mirror of
https://github.com/rtomik/helm-charts.git
synced 2026-08-22 14:53:51 +00:00
Compare commits
3 Commits
norish-0.0
...
adguard-ho
| Author | SHA1 | Date | |
|---|---|---|---|
| 7438b18313 | |||
| 5497301740 | |||
| d84a669a62 |
19
charts/adguard-home/Chart.yaml
Normal file
19
charts/adguard-home/Chart.yaml
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: adguard-home
|
||||||
|
description: AdGuard Home helm chart for Kubernetes - Network-wide ad and tracker blocking DNS server
|
||||||
|
type: application
|
||||||
|
version: 0.0.2
|
||||||
|
appVersion: "v0.107.79"
|
||||||
|
maintainers:
|
||||||
|
- name: Richard Tomik
|
||||||
|
email: no@m.com
|
||||||
|
keywords:
|
||||||
|
- dns
|
||||||
|
- ad-blocking
|
||||||
|
- dns-filtering
|
||||||
|
- adguard-home
|
||||||
|
- privacy
|
||||||
|
- network-security
|
||||||
|
home: https://github.com/rtomik/helm-charts
|
||||||
|
sources:
|
||||||
|
- https://github.com/AdguardTeam/AdGuardHome
|
||||||
55
charts/adguard-home/NOTES.txt
Normal file
55
charts/adguard-home/NOTES.txt
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
1. Get the admin dashboard URL by running these commands:
|
||||||
|
{{- if .Values.ingress.enabled }}
|
||||||
|
{{- range $host := .Values.ingress.hosts }}
|
||||||
|
{{- range .paths }}
|
||||||
|
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else if contains "NodePort" .Values.service.type }}
|
||||||
|
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[?(@.name=='web')].nodePort}" services {{ include "adguard-home.fullname" . }})
|
||||||
|
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||||
|
echo http://$NODE_IP:$NODE_PORT
|
||||||
|
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||||
|
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||||
|
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "adguard-home.fullname" . }}'
|
||||||
|
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "adguard-home.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||||
|
echo http://$SERVICE_IP:{{ .Values.ports.web.port }}
|
||||||
|
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||||
|
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "adguard-home.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||||
|
echo "Visit http://127.0.0.1:8080 to use the AdGuard Home setup wizard / dashboard"
|
||||||
|
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:{{ .Values.ports.web.port }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
2. On first access, complete the AdGuard Home setup wizard (admin user, DNS listener
|
||||||
|
interfaces/ports). The resulting AdGuardHome.yaml is written to the conf volume.
|
||||||
|
|
||||||
|
3. DNS listens on port {{ .Values.ports.dns.port }} (TCP/UDP).
|
||||||
|
{{- if not .Values.hostNetwork }}
|
||||||
|
NOTE: hostNetwork is disabled, so clients will see the Service/pod IP, not their
|
||||||
|
real IP, in the AdGuard Home query log/filters. Set hostNetwork: true, or use a
|
||||||
|
LoadBalancer Service with externalTrafficPolicy: Local, to preserve client IPs.
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.dhcp.enabled }}
|
||||||
|
4. DHCP server is enabled on UDP 67/68.
|
||||||
|
{{- if not .Values.hostNetwork }}
|
||||||
|
WARNING: DHCP requires hostNetwork: true to function correctly - it will not
|
||||||
|
work through a ClusterIP/LoadBalancer Service.
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.persistence.work.enabled .Values.persistence.conf.enabled }}
|
||||||
|
|
||||||
|
5. Data is persisted using PVCs:
|
||||||
|
{{- if .Values.persistence.work.enabled }}
|
||||||
|
- {{ .Values.persistence.work.existingClaim | default (printf "%s-work" (include "adguard-home.fullname" .)) }} (query log, filter cache, stats)
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.persistence.conf.enabled }}
|
||||||
|
- {{ .Values.persistence.conf.existingClaim | default (printf "%s-conf" (include "adguard-home.fullname" .)) }} (AdGuardHome.yaml)
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
|
||||||
|
5. WARNING: No persistence enabled. Configuration and filter data will be lost when
|
||||||
|
the pod restarts.
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
For more information about using this Helm chart, please refer to the readme.md file.
|
||||||
235
charts/adguard-home/readme.md
Normal file
235
charts/adguard-home/readme.md
Normal file
@ -0,0 +1,235 @@
|
|||||||
|
# AdGuard Home Helm Chart
|
||||||
|
|
||||||
|
A Helm chart for deploying [AdGuard Home](https://github.com/AdguardTeam/AdGuardHome), a network-wide DNS ad and tracker blocker, on Kubernetes.
|
||||||
|
|
||||||
|
## Introduction
|
||||||
|
|
||||||
|
This chart deploys AdGuard Home on a Kubernetes cluster using the Helm package manager. AdGuard Home is a self-hosted DNS server that blocks ads and trackers for every device on your network, and can also act as a DHCP server, DNS-over-TLS/HTTPS/QUIC resolver, and DNSCrypt server.
|
||||||
|
|
||||||
|
Source code: https://github.com/rtomik/helm-charts/tree/main/charts/adguard-home
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- Kubernetes 1.19+
|
||||||
|
- Helm 3.0+
|
||||||
|
- PV provisioner support (if persistence is needed)
|
||||||
|
- A way to route real LAN clients to the DNS Service (LoadBalancer/MetalLB, NodePort, or `hostNetwork: true`) if you intend to use it as your network's resolver
|
||||||
|
|
||||||
|
## Installing the Chart
|
||||||
|
|
||||||
|
```bash
|
||||||
|
helm repo add rtomik https://rtomik.github.io/helm-charts
|
||||||
|
helm install adguard-home rtomik/adguard-home
|
||||||
|
```
|
||||||
|
|
||||||
|
## Uninstalling the Chart
|
||||||
|
|
||||||
|
```bash
|
||||||
|
helm uninstall adguard-home
|
||||||
|
```
|
||||||
|
|
||||||
|
## Configuration Examples
|
||||||
|
|
||||||
|
### Minimal Installation (admin UI only, no DNS exposed on the LAN)
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
persistence:
|
||||||
|
work:
|
||||||
|
enabled: true
|
||||||
|
size: 2Gi
|
||||||
|
conf:
|
||||||
|
enabled: true
|
||||||
|
size: 100Mi
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
hosts:
|
||||||
|
- host: adguard.example.com
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- adguard.example.com
|
||||||
|
secretName: adguard-tls
|
||||||
|
```
|
||||||
|
|
||||||
|
### Expose DNS to the LAN via LoadBalancer (e.g. MetalLB)
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
service:
|
||||||
|
type: LoadBalancer
|
||||||
|
loadBalancerIP: 192.168.1.53
|
||||||
|
annotations:
|
||||||
|
metallb.universe.tf/allow-shared-ip: adguard-home
|
||||||
|
|
||||||
|
hostNetwork: true # preserves real client IPs in the query log/filters
|
||||||
|
```
|
||||||
|
|
||||||
|
### Enable DNS-over-TLS / DNS-over-QUIC and DNS-over-HTTPS
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
ports:
|
||||||
|
dot:
|
||||||
|
enabled: true
|
||||||
|
https:
|
||||||
|
enabled: true
|
||||||
|
```
|
||||||
|
|
||||||
|
### Enable the DHCP server
|
||||||
|
|
||||||
|
DHCP requires `hostNetwork: true` - it cannot be proxied through a ClusterIP/LoadBalancer Service.
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
hostNetwork: true
|
||||||
|
ports:
|
||||||
|
dhcp:
|
||||||
|
enabled: true
|
||||||
|
```
|
||||||
|
|
||||||
|
### Use an existing PVC
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
persistence:
|
||||||
|
work:
|
||||||
|
existingClaim: "adguard-work-pvc"
|
||||||
|
conf:
|
||||||
|
existingClaim: "adguard-conf-pvc"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Parameters
|
||||||
|
|
||||||
|
### Global Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `nameOverride` | Override the release name | `""` |
|
||||||
|
| `fullnameOverride` | Fully override the release name | `""` |
|
||||||
|
|
||||||
|
### Image Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `image.repository` | AdGuard Home image repository | `adguard/adguardhome` |
|
||||||
|
| `image.tag` | Image tag | `v0.107.79` |
|
||||||
|
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||||
|
| `imagePullSecrets` | Image pull secrets | `[]` |
|
||||||
|
|
||||||
|
### Deployment Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `replicaCount` | Number of replicas (keep at 1 - AdGuard Home is not multi-writer safe) | `1` |
|
||||||
|
| `revisionHistoryLimit` | Revisions to retain | `3` |
|
||||||
|
| `podSecurityContext.runAsNonRoot` | Run as non-root | `true` |
|
||||||
|
| `podSecurityContext.runAsUser` | User ID | `1000` |
|
||||||
|
| `podSecurityContext.runAsGroup` | Group ID | `1000` |
|
||||||
|
| `podSecurityContext.fsGroup` | Filesystem group ID | `1000` |
|
||||||
|
| `containerSecurityContext.capabilities.add` | Capabilities added (NET_BIND_SERVICE for ports < 1024) | `["NET_BIND_SERVICE"]` |
|
||||||
|
| `hostNetwork` | Use host networking (required for DHCP, recommended for accurate client IPs) | `false` |
|
||||||
|
| `nodeSelector` | Node selector | `{}` |
|
||||||
|
| `tolerations` | Tolerations | `[]` |
|
||||||
|
| `affinity` | Affinity rules | `{}` |
|
||||||
|
|
||||||
|
### Ports Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `ports.web.port` | Admin dashboard / setup wizard | `3000` |
|
||||||
|
| `ports.dns.port` | Plain DNS (TCP+UDP) | `53` |
|
||||||
|
| `ports.dot.enabled` | Enable DNS-over-TLS / DNS-over-QUIC | `false` |
|
||||||
|
| `ports.dot.port` | DoT/DoQ port (TCP+UDP) | `853` |
|
||||||
|
| `ports.https.enabled` | Enable DNS-over-HTTPS / HTTPS admin dashboard | `false` |
|
||||||
|
| `ports.https.port` | HTTPS port (TCP+UDP) | `443` |
|
||||||
|
| `ports.dnscrypt.enabled` | Enable DNSCrypt | `false` |
|
||||||
|
| `ports.dnscrypt.port` | DNSCrypt port (TCP+UDP) | `5443` |
|
||||||
|
| `ports.dhcp.enabled` | Enable DHCP server (67/68 UDP, requires `hostNetwork: true`) | `false` |
|
||||||
|
| `ports.pprof.enabled` | Enable the debug pprof API | `false` |
|
||||||
|
| `ports.pprof.port` | pprof port | `6060` |
|
||||||
|
|
||||||
|
### Service Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
|
| `service.annotations` | Service annotations | `{}` |
|
||||||
|
| `service.loadBalancerIP` | Static LoadBalancer IP (e.g. for MetalLB) | `""` |
|
||||||
|
|
||||||
|
### Ingress Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `ingress.enabled` | Enable ingress (routes to the admin dashboard only) | `false` |
|
||||||
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
|
| `ingress.annotations` | Ingress annotations | See values.yaml |
|
||||||
|
| `ingress.hosts` | Ingress hosts | See values.yaml |
|
||||||
|
| `ingress.tls` | TLS configuration | See values.yaml |
|
||||||
|
|
||||||
|
### Persistence Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `persistence.work.enabled` | Persist `/opt/adguardhome/work` (query log, filter cache, stats) | `true` |
|
||||||
|
| `persistence.work.existingClaim` | Use an existing PVC instead of creating one | `""` |
|
||||||
|
| `persistence.work.storageClass` | Storage class | `""` |
|
||||||
|
| `persistence.work.accessMode` | Access mode | `ReadWriteOnce` |
|
||||||
|
| `persistence.work.size` | PVC size | `1Gi` |
|
||||||
|
| `persistence.conf.enabled` | Persist `/opt/adguardhome/conf` (AdGuardHome.yaml) | `true` |
|
||||||
|
| `persistence.conf.existingClaim` | Use an existing PVC instead of creating one | `""` |
|
||||||
|
| `persistence.conf.storageClass` | Storage class | `""` |
|
||||||
|
| `persistence.conf.accessMode` | Access mode | `ReadWriteOnce` |
|
||||||
|
| `persistence.conf.size` | PVC size | `100Mi` |
|
||||||
|
|
||||||
|
### Resource Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `resources` | Resource limits and requests | `{}` |
|
||||||
|
|
||||||
|
### Health Check Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `probes.liveness.enabled` | Enable liveness probe (TCP check on the admin web port) | `true` |
|
||||||
|
| `probes.liveness.initialDelaySeconds` | Liveness initial delay | `15` |
|
||||||
|
| `probes.liveness.periodSeconds` | Liveness period | `30` |
|
||||||
|
| `probes.readiness.enabled` | Enable readiness probe (TCP check on the admin web port) | `true` |
|
||||||
|
| `probes.readiness.initialDelaySeconds` | Readiness initial delay | `5` |
|
||||||
|
| `probes.readiness.periodSeconds` | Readiness period | `10` |
|
||||||
|
|
||||||
|
### Other Parameters
|
||||||
|
|
||||||
|
| Name | Description | Default |
|
||||||
|
|------|-------------|---------|
|
||||||
|
| `extraEnv` | Additional environment variables | `[]` |
|
||||||
|
| `extraVolumeMounts` | Additional volume mounts | `[]` |
|
||||||
|
| `extraVolumes` | Additional volumes | `[]` |
|
||||||
|
|
||||||
|
## Notes
|
||||||
|
|
||||||
|
- AdGuard Home has no supported way to bootstrap its admin account or DNS settings via
|
||||||
|
environment variables - complete the setup wizard once at `http://<web-service>:3000`
|
||||||
|
after the first install. The resulting `AdGuardHome.yaml` is written to the `conf` PVC,
|
||||||
|
so it survives pod restarts/upgrades.
|
||||||
|
- Because AdGuard Home stores state on disk and isn't multi-writer safe, do not scale
|
||||||
|
`replicaCount` beyond `1`.
|
||||||
|
- If you plan to use this as your network's DNS resolver, prefer `hostNetwork: true` (or
|
||||||
|
a LoadBalancer Service with `externalTrafficPolicy: Local`) so AdGuard Home sees real
|
||||||
|
client IPs rather than a single Service/NAT IP for every device.
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
- **Clients all show up as the same IP / filters by client don't work**: enable `hostNetwork` or use `externalTrafficPolicy: Local` on a LoadBalancer Service.
|
||||||
|
- **DHCP doesn't hand out leases**: DHCP only works with `hostNetwork: true`.
|
||||||
|
- **Setup wizard settings don't persist**: verify `persistence.conf.enabled` is `true` and the PVC is bound.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
kubectl logs -f deployment/adguard-home
|
||||||
|
kubectl describe pod -l app.kubernetes.io/name=adguard-home
|
||||||
|
```
|
||||||
|
|
||||||
|
## Links
|
||||||
|
|
||||||
|
- [AdGuard Home GitHub](https://github.com/AdguardTeam/AdGuardHome)
|
||||||
|
- [AdGuard Home Docker documentation](https://adguard-dns.io/kb/adguard-home/docker/)
|
||||||
|
- [Chart Source](https://github.com/rtomik/helm-charts/tree/main/charts/adguard-home)
|
||||||
@ -1,14 +1,14 @@
|
|||||||
{{/*
|
{{/*
|
||||||
Expand the name of the chart.
|
Expand the name of the chart.
|
||||||
*/}}
|
*/}}
|
||||||
{{- define "checkmk.name" -}}
|
{{- define "adguard-home.name" -}}
|
||||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{/*
|
{{/*
|
||||||
Create a default fully qualified app name.
|
Create a default fully qualified app name.
|
||||||
*/}}
|
*/}}
|
||||||
{{- define "checkmk.fullname" -}}
|
{{- define "adguard-home.fullname" -}}
|
||||||
{{- if .Values.fullnameOverride }}
|
{{- if .Values.fullnameOverride }}
|
||||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
{{- else }}
|
{{- else }}
|
||||||
@ -20,16 +20,16 @@ Create a default fully qualified app name.
|
|||||||
{{/*
|
{{/*
|
||||||
Create chart name and version as used by the chart label.
|
Create chart name and version as used by the chart label.
|
||||||
*/}}
|
*/}}
|
||||||
{{- define "checkmk.chart" -}}
|
{{- define "adguard-home.chart" -}}
|
||||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{/*
|
{{/*
|
||||||
Common labels
|
Common labels
|
||||||
*/}}
|
*/}}
|
||||||
{{- define "checkmk.labels" -}}
|
{{- define "adguard-home.labels" -}}
|
||||||
helm.sh/chart: {{ include "checkmk.chart" . }}
|
helm.sh/chart: {{ include "adguard-home.chart" . }}
|
||||||
{{ include "checkmk.selectorLabels" . }}
|
{{ include "adguard-home.selectorLabels" . }}
|
||||||
{{- if .Chart.AppVersion }}
|
{{- if .Chart.AppVersion }}
|
||||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@ -39,28 +39,7 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|||||||
{{/*
|
{{/*
|
||||||
Selector labels
|
Selector labels
|
||||||
*/}}
|
*/}}
|
||||||
{{- define "checkmk.selectorLabels" -}}
|
{{- define "adguard-home.selectorLabels" -}}
|
||||||
app.kubernetes.io/name: {{ include "checkmk.name" . }}
|
app.kubernetes.io/name: {{ include "adguard-home.name" . }}
|
||||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{/*
|
|
||||||
Name of the secret holding CMK_PASSWORD
|
|
||||||
*/}}
|
|
||||||
{{- define "checkmk.secretName" -}}
|
|
||||||
{{- .Values.config.adminPassword.existingSecret | default (printf "%s-secrets" (include "checkmk.fullname" .)) }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Web UI path for health probes: /<siteId>/check_mk/login.py
|
|
||||||
*/}}
|
|
||||||
{{- define "checkmk.probePath" -}}
|
|
||||||
{{- printf "/%s/check_mk/login.py" .Values.config.siteId }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
tmpfs mount path derived from site ID
|
|
||||||
*/}}
|
|
||||||
{{- define "checkmk.tmpPath" -}}
|
|
||||||
{{- printf "/opt/omd/sites/%s/tmp" .Values.config.siteId }}
|
|
||||||
{{- end }}
|
|
||||||
175
charts/adguard-home/templates/deployment.yaml
Normal file
175
charts/adguard-home/templates/deployment.yaml
Normal file
@ -0,0 +1,175 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "adguard-home.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.replicaCount }}
|
||||||
|
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "adguard-home.selectorLabels" . | nindent 6 }}
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "adguard-home.selectorLabels" . | nindent 8 }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.hostNetwork }}
|
||||||
|
hostNetwork: true
|
||||||
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
|
{{- end }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||||
|
{{- if .Values.persistence.conf.enabled }}
|
||||||
|
initContainers:
|
||||||
|
- name: init-config
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
# AdGuard Home's first-run setup wizard defaults the admin web interface
|
||||||
|
# port to 80, regardless of ports.web.port below - if a user accepts that
|
||||||
|
# default, the Service/Ingress (which forward to ports.web.port) end up
|
||||||
|
# pointing at the wrong container port and the UI becomes unreachable
|
||||||
|
# (502/Bad Gateway) as soon as setup completes. Seeding http.address here
|
||||||
|
# before the wizard ever runs makes it pre-fill the correct port instead.
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
if [ ! -f /opt/adguardhome/conf/AdGuardHome.yaml ]; then
|
||||||
|
cat > /opt/adguardhome/conf/AdGuardHome.yaml <<'CONF'
|
||||||
|
http:
|
||||||
|
address: 0.0.0.0:{{ .Values.ports.web.port }}
|
||||||
|
CONF
|
||||||
|
fi
|
||||||
|
volumeMounts:
|
||||||
|
- name: conf
|
||||||
|
mountPath: /opt/adguardhome/conf
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: {{ .Chart.Name }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
ports:
|
||||||
|
- name: web
|
||||||
|
containerPort: {{ .Values.ports.web.port }}
|
||||||
|
protocol: TCP
|
||||||
|
- name: dns-tcp
|
||||||
|
containerPort: {{ .Values.ports.dns.port }}
|
||||||
|
protocol: TCP
|
||||||
|
- name: dns-udp
|
||||||
|
containerPort: {{ .Values.ports.dns.port }}
|
||||||
|
protocol: UDP
|
||||||
|
{{- if .Values.ports.dot.enabled }}
|
||||||
|
- name: dot-tcp
|
||||||
|
containerPort: {{ .Values.ports.dot.port }}
|
||||||
|
protocol: TCP
|
||||||
|
- name: dot-udp
|
||||||
|
containerPort: {{ .Values.ports.dot.port }}
|
||||||
|
protocol: UDP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.https.enabled }}
|
||||||
|
- name: https-tcp
|
||||||
|
containerPort: {{ .Values.ports.https.port }}
|
||||||
|
protocol: TCP
|
||||||
|
- name: https-udp
|
||||||
|
containerPort: {{ .Values.ports.https.port }}
|
||||||
|
protocol: UDP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.dnscrypt.enabled }}
|
||||||
|
- name: dnscrypt-tcp
|
||||||
|
containerPort: {{ .Values.ports.dnscrypt.port }}
|
||||||
|
protocol: TCP
|
||||||
|
- name: dnscrypt-udp
|
||||||
|
containerPort: {{ .Values.ports.dnscrypt.port }}
|
||||||
|
protocol: UDP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.dhcp.enabled }}
|
||||||
|
- name: dhcp-server
|
||||||
|
containerPort: 67
|
||||||
|
protocol: UDP
|
||||||
|
- name: dhcp-client
|
||||||
|
containerPort: 68
|
||||||
|
protocol: UDP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.pprof.enabled }}
|
||||||
|
- name: pprof
|
||||||
|
containerPort: {{ .Values.ports.pprof.port }}
|
||||||
|
protocol: TCP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.probes.liveness.enabled }}
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: web
|
||||||
|
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.probes.readiness.enabled }}
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: web
|
||||||
|
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||||
|
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||||
|
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.extraEnv }}
|
||||||
|
env:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
{{- if .Values.persistence.work.enabled }}
|
||||||
|
- name: work
|
||||||
|
mountPath: /opt/adguardhome/work
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.persistence.conf.enabled }}
|
||||||
|
- name: conf
|
||||||
|
mountPath: /opt/adguardhome/conf
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.extraVolumeMounts }}
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
|
volumes:
|
||||||
|
{{- if .Values.persistence.work.enabled }}
|
||||||
|
- name: work
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ .Values.persistence.work.existingClaim | default (printf "%s-work" (include "adguard-home.fullname" .)) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.persistence.conf.enabled }}
|
||||||
|
- name: conf
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ .Values.persistence.conf.existingClaim | default (printf "%s-conf" (include "adguard-home.fullname" .)) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.extraVolumes }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
@ -2,9 +2,9 @@
|
|||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
metadata:
|
metadata:
|
||||||
name: {{ include "checkmk.fullname" . }}
|
name: {{ include "adguard-home.fullname" . }}
|
||||||
labels:
|
labels:
|
||||||
{{- include "checkmk.labels" . | nindent 4 }}
|
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||||
{{- with .Values.ingress.annotations }}
|
{{- with .Values.ingress.annotations }}
|
||||||
annotations:
|
annotations:
|
||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
@ -35,9 +35,9 @@ spec:
|
|||||||
pathType: {{ .pathType }}
|
pathType: {{ .pathType }}
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: {{ include "checkmk.fullname" $ }}
|
name: {{ include "adguard-home.fullname" $ }}
|
||||||
port:
|
port:
|
||||||
number: {{ $.Values.service.port }}
|
number: {{ $.Values.ports.web.port }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
43
charts/adguard-home/templates/pvc.yaml
Normal file
43
charts/adguard-home/templates/pvc.yaml
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{{- if and .Values.persistence.work.enabled (not .Values.persistence.work.existingClaim) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: {{ include "adguard-home.fullname" . }}-work
|
||||||
|
labels:
|
||||||
|
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.persistence.work.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- {{ .Values.persistence.work.accessMode | quote }}
|
||||||
|
{{- if .Values.persistence.work.storageClass }}
|
||||||
|
storageClassName: {{ .Values.persistence.work.storageClass | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.persistence.work.size | quote }}
|
||||||
|
{{- end }}
|
||||||
|
---
|
||||||
|
{{- if and .Values.persistence.conf.enabled (not .Values.persistence.conf.existingClaim) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: {{ include "adguard-home.fullname" . }}-conf
|
||||||
|
labels:
|
||||||
|
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.persistence.conf.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- {{ .Values.persistence.conf.accessMode | quote }}
|
||||||
|
{{- if .Values.persistence.conf.storageClass }}
|
||||||
|
storageClassName: {{ .Values.persistence.conf.storageClass | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.persistence.conf.size | quote }}
|
||||||
|
{{- end }}
|
||||||
76
charts/adguard-home/templates/service.yaml
Normal file
76
charts/adguard-home/templates/service.yaml
Normal file
@ -0,0 +1,76 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "adguard-home.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.service.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.service.type }}
|
||||||
|
{{- if .Values.service.loadBalancerIP }}
|
||||||
|
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: web
|
||||||
|
port: {{ .Values.ports.web.port }}
|
||||||
|
targetPort: web
|
||||||
|
protocol: TCP
|
||||||
|
- name: dns-tcp
|
||||||
|
port: {{ .Values.ports.dns.port }}
|
||||||
|
targetPort: dns-tcp
|
||||||
|
protocol: TCP
|
||||||
|
- name: dns-udp
|
||||||
|
port: {{ .Values.ports.dns.port }}
|
||||||
|
targetPort: dns-udp
|
||||||
|
protocol: UDP
|
||||||
|
{{- if .Values.ports.dot.enabled }}
|
||||||
|
- name: dot-tcp
|
||||||
|
port: {{ .Values.ports.dot.port }}
|
||||||
|
targetPort: dot-tcp
|
||||||
|
protocol: TCP
|
||||||
|
- name: dot-udp
|
||||||
|
port: {{ .Values.ports.dot.port }}
|
||||||
|
targetPort: dot-udp
|
||||||
|
protocol: UDP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.https.enabled }}
|
||||||
|
- name: https-tcp
|
||||||
|
port: {{ .Values.ports.https.port }}
|
||||||
|
targetPort: https-tcp
|
||||||
|
protocol: TCP
|
||||||
|
- name: https-udp
|
||||||
|
port: {{ .Values.ports.https.port }}
|
||||||
|
targetPort: https-udp
|
||||||
|
protocol: UDP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.dnscrypt.enabled }}
|
||||||
|
- name: dnscrypt-tcp
|
||||||
|
port: {{ .Values.ports.dnscrypt.port }}
|
||||||
|
targetPort: dnscrypt-tcp
|
||||||
|
protocol: TCP
|
||||||
|
- name: dnscrypt-udp
|
||||||
|
port: {{ .Values.ports.dnscrypt.port }}
|
||||||
|
targetPort: dnscrypt-udp
|
||||||
|
protocol: UDP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.dhcp.enabled }}
|
||||||
|
- name: dhcp-server
|
||||||
|
port: 67
|
||||||
|
targetPort: dhcp-server
|
||||||
|
protocol: UDP
|
||||||
|
- name: dhcp-client
|
||||||
|
port: 68
|
||||||
|
targetPort: dhcp-client
|
||||||
|
protocol: UDP
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ports.pprof.enabled }}
|
||||||
|
- name: pprof
|
||||||
|
port: {{ .Values.ports.pprof.port }}
|
||||||
|
targetPort: pprof
|
||||||
|
protocol: TCP
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
{{- include "adguard-home.selectorLabels" . | nindent 4 }}
|
||||||
161
charts/adguard-home/values.yaml
Normal file
161
charts/adguard-home/values.yaml
Normal file
@ -0,0 +1,161 @@
|
|||||||
|
## Global settings
|
||||||
|
nameOverride: ""
|
||||||
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
## Image settings
|
||||||
|
image:
|
||||||
|
repository: adguard/adguardhome
|
||||||
|
tag: "v0.107.79"
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
|
||||||
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
## Deployment settings
|
||||||
|
## AdGuard Home keeps its state on disk (PVCs below) and is not designed to run as
|
||||||
|
## multiple replicas against the same data - keep replicaCount at 1.
|
||||||
|
replicaCount: 1
|
||||||
|
revisionHistoryLimit: 3
|
||||||
|
|
||||||
|
## Pod security settings
|
||||||
|
## AdGuard Home's own startup check refuses to run on its first launch unless the
|
||||||
|
## process euid is 0 ("this is the first launch of adguard home; you must run it as
|
||||||
|
## administrator"), so - unlike most charts here - this one runs as root. Capabilities
|
||||||
|
## are still dropped to the minimum the binary needs.
|
||||||
|
podSecurityContext:
|
||||||
|
runAsNonRoot: false
|
||||||
|
runAsUser: 0
|
||||||
|
fsGroup: 0
|
||||||
|
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
add:
|
||||||
|
- NET_BIND_SERVICE
|
||||||
|
- CHOWN
|
||||||
|
- DAC_OVERRIDE
|
||||||
|
- SETUID
|
||||||
|
- SETGID
|
||||||
|
|
||||||
|
## Pod scheduling
|
||||||
|
nodeSelector: {}
|
||||||
|
tolerations: []
|
||||||
|
affinity: {}
|
||||||
|
podAnnotations: {}
|
||||||
|
|
||||||
|
## Use host networking. Required if you enable the DHCP server, and recommended
|
||||||
|
## when exposing DNS so AdGuard Home sees real client IPs instead of the pod/service IP.
|
||||||
|
hostNetwork: false
|
||||||
|
|
||||||
|
## Ports exposed by AdGuard Home. web+dns are enabled by default; the rest are
|
||||||
|
## optional protocols you can turn on as needed.
|
||||||
|
## https://adguard-dns.io/kb/adguard-home/docker/
|
||||||
|
ports:
|
||||||
|
web:
|
||||||
|
# Admin dashboard / setup wizard
|
||||||
|
port: 3000
|
||||||
|
dns:
|
||||||
|
# Plain DNS (TCP+UDP)
|
||||||
|
port: 53
|
||||||
|
dot:
|
||||||
|
# DNS-over-TLS / DNS-over-QUIC (TCP+UDP)
|
||||||
|
enabled: false
|
||||||
|
port: 853
|
||||||
|
https:
|
||||||
|
# DNS-over-HTTPS and HTTPS admin dashboard (TCP+UDP)
|
||||||
|
enabled: false
|
||||||
|
port: 443
|
||||||
|
dnscrypt:
|
||||||
|
# DNSCrypt (TCP+UDP)
|
||||||
|
enabled: false
|
||||||
|
port: 5443
|
||||||
|
dhcp:
|
||||||
|
# DHCP server (UDP 67/68). Requires hostNetwork: true.
|
||||||
|
enabled: false
|
||||||
|
pprof:
|
||||||
|
# Debug pprof API - leave disabled unless troubleshooting
|
||||||
|
enabled: false
|
||||||
|
port: 6060
|
||||||
|
|
||||||
|
## Service settings
|
||||||
|
## For exposing DNS to your LAN, set type to LoadBalancer (e.g. with MetalLB) and
|
||||||
|
## add annotations/loadBalancerIP as needed, or use type: NodePort.
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
annotations: {}
|
||||||
|
# loadBalancerIP: 192.168.1.53
|
||||||
|
|
||||||
|
## Ingress settings (routes to the admin web UI only)
|
||||||
|
ingress:
|
||||||
|
enabled: false
|
||||||
|
className: ""
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
hosts:
|
||||||
|
- host: adguard.domain.com
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- adguard.domain.com
|
||||||
|
|
||||||
|
## Persistence settings
|
||||||
|
persistence:
|
||||||
|
work:
|
||||||
|
# /opt/adguardhome/work - query log, filter cache, stats
|
||||||
|
enabled: true
|
||||||
|
existingClaim: ""
|
||||||
|
storageClass: ""
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 1Gi
|
||||||
|
annotations: {}
|
||||||
|
conf:
|
||||||
|
# /opt/adguardhome/conf - AdGuardHome.yaml configuration
|
||||||
|
enabled: true
|
||||||
|
existingClaim: ""
|
||||||
|
storageClass: ""
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 100Mi
|
||||||
|
annotations: {}
|
||||||
|
|
||||||
|
## Resource limits and requests
|
||||||
|
resources: {}
|
||||||
|
# resources:
|
||||||
|
# limits:
|
||||||
|
# cpu: 500m
|
||||||
|
# memory: 256Mi
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 64Mi
|
||||||
|
|
||||||
|
## Application health checks
|
||||||
|
## Uses a TCP check against the admin web port. The DNS listener only comes up after
|
||||||
|
## the first-run setup wizard is completed, so probing the DNS port instead would
|
||||||
|
## fail/restart the pod before it's ever configured; the web port is always up.
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: true
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 30
|
||||||
|
timeoutSeconds: 5
|
||||||
|
failureThreshold: 3
|
||||||
|
successThreshold: 1
|
||||||
|
readiness:
|
||||||
|
enabled: true
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
timeoutSeconds: 5
|
||||||
|
failureThreshold: 3
|
||||||
|
successThreshold: 1
|
||||||
|
|
||||||
|
## Extra environment variables
|
||||||
|
extraEnv: []
|
||||||
|
|
||||||
|
## Extra volume mounts
|
||||||
|
extraVolumeMounts: []
|
||||||
|
|
||||||
|
## Extra volumes
|
||||||
|
extraVolumes: []
|
||||||
@ -1,18 +0,0 @@
|
|||||||
apiVersion: v2
|
|
||||||
name: checkmk
|
|
||||||
description: Checkmk monitoring platform helm chart for Kubernetes
|
|
||||||
type: application
|
|
||||||
version: 0.1.0
|
|
||||||
appVersion: "2.5.0p6"
|
|
||||||
maintainers:
|
|
||||||
- name: Richard Tomik
|
|
||||||
email: richard.tomik@proton.me
|
|
||||||
keywords:
|
|
||||||
- monitoring
|
|
||||||
- checkmk
|
|
||||||
- infrastructure
|
|
||||||
- observability
|
|
||||||
home: https://github.com/rtomik/helm-charts
|
|
||||||
sources:
|
|
||||||
- https://checkmk.com
|
|
||||||
- https://hub.docker.com/r/checkmk/check-mk-community
|
|
||||||
@ -1,56 +0,0 @@
|
|||||||
1. Get the application URL by running these commands:
|
|
||||||
{{- if .Values.ingress.enabled }}
|
|
||||||
{{- range $host := .Values.ingress.hosts }}
|
|
||||||
{{- range .paths }}
|
|
||||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- else if contains "NodePort" .Values.service.type }}
|
|
||||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "checkmk.fullname" . }})
|
|
||||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
|
||||||
echo http://$NODE_IP:$NODE_PORT
|
|
||||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
|
||||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
|
||||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "checkmk.fullname" . }}'
|
|
||||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "checkmk.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
|
||||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
|
||||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
|
||||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "checkmk.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
|
||||||
echo "Visit http://127.0.0.1:5000/{{ .Values.config.siteId }}/check_mk/ to use your application"
|
|
||||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 5000:5000
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
2. Checkmk web interface is available at:
|
|
||||||
http://<host>/{{ .Values.config.siteId }}/check_mk/
|
|
||||||
|
|
||||||
3. Default credentials:
|
|
||||||
Username: cmkadmin
|
|
||||||
Password: (as configured in config.adminPassword)
|
|
||||||
|
|
||||||
4. Ports:
|
|
||||||
- Web interface: {{ .Values.service.port }} → container 5000
|
|
||||||
- Agent Receiver: {{ .Values.service.agentReceiverPort }} → container 8000
|
|
||||||
|
|
||||||
{{- if .Values.persistence.enabled }}
|
|
||||||
5. Persistent storage: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "checkmk.fullname" . }}-sites{{ end }} ({{ .Values.persistence.size }})
|
|
||||||
Mounted at /omd/sites — contains all site data, configs, and RRD files.
|
|
||||||
{{- else }}
|
|
||||||
5. WARNING: No persistent storage enabled. All monitoring data will be lost on pod restart.
|
|
||||||
Enable persistence in values.yaml for production use.
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{- if .Values.config.livestatusTcp }}
|
|
||||||
6. Livestatus TCP is enabled. Ensure appropriate NetworkPolicies are in place.
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{- if not .Values.config.adminPassword.existingSecret }}
|
|
||||||
7. SECURITY NOTE: For production use, store the admin password in a Kubernetes Secret:
|
|
||||||
kubectl create secret generic checkmk-secrets \
|
|
||||||
--from-literal=cmk-password=<your-password>
|
|
||||||
Then set config.adminPassword.existingSecret=checkmk-secrets in your values.
|
|
||||||
{{- else }}
|
|
||||||
7. Admin password read from existing secret: {{ .Values.config.adminPassword.existingSecret }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
For more information, see the official Checkmk Docker documentation:
|
|
||||||
https://docs.checkmk.com/latest/en/introduction_docker.html
|
|
||||||
@ -1,91 +0,0 @@
|
|||||||
# Checkmk Helm Chart
|
|
||||||
|
|
||||||
Helm chart for deploying [Checkmk](https://checkmk.com/) — an infrastructure and application monitoring platform — on Kubernetes.
|
|
||||||
|
|
||||||
## Overview
|
|
||||||
|
|
||||||
Checkmk uses OMD (Open Monitoring Distribution) to manage monitoring sites. This chart deploys the Community Edition using the official Docker image with:
|
|
||||||
|
|
||||||
- Persistent storage for all site data (`/omd/sites`)
|
|
||||||
- RAM-backed tmpfs for the site temp directory (performance optimization from the official docs)
|
|
||||||
- Separate service ports for the web interface (5000) and agent receiver (8000)
|
|
||||||
- Admin password stored in a Kubernetes Secret
|
|
||||||
|
|
||||||
## Prerequisites
|
|
||||||
|
|
||||||
- Kubernetes 1.19+
|
|
||||||
- Helm 3.0+
|
|
||||||
- A default StorageClass or an existing PersistentVolumeClaim
|
|
||||||
|
|
||||||
## Quick Start
|
|
||||||
|
|
||||||
```bash
|
|
||||||
helm install checkmk ./charts/checkmk \
|
|
||||||
--set config.adminPassword.value=mysecretpassword \
|
|
||||||
--set ingress.enabled=true \
|
|
||||||
--set ingress.hosts[0].host=checkmk.example.com \
|
|
||||||
--set ingress.hosts[0].paths[0].path=/ \
|
|
||||||
--set ingress.hosts[0].paths[0].pathType=Prefix
|
|
||||||
```
|
|
||||||
|
|
||||||
After installation, access the UI at `http://<host>/cmk/check_mk/` with username `cmkadmin`.
|
|
||||||
|
|
||||||
## Configuration
|
|
||||||
|
|
||||||
### Admin Password (recommended: use existing secret)
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl create secret generic checkmk-secrets \
|
|
||||||
--from-literal=cmk-password=<your-password>
|
|
||||||
```
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
config:
|
|
||||||
adminPassword:
|
|
||||||
existingSecret: "checkmk-secrets"
|
|
||||||
passwordKey: "cmk-password"
|
|
||||||
```
|
|
||||||
|
|
||||||
### Site ID
|
|
||||||
|
|
||||||
The `config.siteId` value sets the Checkmk site name and determines the URL path (`/<siteId>/check_mk/`). Defaults to `cmk`.
|
|
||||||
|
|
||||||
### Livestatus TCP
|
|
||||||
|
|
||||||
Enable Livestatus TCP for distributed monitoring setups or external integrations:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
config:
|
|
||||||
livestatusTcp: true
|
|
||||||
```
|
|
||||||
|
|
||||||
### Persistence
|
|
||||||
|
|
||||||
Site data (hosts, checks, RRD files) is stored in `/omd/sites`. A 5 Gi PVC is created by default. Adjust size or use an existing claim:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
persistence:
|
|
||||||
size: 20Gi
|
|
||||||
storageClass: "fast-ssd"
|
|
||||||
```
|
|
||||||
|
|
||||||
## Key Values
|
|
||||||
|
|
||||||
| Key | Default | Description |
|
|
||||||
|-----|---------|-------------|
|
|
||||||
| `image.tag` | `2.5.0p6` | Checkmk Community image tag |
|
|
||||||
| `config.siteId` | `cmk` | Monitoring site name |
|
|
||||||
| `config.timezone` | `UTC` | Container timezone |
|
|
||||||
| `config.adminPassword.value` | `changeme` | cmkadmin password (use existingSecret in production) |
|
|
||||||
| `config.livestatusTcp` | `false` | Enable Livestatus over TCP |
|
|
||||||
| `config.mailRelayHost` | `""` | SMTP relay for notifications |
|
|
||||||
| `service.port` | `5000` | Web interface port |
|
|
||||||
| `service.agentReceiverPort` | `8000` | Agent registration port |
|
|
||||||
| `persistence.enabled` | `true` | Enable persistent storage |
|
|
||||||
| `persistence.size` | `5Gi` | PVC size |
|
|
||||||
|
|
||||||
## Security Notes
|
|
||||||
|
|
||||||
Checkmk (OMD) requires root access inside the container to manage monitoring sites and switch to the site user account. The `podSecurityContext.runAsUser` is set to `0` and `containerSecurityContext.allowPrivilegeEscalation` is `true` by default.
|
|
||||||
|
|
||||||
Place a reverse proxy (e.g. Traefik or nginx) in front for TLS termination rather than exposing the container port directly.
|
|
||||||
@ -1,135 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: {{ include "checkmk.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{- include "checkmk.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
|
||||||
spec:
|
|
||||||
replicas: {{ .Values.replicaCount }}
|
|
||||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
{{- include "checkmk.selectorLabels" . | nindent 6 }}
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "checkmk.selectorLabels" . | nindent 8 }}
|
|
||||||
annotations:
|
|
||||||
{{- with .Values.podAnnotations }}
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
spec:
|
|
||||||
{{- with .Values.imagePullSecrets }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
securityContext:
|
|
||||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
|
||||||
containers:
|
|
||||||
- name: {{ .Chart.Name }}
|
|
||||||
securityContext:
|
|
||||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
|
||||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
|
||||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
containerPort: 5000
|
|
||||||
protocol: TCP
|
|
||||||
- name: agent-receiver
|
|
||||||
containerPort: 8000
|
|
||||||
protocol: TCP
|
|
||||||
{{- if .Values.probes.startup.enabled }}
|
|
||||||
startupProbe:
|
|
||||||
httpGet:
|
|
||||||
path: {{ include "checkmk.probePath" . }}
|
|
||||||
port: http
|
|
||||||
initialDelaySeconds: {{ .Values.probes.startup.initialDelaySeconds }}
|
|
||||||
periodSeconds: {{ .Values.probes.startup.periodSeconds }}
|
|
||||||
timeoutSeconds: {{ .Values.probes.startup.timeoutSeconds }}
|
|
||||||
failureThreshold: {{ .Values.probes.startup.failureThreshold }}
|
|
||||||
successThreshold: {{ .Values.probes.startup.successThreshold }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.probes.liveness.enabled }}
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: {{ include "checkmk.probePath" . }}
|
|
||||||
port: http
|
|
||||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
|
||||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
|
||||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
|
||||||
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.probes.readiness.enabled }}
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: {{ include "checkmk.probePath" . }}
|
|
||||||
port: http
|
|
||||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
|
||||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
|
||||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
|
||||||
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
|
||||||
{{- end }}
|
|
||||||
env:
|
|
||||||
- name: CMK_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: {{ include "checkmk.secretName" . }}
|
|
||||||
key: {{ .Values.config.adminPassword.passwordKey }}
|
|
||||||
- name: CMK_SITE_ID
|
|
||||||
value: {{ .Values.config.siteId | quote }}
|
|
||||||
- name: TZ
|
|
||||||
value: {{ .Values.config.timezone | quote }}
|
|
||||||
{{- if .Values.config.livestatusTcp }}
|
|
||||||
- name: CMK_LIVESTATUS_TCP
|
|
||||||
value: "on"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.config.mailRelayHost }}
|
|
||||||
- name: MAIL_RELAY_HOST
|
|
||||||
value: {{ .Values.config.mailRelayHost | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.extraEnv }}
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
volumeMounts:
|
|
||||||
- name: sites
|
|
||||||
mountPath: /omd/sites
|
|
||||||
# tmpfs for site temp dir — improves performance by using host RAM
|
|
||||||
# equivalent to Docker's --tmpfs /opt/omd/sites/<siteId>/tmp:uid=1000,gid=1000
|
|
||||||
- name: tmp
|
|
||||||
mountPath: {{ include "checkmk.tmpPath" . }}
|
|
||||||
{{- with .Values.extraVolumeMounts }}
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
resources:
|
|
||||||
{{- toYaml .Values.resources | nindent 12 }}
|
|
||||||
volumes:
|
|
||||||
{{- if .Values.persistence.enabled }}
|
|
||||||
- name: sites
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "checkmk.fullname" . }}-sites{{ end }}
|
|
||||||
{{- else }}
|
|
||||||
- name: sites
|
|
||||||
emptyDir: {}
|
|
||||||
{{- end }}
|
|
||||||
- name: tmp
|
|
||||||
emptyDir:
|
|
||||||
medium: Memory
|
|
||||||
{{- with .Values.extraVolumes }}
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.nodeSelector }}
|
|
||||||
nodeSelector:
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.affinity }}
|
|
||||||
affinity:
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.tolerations }}
|
|
||||||
tolerations:
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,21 +0,0 @@
|
|||||||
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: {{ include "checkmk.fullname" . }}-sites
|
|
||||||
labels:
|
|
||||||
{{- include "checkmk.labels" . | nindent 4 }}
|
|
||||||
{{- with .Values.persistence.annotations }}
|
|
||||||
annotations:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- {{ .Values.persistence.accessMode | quote }}
|
|
||||||
{{- if .Values.persistence.storageClass }}
|
|
||||||
storageClassName: {{ .Values.persistence.storageClass | quote }}
|
|
||||||
{{- end }}
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: {{ .Values.persistence.size | quote }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,11 +0,0 @@
|
|||||||
{{- if not .Values.config.adminPassword.existingSecret }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: {{ include "checkmk.fullname" . }}-secrets
|
|
||||||
labels:
|
|
||||||
{{- include "checkmk.labels" . | nindent 4 }}
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
{{ .Values.config.adminPassword.passwordKey }}: {{ .Values.config.adminPassword.value | default "changeme" | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,25 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: {{ include "checkmk.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{- include "checkmk.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
type: {{ .Values.service.type }}
|
|
||||||
ports:
|
|
||||||
- port: {{ .Values.service.port }}
|
|
||||||
targetPort: http
|
|
||||||
protocol: TCP
|
|
||||||
name: http
|
|
||||||
- port: {{ .Values.service.agentReceiverPort }}
|
|
||||||
targetPort: agent-receiver
|
|
||||||
protocol: TCP
|
|
||||||
name: agent-receiver
|
|
||||||
{{- if .Values.config.livestatusTcp }}
|
|
||||||
- port: 6557
|
|
||||||
targetPort: 6557
|
|
||||||
protocol: TCP
|
|
||||||
name: livestatus
|
|
||||||
{{- end }}
|
|
||||||
selector:
|
|
||||||
{{- include "checkmk.selectorLabels" . | nindent 4 }}
|
|
||||||
@ -1,131 +0,0 @@
|
|||||||
## Global settings
|
|
||||||
nameOverride: ""
|
|
||||||
fullnameOverride: ""
|
|
||||||
|
|
||||||
## Image settings
|
|
||||||
image:
|
|
||||||
repository: checkmk/check-mk-community
|
|
||||||
tag: "2.5.0p6"
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
|
|
||||||
## Deployment settings
|
|
||||||
replicaCount: 1
|
|
||||||
revisionHistoryLimit: 3
|
|
||||||
|
|
||||||
# Pod security settings
|
|
||||||
# Checkmk (OMD) requires root to manage monitoring sites and switch to site users.
|
|
||||||
# fsGroup: 1000 matches Docker's --tmpfs uid=1000,gid=1000 so the site user can write to tmp.
|
|
||||||
podSecurityContext:
|
|
||||||
runAsNonRoot: false
|
|
||||||
runAsUser: 0
|
|
||||||
fsGroup: 1000
|
|
||||||
|
|
||||||
containerSecurityContext:
|
|
||||||
allowPrivilegeEscalation: true
|
|
||||||
readOnlyRootFilesystem: false
|
|
||||||
|
|
||||||
## Pod scheduling
|
|
||||||
nodeSelector: {}
|
|
||||||
tolerations: []
|
|
||||||
affinity: {}
|
|
||||||
|
|
||||||
## Pod annotations
|
|
||||||
podAnnotations: {}
|
|
||||||
|
|
||||||
## Service settings
|
|
||||||
service:
|
|
||||||
type: ClusterIP
|
|
||||||
port: 5000
|
|
||||||
agentReceiverPort: 8000
|
|
||||||
|
|
||||||
## Ingress settings
|
|
||||||
ingress:
|
|
||||||
enabled: false
|
|
||||||
className: ""
|
|
||||||
annotations:
|
|
||||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
||||||
hosts:
|
|
||||||
- host: checkmk.domain.com
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- checkmk.domain.com
|
|
||||||
# secretName: "existing-tls-secret"
|
|
||||||
|
|
||||||
## Persistence settings for /omd/sites (all site data, configs, and RRDs)
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: ""
|
|
||||||
storageClass: ""
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: 5Gi
|
|
||||||
annotations: {}
|
|
||||||
|
|
||||||
## Resource limits and requests
|
|
||||||
# resources:
|
|
||||||
# limits:
|
|
||||||
# cpu: 2000m
|
|
||||||
# memory: 2Gi
|
|
||||||
# requests:
|
|
||||||
# cpu: 500m
|
|
||||||
# memory: 512Mi
|
|
||||||
|
|
||||||
## Application health checks
|
|
||||||
# startupProbe absorbs slow first-boot (site init + DB creation) so liveness/readiness
|
|
||||||
# don't fire until the site is actually up. Budget: 120 * 10s = 20 minutes max.
|
|
||||||
probes:
|
|
||||||
startup:
|
|
||||||
enabled: true
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 10
|
|
||||||
failureThreshold: 120
|
|
||||||
successThreshold: 1
|
|
||||||
liveness:
|
|
||||||
enabled: true
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 10
|
|
||||||
failureThreshold: 6
|
|
||||||
successThreshold: 1
|
|
||||||
readiness:
|
|
||||||
enabled: true
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 5
|
|
||||||
failureThreshold: 3
|
|
||||||
successThreshold: 1
|
|
||||||
|
|
||||||
## Checkmk configuration
|
|
||||||
config:
|
|
||||||
# Site name — also determines the URL path: /<siteId>/check_mk/
|
|
||||||
siteId: "cmk"
|
|
||||||
|
|
||||||
# Timezone (e.g. Europe/Berlin)
|
|
||||||
timezone: "UTC"
|
|
||||||
|
|
||||||
# Enable Livestatus TCP access (for distributed monitoring or external tools).
|
|
||||||
# When enabled, port 6557 is added to the Service.
|
|
||||||
livestatusTcp: false
|
|
||||||
|
|
||||||
# SMTP relay host for notifications (leave empty to disable)
|
|
||||||
mailRelayHost: ""
|
|
||||||
|
|
||||||
## Admin (cmkadmin) password
|
|
||||||
adminPassword:
|
|
||||||
# Use an existing Kubernetes secret
|
|
||||||
existingSecret: ""
|
|
||||||
passwordKey: "cmk-password"
|
|
||||||
# Or set directly (not recommended for production)
|
|
||||||
value: "changeme"
|
|
||||||
|
|
||||||
# Extra environment variables
|
|
||||||
extraEnv: []
|
|
||||||
# - name: CMK_LIVESTATUS_TCP
|
|
||||||
# value: "on"
|
|
||||||
|
|
||||||
# Extra volume mounts
|
|
||||||
extraVolumeMounts: []
|
|
||||||
|
|
||||||
# Extra volumes
|
|
||||||
extraVolumes: []
|
|
||||||
Reference in New Issue
Block a user