wbsong111
6290322f1b
- VM stack 10 charts: victoria-metrics-cluster/auth, victoria-logs-cluster, victoria-metrics-agent/alert, opentelemetry-collector, kube-state-metrics, prometheus-node-exporter, alertmanager, perses (JWT/OIDC, Infisical-ready) - ArgoCD ApplicationSet (syncWave) + per-chart dip-values overlays - doc/victoria-metrics-architecture.md, define-chart-resources updates - includes pending working-tree changes (mlflow, kubeflow, apisix, CLAUDE.md) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
498 lines
17 KiB
YAML
498 lines
17 KiB
YAML
# Default values for perses.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
|
|
# -- Override name of the chart used in Kubernetes object names.
|
|
nameOverride: ""
|
|
|
|
# -- Override fully qualified app name
|
|
fullnameOverride: ""
|
|
|
|
## Image of Perses
|
|
##
|
|
image:
|
|
# -- Perses image registry
|
|
registry: docker.io
|
|
|
|
# -- Perses image repository and name
|
|
name: "persesdev/perses"
|
|
|
|
# -- Overrides the image tag whose default is the chart appVersion.
|
|
version: ""
|
|
|
|
# -- Default image pull policy
|
|
pullPolicy: IfNotPresent
|
|
|
|
additionalLabels:
|
|
{}
|
|
# app: perses
|
|
|
|
# -- Service account for Perses to use.
|
|
serviceAccount:
|
|
# -- Specifies whether a service account should be created
|
|
create: true
|
|
# -- Annotations to add to the service account
|
|
annotations: {}
|
|
# -- The name of the service account to use.
|
|
# If not set and create is true, a name is generated using the fullname template
|
|
name: ""
|
|
|
|
# -- Expose the Perses service to be accessed from outside the cluster (LoadBalancer service).
|
|
# or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
|
|
service:
|
|
# -- Annotations to add to the service
|
|
annotations: {}
|
|
# -- Labels to add to the service
|
|
labels: {}
|
|
# -- Service Type
|
|
type: "ClusterIP"
|
|
# -- Service Port Name
|
|
portName: http
|
|
# -- Service Port
|
|
port: 8080
|
|
# -- Perses running port
|
|
targetPort: 8080
|
|
|
|
serviceMonitor:
|
|
# -- Create a serviceMonitor for Perses
|
|
selfMonitor: false
|
|
|
|
# -- Labels to add to the ServiceMonitor so that Prometheus can discover it.
|
|
# These labels should match the 'serviceMonitorSelector.matchLabels' defined in your Prometheus CR.
|
|
labels: {}
|
|
|
|
selector:
|
|
# -- Selector used by the ServiceMonitor to find which Perses service to scrape metrics from.
|
|
# These matchLabels should match the labels on your Perses service.
|
|
matchLabels: {}
|
|
|
|
# -- Interval for the serviceMonitor
|
|
interval: 30s
|
|
|
|
# -- Statefulset Annotations
|
|
annotations: {}
|
|
|
|
# -- Number of pod replicas.
|
|
replicas: 1
|
|
|
|
# -- Node tolerations for server scheduling to nodes with taints
|
|
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
|
|
##
|
|
tolerations:
|
|
[]
|
|
# - key: "key"
|
|
# operator: "Equal|Exists"
|
|
# value: "value"
|
|
# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
|
|
|
|
# -- Node labels for Perses pod assignment
|
|
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
|
##
|
|
nodeSelector: {}
|
|
|
|
## Pod affinity
|
|
##
|
|
affinity: {}
|
|
|
|
# -- Pod anti-affinity can prevent the scheduler from placing Perses replicas on the same node.
|
|
## The value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.
|
|
## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.
|
|
## The default value "" will disable pod anti-affinity so that no anti-affinity rules will be configured.
|
|
##
|
|
podAntiAffinity: ""
|
|
|
|
# -- If anti-affinity is enabled sets the topologyKey to use for anti-affinity.
|
|
## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone
|
|
##
|
|
podAntiAffinityTopologyKey: kubernetes.io/hostname
|
|
|
|
# -- Pod topology spread constraints
|
|
## ref. https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
|
|
topologySpreadConstraints: []
|
|
|
|
# -- Log level for Perses be configured in
|
|
# available options "panic", "error", "warning", "info", "debug", "trace"
|
|
logLevel: info
|
|
|
|
# -- Liveness probe configuration
|
|
# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
|
|
livenessProbe:
|
|
enabled: true
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 60
|
|
timeoutSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 5
|
|
|
|
# -- Readiness probe configuration
|
|
# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
|
|
readinessProbe:
|
|
enabled: true
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 5
|
|
|
|
# -- Additional arguments to pass to perses.
|
|
# Set to null for argumentless flags
|
|
extraArgs:
|
|
{}
|
|
# web.hide-port: null
|
|
|
|
# -- Additional volumes on the output StatefulSet definition.
|
|
volumes: []
|
|
|
|
# -- Additional VolumeMounts on the output StatefulSet definition.
|
|
volumeMounts: []
|
|
|
|
# -- OCI artifacts configuration for mounting OCI images as volumes.
|
|
# This feature allows you to package Perses manifests (dashboards, datasources, projects, etc.)
|
|
# as OCI images and mount them directly into the Perses container. The mounted manifests will be
|
|
# automatically loaded by Perses provisioning system when mounted at the provisioning path.
|
|
#
|
|
# Use cases:
|
|
# - Distribute dashboards as versioned OCI images
|
|
# - Deploy datasource configurations from container registries
|
|
# - Enable immutable configuration deployments with rollback capabilities
|
|
#
|
|
# Requirements: Kubernetes v1.31+ and ImageVolume feature gate enabled
|
|
# Note: OCI artifacts are inherently read-only
|
|
# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/
|
|
ociArtifacts:
|
|
{}
|
|
# name: perses-manifests
|
|
# image:
|
|
# reference: "registry.example.com/perses-manifests:v1.0.0"
|
|
# pullPolicy: Always # Options: Always, IfNotPresent, Never
|
|
# mountPath: "/etc/perses/provisioning" # Should match provisioning.folders path
|
|
# # Optional: Mount specific path from image
|
|
# subPath: "configs/production"
|
|
|
|
# -- TLS configuration for mounting certificates from Kubernetes secrets
|
|
tls:
|
|
# -- Enable TLS certificate mounting
|
|
enabled: false
|
|
|
|
# -- CA Certificate configuration
|
|
# Certificates will be mounted to the directory specified in mountPath
|
|
caCert:
|
|
# -- Enable CA certificate mounting
|
|
enabled: false
|
|
# -- Name of the Kubernetes secret containing the CA certificate
|
|
# Defaults to "release-name-tls" if not specified
|
|
secretName: ""
|
|
# -- Mount path for the CA certificate directory
|
|
mountPath: "/ca"
|
|
|
|
# -- Client Certificate configuration (contains both cert and key)
|
|
# Certificates will be mounted to the directory specified in mountPath
|
|
clientCert:
|
|
# -- Enable client certificate mounting
|
|
enabled: false
|
|
# -- Name of the Kubernetes secret containing the client certificate and key
|
|
# Defaults to "release-name-tls" if not specified
|
|
secretName: ""
|
|
# -- Mount path for the client certificate directory
|
|
mountPath: "/tls"
|
|
|
|
# -- Resource limits & requests.
|
|
# Update according to your own use case as these values might be too low for a typical deployment.
|
|
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
resources:
|
|
{}
|
|
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
# -- Perses configuration file
|
|
# ref: https://github.com/perses/perses/blob/main/docs/configuration/configuration.md
|
|
config:
|
|
# -- Annotations for config
|
|
annotations: {}
|
|
|
|
# -- Use it in case you want to prefix the API path. By default the API is served with the path /api.
|
|
# With this config, it will be served with the path <api_prefix>/api
|
|
api_prefix: ""
|
|
|
|
security:
|
|
# -- Configure Perses instance as readonly
|
|
readonly: false
|
|
# -- Enable Authentication
|
|
enable_auth: false
|
|
# -- cookie config
|
|
cookie:
|
|
same_site: lax
|
|
secure: false
|
|
# [ same_site: < enum | possibleValue = 'strict' | 'lax' | 'none' > | default = lax ]
|
|
# Set to true if you host Perses behind HTTPS. Default is false
|
|
# [ secure: <boolean> | default = false ]
|
|
|
|
# -- Frontend configuration
|
|
frontend:
|
|
explorer:
|
|
enable: true
|
|
# -- Information contains markdown content to be display on the home page
|
|
information: ""
|
|
# -- Important dashboards list
|
|
important_dashboards:
|
|
[]
|
|
# - project: "perses"
|
|
# dashboard: "Demo"
|
|
|
|
# -- Database config based on data base type
|
|
database:
|
|
# -- file system configs
|
|
file:
|
|
folder: /perses
|
|
extension: json
|
|
# -- SQL Config (Perses v0.53+ uses camelCase keys in tls_config)
|
|
# sql:
|
|
# user: "user"
|
|
# password: "password"
|
|
# net: "tcp"
|
|
# addr: "localhost:3306"
|
|
# db_name: "perses"
|
|
# allow_native_passwords: true
|
|
# tls_config:
|
|
# caFile: "/ca/ca.crt"
|
|
# certFile: "/tls/tls.crt"
|
|
# keyFile: "/tls/tls.key"
|
|
# serverName: "localhost"
|
|
# insecureSkipVerify: false
|
|
# minVersion: "TLS12"
|
|
# maxVersion: "TLS13"
|
|
|
|
# -- provisioning config
|
|
provisioning:
|
|
folders:
|
|
- /etc/perses/provisioning
|
|
interval: 10m
|
|
|
|
# -- Persistence configuration for Perses provisioning.
|
|
# For more information on provisioning feature, see: https://perses.dev/perses/docs/configuration/provisioning/
|
|
# When enabled, a PersistentVolumeClaim (PVC) is created via StatefulSet volumeClaimTemplates.
|
|
# The PVC will be named: provisioning-<statefulset-name>-<ordinal>
|
|
# Examples:
|
|
# - Release "perses-oci" → PVC: "provisioning-perses-oci-0"
|
|
# - Release "my-app" → PVC: "provisioning-my-app-perses-0"
|
|
# This PVC can be referenced by other workloads (e.g., CronJobs) to write dashboards/datasources.
|
|
provisioningPersistence:
|
|
# -- enable persistent volume for provisioning
|
|
enabled: false
|
|
# -- storage class for provisioning PVC
|
|
storageClass: ""
|
|
# -- access modes for provisioning PVC
|
|
# ReadWriteOnce: Only one pod can mount (cheaper, single-node storage)
|
|
# ReadWriteMany: Multiple pods can mount simultaneously (required for CronJobs or multiple replicas)
|
|
# Note: ReadWriteMany requires storage class that supports it (e.g., NFS, CephFS, Azure Files)
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
# -- size of provisioning PVC
|
|
size: 1Gi
|
|
# -- labels for provisioning PVC
|
|
labels: {}
|
|
# -- annotations for provisioning PVC
|
|
annotations: {}
|
|
|
|
# -- Perses configuration as environment variables.
|
|
# A Kubernetes Secret will be created containing these environment variables.
|
|
# Perses automatically merges them at runtime using the PERSES_<YAML_PATH> pattern,
|
|
# e.g. PERSES_SECURITY_AUTHENTICATION_PROVIDERS_OIDC_0_CLIENT_SECRET
|
|
# For more information, see: https://perses.dev/perses/docs/configuration/configuration/?h=envir#configuration-file
|
|
envVars: []
|
|
# - name: PERSES_SECURITY_AUTHENTICATION_PROVIDERS_OIDC_0_CLIENT_SECRET
|
|
# value: "4711"
|
|
# - name: PERSES_SECURITY_AUTHENTICATION_PROVIDERS_OIDC_1_CLIENT_SECRET
|
|
# value: "0815"
|
|
|
|
# -- Secret settings for envVars / auto-generated auth env vars
|
|
secret:
|
|
# -- Create the Secret automatically
|
|
create: true
|
|
# -- Name of the Secret to reference (defaults to release fullname when empty)
|
|
name: ""
|
|
|
|
# -- Name of existing Kubernetes Secret containing environment variables.
|
|
# When specified, no new Secret is created and values from envVars array are ignored.
|
|
#########################################################################################################
|
|
###### WARNING: 'envVarsExternalSecretName' is deprecated since 0.19.2 and will be removed soon. #####
|
|
###### Use the 'secret' block to reference an existing Secret instead. #####
|
|
###### Example: set secret.create=false and secret.name to your Secret name. #####
|
|
#########################################################################################################
|
|
envVarsExternalSecretName: ""
|
|
|
|
# -- Sidecar configuration that watches for ConfigMaps with the specified label/labelValue and loads them into Perses provisioning
|
|
sidecar:
|
|
# -- Enable the sidecar container for ConfigMap provisioning
|
|
enabled: false
|
|
# -- List of usernames to bind to the Perses global-admin role when the sidecar is enabled
|
|
globalAdminUsers: []
|
|
image:
|
|
# -- Container image registry for the sidecar
|
|
registry: docker.io
|
|
# -- Container image repository for the sidecar
|
|
repository: kiwigrid/k8s-sidecar
|
|
# -- Container image tag for the sidecar
|
|
tag: 2.5.0
|
|
# -- Label key to watch for ConfigMaps containing Perses resources
|
|
label: "perses.dev/resource"
|
|
# -- Label value to watch for ConfigMaps containing Perses resources
|
|
labelValue: "true"
|
|
# -- check for configmaps from all namespaces. When set to false, it will only check for configmaps in the same namespace as the Perses instance
|
|
allNamespaces: true
|
|
# -- Port exposed by the sidecar health endpoint (k8s-sidecar HEALTH_PORT env var)
|
|
healthPort: 8081
|
|
# -- add additional environment variables to sidecar container. you can look at the k8s-sidecar documentation for more information - https://github.com/kiwigrid/k8s-sidecar
|
|
extraEnvVars:
|
|
[]
|
|
# - name: RESOURCE
|
|
# value: both
|
|
# -- Enable secret access permissions in the cluster role. When enabled, the sidecar will have permissions to read secrets and use them.
|
|
enableSecretAccess: false
|
|
# -- dedicated sidecar container security in case elevated privileges are needed for writing to volumes.
|
|
securityContext: {}
|
|
|
|
# -- Persistence parameters
|
|
persistence:
|
|
# -- If disabled, it will use a emptydir volume
|
|
enabled: false
|
|
|
|
# -- Specify the `storageClass` to provision the volume for the PVC. If you don't specify a `storageClass`, a default `storageClass` will be used.
|
|
# storageClass: ""
|
|
|
|
# -- PVC Access Modes for data volume
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
|
|
# -- PVC Storage Request for data volume
|
|
size: 8Gi
|
|
|
|
# -- Pod-level security context applied to all containers
|
|
securityContext:
|
|
# -- Group ID that owns mounted volumes (needed for file access when using persistent storage)
|
|
fsGroup: 2000
|
|
# -- UID to run the entrypoint of the container process (e.g., 1000)
|
|
# runAsUser: 1000
|
|
# -- GID to run the entrypoint of the container process (e.g., 3000)
|
|
# runAsGroup: 3000
|
|
# -- Indicates that containers must run as a non-root user (true/false)
|
|
# runAsNonRoot: true
|
|
# -- How volume ownership and permissions are changed (OnRootMismatch/Always)
|
|
# fsGroupChangePolicy: OnRootMismatch
|
|
# -- List of additional groups for the first process in containers
|
|
# supplementalGroups: [2000, 3000]
|
|
|
|
# -- Labels for the PVC
|
|
labels: {}
|
|
# -- Annotations for the PVC
|
|
annotations: {}
|
|
|
|
# -- Configure the ingress resource that allows you to access Perses Frontend
|
|
# ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
|
|
ingress:
|
|
# -- Enable ingress controller resource
|
|
enabled: false
|
|
|
|
# -- Default host for the ingress resource
|
|
hosts:
|
|
- host: perses.local
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
|
|
# -- IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)
|
|
# This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .
|
|
# ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
|
|
#
|
|
ingressClassName: ""
|
|
|
|
# -- Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.
|
|
# For a full list of possible ingress annotations, please see
|
|
# ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md
|
|
annotations: {}
|
|
|
|
# -- Ingress TLS configuration
|
|
tls: []
|
|
# - secretName: ingress-cert
|
|
# hosts: []
|
|
|
|
# -- Configure Gateway API resources to expose Perses Frontend through a Gateway and HTTPRoute
|
|
gateway:
|
|
# -- Enable Gateway API resources
|
|
enabled: false
|
|
# -- Create a Gateway resource. If false, only the HTTPRoute is created and parentRefs must target an existing Gateway.
|
|
createGateway: true
|
|
# -- Name of the Gateway to create or reference. Defaults to "<release-name>-perses-gateway" when empty.
|
|
name: ""
|
|
# -- Namespace of the Gateway. Defaults to the release namespace when empty.
|
|
namespace: ""
|
|
# -- GatewayClass name used by the Gateway. Required when createGateway is true.
|
|
gatewayClassName: ""
|
|
# -- Labels to add to the Gateway
|
|
labels: {}
|
|
# -- Annotations to add to the Gateway
|
|
annotations: {}
|
|
# -- Listener configuration for the Gateway
|
|
listeners:
|
|
- name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
hostname: ""
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
httpRoute:
|
|
# -- Name of the HTTPRoute. Defaults to "<release-name>-perses-http-route" when empty.
|
|
name: ""
|
|
# -- Labels to add to the HTTPRoute
|
|
labels: {}
|
|
# -- Annotations to add to the HTTPRoute
|
|
annotations: {}
|
|
# -- ParentRefs for the HTTPRoute. Defaults to the created Gateway when createGateway is true.
|
|
parentRefs: []
|
|
# -- Hostnames served by the HTTPRoute
|
|
hostnames:
|
|
- perses.local
|
|
# -- Rules for the HTTPRoute. Defaults to a single PathPrefix "/" rule targeting the Perses service.
|
|
rules: []
|
|
|
|
# -- Configure datasources
|
|
# DEPRECATED: This field will be removed in the future release. Please use the 'sidecar' configuration to provision datasources.
|
|
# ref: https://github.com/perses/perses/blob/90beed356243208f14cf2249bebb6f6222cb77ae/docs/datasource.md
|
|
datasources:
|
|
[]
|
|
# - kind: GlobalDatasource
|
|
# metadata:
|
|
# name: PrometheusDemoBrowser
|
|
# spec:
|
|
# default: true
|
|
# plugin:
|
|
# kind: PrometheusDatasource
|
|
# spec:
|
|
# directUrl: https://prometheus.demo.do.prometheus.io
|
|
|
|
testFramework:
|
|
enabled: true
|
|
image:
|
|
registry: ghcr.io
|
|
repository: cloudoperators/greenhouse-extensions-integration-test
|
|
tag: main
|
|
imagePullPolicy: IfNotPresent
|
|
|
|
# -- Deploy extra K8s manifests
|
|
extraObjects:
|
|
[]
|
|
# - apiVersion: v1
|
|
# kind: ConfigMap
|
|
# metadata:
|
|
# name: 'truststore-{{ include "perses.fullname" . }}'
|
|
# data:
|
|
# ca.crt: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# -----END CERTIFICATE-----
|