index 0000000..cedc3be --- /dev/null +++ b/charts/hairpin-proxy/templates/controller-deployment.yaml @@ -0,0 +1,57 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "hairpin-proxy.fullname" . }}-controller + labels: + app.kubernetes.io/component: controller + {{- include "hairpin-proxy.labels" . | nindent 4 }} + annotations: + kube-score/ignore: deployment-has-poddisruptionbudget, deployment-has-host-podantiaffinity, pod-probes, container-security-context-user-group-id, pod-networkpolicy +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app.kubernetes.io/component: controller + {{- include "hairpin-proxy.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + app.kubernetes.io/component: controller + {{- include "hairpin-proxy.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "hairpin-proxy.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.controller.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }}-controller + securityContext: + {{- toYaml .Values.controller.securityContext | nindent 12 }} + image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.controller.image.pullPolicy }} + env: + - name: HAIRPIN_NAMESPACE + value: {{ .Release.Namespace }} + - name: HAIRPIN_SERVICE + value: {{ include "hairpin-proxy.fullname" . }} + resources: + {{- toYaml .Values.controller.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/hairpin-proxy/templates/haproxy-deployment.yaml b/charts/hairpin-proxy/templates/haproxy-deployment.yaml new file mode 100644 index 0000000..fdc79a7 --- /dev/null +++ b/charts/hairpin-proxy/templates/haproxy-deployment.yaml @@ -0,0 +1,73 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "hairpin-proxy.fullname" . }}-haproxy + labels: + app.kubernetes.io/component: haproxy + {{- include "hairpin-proxy.labels" . | nindent 4 }} + annotations: + kube-score/ignore: deployment-has-poddisruptionbudget, deployment-has-host-podantiaffinity, pod-probes, container-security-context-user-group-id, pod-networkpolicy +spec: + replicas: {{ .Values.haproxy.replicaCount }} + selector: + matchLabels: + {{- include "hairpin-proxy.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + app.kubernetes.io/component: haproxy + {{- include "hairpin-proxy.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "hairpin-proxy.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.haproxy.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }}-haproxy + securityContext: + {{- toYaml .Values.haproxy.securityContext | nindent 12 }} + image: "{{ .Values.haproxy.image.repository }}:{{ .Values.haproxy.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.haproxy.image.pullPolicy }} + ports: + - name: http + containerPort: 8080 + protocol: TCP + - name: https + containerPort: 8443 + protocol: TCP + env: + - name: TARGET_SERVER + value: {{ .Values.haproxy.targetServer }} + volumeMounts: + - name: haproxycfg + mountPath: /usr/local/etc/haproxy + readinessProbe: + {{- toYaml .Values.haproxy.readinessProbe | nindent 12 }} + resources: + {{- toYaml .Values.haproxy.resources | nindent 12 }} + volumes: + - name: haproxycfg + configMap: + name: {{ include "hairpin-proxy.fullname" . }} + items: + - key: "haproxy.cfg" + path: "haproxy.cfg" + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/hairpin-proxy/templates/psp-role.yaml b/charts/hairpin-proxy/templates/psp-role.yaml new file mode 100644 index 0000000..50b805a --- /dev/null +++ b/charts/hairpin-proxy/templates/psp-role.yaml @@ -0,0 +1,14 @@ +{{- if .Values.podSecurityPolicy.enabled }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "hairpin-proxy.fullname" . }}-psp + labels: +{{- include "hairpin-proxy.labels" . | nindent 4 }} +rules: +- apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "hairpin-proxy.fullname" . }} +{{- end }} diff --git a/charts/hairpin-proxy/templates/psp-rolebinding.yaml b/charts/hairpin-proxy/templates/psp-rolebinding.yaml new file mode 100644 index 0000000..8a18657 --- /dev/null +++ b/charts/hairpin-proxy/templates/psp-rolebinding.yaml @@ -0,0 +1,17 @@ +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "hairpin-proxy.fullname" . }}-psp + labels: +{{- include "hairpin-proxy.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "hairpin-proxy.fullname" . }}-psp +subjects: + - kind: ServiceAccount + name: {{ include "hairpin-proxy.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} + diff --git a/charts/hairpin-proxy/templates/psp.yaml b/charts/hairpin-proxy/templates/psp.yaml new file mode 100644 index 0000000..00ea9e2 --- /dev/null +++ b/charts/hairpin-proxy/templates/psp.yaml @@ -0,0 +1,43 @@ +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "hairpin-proxy.fullname" . }} + labels: +{{- include "hairpin-proxy.labels" . | nindent 4 }} + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' +spec: + privileged: false + allowPrivilegeEscalation: false + allowedCapabilities: [] + readOnlyRootFilesystem: true + volumes: + - configMap + - emptyDir + - projected + - secret + - downwardAPI + - persistentVolumeClaim + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: MustRunAs + ranges: + - min: 1 + max: 65535 + seLinux: + rule: RunAsAny + supplementalGroups: + rule: MustRunAs + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: MustRunAs + ranges: + - min: 1 + max: 65535 +{{- end }} diff --git a/charts/hairpin-proxy/templates/role.yaml b/charts/hairpin-proxy/templates/role.yaml new file mode 100644 index 0000000..5c0f622 --- /dev/null +++ b/charts/hairpin-proxy/templates/role.yaml @@ -0,0 +1,19 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "hairpin-proxy.fullname" . }} + namespace: kube-system + labels: + {{- include "hairpin-proxy.labels" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: + - configmaps + resourceNames: + - coredns + verbs: + - get + - watch + - update +{{- end }} diff --git a/charts/hairpin-proxy/templates/rolebinding.yaml b/charts/hairpin-proxy/templates/rolebinding.yaml new file mode 100644 index 0000000..502e77b --- /dev/null +++ b/charts/hairpin-proxy/templates/rolebinding.yaml @@ -0,0 +1,17 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "hairpin-proxy.fullname" . }} + namespace: kube-system + labels: + {{- include "hairpin-proxy.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "hairpin-proxy.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "hairpin-proxy.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/hairpin-proxy/templates/service.yaml b/charts/hairpin-proxy/templates/service.yaml new file mode 100644 index 0000000..492bf81 --- /dev/null +++ b/charts/hairpin-proxy/templates/service.yaml @@ -0,0 +1,21 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "hairpin-proxy.fullname" . }} + labels: + app.kubernetes.io/component: haproxy + {{- include "hairpin-proxy.labels" . | nindent 4 }} +spec: + type: {{ .Values.haproxy.service.type }} + ports: + - port: 80 + targetPort: http + protocol: TCP + name: http + - port: 443 + targetPort: https + protocol: TCP + name: https + selector: + app.kubernetes.io/component: haproxy + {{- include "hairpin-proxy.selectorLabels" . | nindent 4 }} diff --git a/charts/hairpin-proxy/templates/serviceaccount.yaml b/charts/hairpin-proxy/templates/serviceaccount.yaml new file mode 100644 index 0000000..dfc1a14 --- /dev/null +++ b/charts/hairpin-proxy/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "hairpin-proxy.serviceAccountName" . }} + labels: + {{- include "hairpin-proxy.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/hairpin-proxy/values.yaml b/charts/hairpin-proxy/values.yaml new file mode 100644 index 0000000..1413586 --- /dev/null +++ b/charts/hairpin-proxy/values.yaml @@ -0,0 +1,67 @@ +haproxy: + replicaCount: 1 + image: + repository: compumike/hairpin-proxy-haproxy + pullPolicy: Always + tag: "0.2.1" + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + podSecurityContext: {} + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 101 + readinessProbe: + tcpSocket: + port: http + service: + type: ClusterIP + port: 80 + targetServer: "ingress-nginx-controller.ingress-nginx.svc.cluster.local" + +controller: + replicaCount: 1 + image: + repository: compumike/hairpin-proxy-controller + pullPolicy: Always + tag: "0.2.1" + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + podSecurityContext: {} + securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 9000 + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + create: true + annotations: {} + name: "" + +podSecurityPolicy: + enabled: false + +podAnnotations: {} + +nodeSelector: {} + +tolerations: [] + +affinity: {}