Pascal SthamerShuffle Helm chart
Chart Template
The Bitnami Chart Template was used for creating this chart:
https://github.com/bitnami/charts/tree/7e44e64626f5b1fc6d56889cdfdeadc1f62c7cf1/template/CHART_NAME
Original license text:
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
Usage
# Install shuffle via helm (the shuffle namespace is hardcoded into the shuffle source code)
helm install shuffle oci://ghcr.io/shuffle/charts/shuffle --namespace shuffle --create-namespace
Make sure that no other application is deployed to the shuffle namespace, as shuffle deletes kubernetes resources in this namespace.
Only a single deployment of shuffle is supported per namespace.
Uninstallation
# Uninstall shuffle via helm
helm uninstall shuffle --namespace shuffle
# Remove additional resources created by shuffle (such as workers and apps)
kubectl delete svc --namespace shuffle -l "app.kubernetes.io/managed-by in (shuffle-orborus,shuffle-worker)"
kubectl delete deploy --namespace shuffle -l "app.kubernetes.io/managed-by in (shuffle-orborus,shuffle-worker)"
Secret Parameters
The helm chart was designed to not contain any secret data and does not allow configuring secret data using helm values.
Instead, secret values must be passed to services using extraEnvVarsSecret or extraEnvVars.
The secrets need to be manually created. It is possible to run this helm chart without specifying any secrets.
You will be prompted to create an admin user when visiting the shuffle dashboard for the first time.
Note that information will not be encrypted without specifying the SHUFFLE_ENCRYPTION_MODIFIER value.
Mounting env variables into a service
After creating secrets which hold sensitive information, you can mount them as environment variables into a
service via the extraEnvVarsSecret or extraEnvVars values.
backend:
# Use a single secret, which holds environment variables.
# Remember that the secret keys must exactly match the environment variable names.
extraEnvVarsSecret: shuffle-backend-env
# Or mount each value explicitly
extraEnvVars:
- name: SHUFFLE_DEFAULT_USERNAME
valueFrom:
secretKeyRef:
name: "shuffle-initial-user"
key: username
- name: SHUFFLE_DEFAULT_PASSWORD
valueFrom:
secretKeyRef:
name: "shuffle-initial-user"
key: password
- name: SHUFFLE_DEFAULT_APIKEY
valueFrom:
secretKeyRef:
name: "shuffle-initial-user"
key: apikey
- name: SHUFFLE_ENCRYPTION_MODIFIER
valueFrom:
secretKeyRef:
name: "shuffle-encryption"
key: modifier
Backend
A list of environment variables containing secret values for the backend.
# OpenSearch password
SHUFFLE_OPENSEARCH_PASSWORD: ""
# Basic auth credentials for downloading apps from git
SHUFFLE_DOWNLOAD_AUTH_USERNAME: ""
SHUFFLE_DOWNLOAD_AUTH_PASSWORD: ""
# Automatically create the initial admin user. Username and password have a min length of 3.
# If not set, you are prompted with an admin user creation dialog when visiting the shuffle frontend for the first time.
SHUFFLE_DEFAULT_USERNAME: admin
SHUFFLE_DEFAULT_PASSWORD: MySecretAdminPassword1234!
SHUFFLE_DEFAULT_APIKEY: "72E41083-A6F6-4A1B-8538-B06B577F47F0" # Shuffle uses uuid v4
# Encryption modifier. This HAS to be set to encrypt any authentication being used in Shuffle.
# This is put together with other relevant values to ensure multiple parts are needed to decrypt.
# If this key is lost or changed, you will have to reauthenticate all apps.
# The encryption modifier is added to encrypted values to prevent rainbow table attacks. It can be any random string.
SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
OpenSearch
Shuffle uses OpenSearch as its database. This helm chart installs a single-node OpenSearch cluster using the Bitnami Helm Chart.
You can customize the helm chart using the values of the Bitnami helm chart under the opensearch prefix (e.g. opensearch.master.replicaCOunt).
Alternatively, you can disable the built-in OpenSearch installation using opensearch.enabled=false.
Provide your own OpenSearch url and username with backend.openSearch.url and backend.openSearch.username.
The password should be provided with the SHUFFLE_OPENSEARCH_PASSWORD env variable to the backend.
Parameters
Global parameters
| Name | Description | Value |
|---|---|---|
global.imageRegistry |
Global Docker image registry | "" |
global.imagePullSecrets |
Global Docker registry secret names as an array | [] |
global.defaultStorageClass |
Global default StorageClass for Persistent Volume(s) | "" |
global.compatibility.openshift.adaptSecurityContext |
Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | auto |
global.compatibility.omitEmptySeLinuxOptions |
If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object | false |
Common parameters
| Name | Description | Value |
|---|---|---|
kubeVersion |
Override Kubernetes version | "" |
nameOverride |
String to partially override common.names.name | "" |
fullnameOverride |
String to fully override common.names.fullname | "" |
namespaceOverride |
String to fully override common.names.namespace | "" |
commonLabels |
Labels to add to all deployed objects | {} |
commonAnnotations |
Annotations to add to all deployed objects | {} |
clusterDomain |
Kubernetes cluster domain name | cluster.local |
extraDeploy |
Array of extra objects to deploy with the release | [] |
diagnosticMode.enabled |
Enable diagnostic mode (all probes will be disabled and the command will be overridden) | false |
diagnosticMode.command |
Command to override all containers in the chart release | ["sleep"] |
diagnosticMode.args |
Args to override all containers in the chart release | ["infinity"] |
Shared Shuffle Parameters
| Name | Description | Value |
|---|---|---|
shuffle.baseUrl |
The external base URL under which Shuffle is reachable. | "" |
shuffle.org |
Default shuffle organization | Shuffle |
shuffle.appRegistry |
The registry from / to which shuffle apps are pulled / pushed | "" |
shuffle.timezone |
The timezone used by Shuffle | Europe/Berlin |
backend Parameters
| Name | Description | Value |
|---|---|---|
backend.image.registry |
backend image registry | ghcr.io |
backend.image.repository |
backend image repository | shuffle/shuffle-backend |
backend.image.tag |
backend image tag (immutable tags are recommended, defaults to appVersion) | "" |
backend.image.digest |
backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | "" |
backend.image.pullPolicy |
backend image pull policy | IfNotPresent |
backend.image.pullSecrets |
backend image pull secrets | [] |
backend.replicaCount |
Number of backend replicas to deploy | 1 |
backend.containerPorts.http |
backend HTTP container port | 5001 |
backend.extraContainerPorts |
Optionally specify extra list of additional ports for backend containers | [] |
backend.livenessProbe.enabled |
Enable livenessProbe on backend containers | false |
backend.livenessProbe.initialDelaySeconds |
Initial delay seconds for livenessProbe | 0 |
backend.livenessProbe.periodSeconds |
Period seconds for livenessProbe | 15 |
backend.livenessProbe.timeoutSeconds |
Timeout seconds for livenessProbe | 1 |
backend.livenessProbe.failureThreshold |
Failure threshold for livenessProbe | 4 |
backend.livenessProbe.successThreshold |
Success threshold for livenessProbe | 1 |
backend.readinessProbe.enabled |
Enable readinessProbe on backend containers | false |
backend.readinessProbe.initialDelaySeconds |
Initial delay seconds for readinessProbe | 0 |
backend.readinessProbe.periodSeconds |
Period seconds for readinessProbe | 5 |
backend.readinessProbe.timeoutSeconds |
Timeout seconds for readinessProbe | 1 |
backend.readinessProbe.failureThreshold |
Failure threshold for readinessProbe | 3 |
backend.readinessProbe.successThreshold |
Success threshold for readinessProbe | 1 |
backend.startupProbe.enabled |
Enable startupProbe on backend containers | false |
backend.startupProbe.initialDelaySeconds |
Initial delay seconds for startupProbe | 0 |
backend.startupProbe.periodSeconds |
Period seconds for startupProbe | 1 |
backend.startupProbe.timeoutSeconds |
Timeout seconds for startupProbe | 1 |
backend.startupProbe.failureThreshold |
Failure threshold for startupProbe | 60 |
backend.startupProbe.successThreshold |
Success threshold for startupProbe | 1 |
backend.customLivenessProbe |
Custom livenessProbe that overrides the default one | {} |
backend.customReadinessProbe |
Custom readinessProbe that overrides the default one | {} |
backend.customStartupProbe |
Custom startupProbe that overrides the default one | {} |
backend.resourcesPreset |
Set backend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if backend.resources is set (backend.resources is recommended for production). | small |
backend.resources |
Set backend container requests and limits for different resources like CPU or memory (essential for production workloads) | {} |
backend.podSecurityContext.enabled |
Enable backend pods' Security Context | true |
backend.podSecurityContext.fsGroupChangePolicy |
Set filesystem group change policy for backend pods | Always |
backend.podSecurityContext.sysctls |
Set kernel settings using the sysctl interface for backend pods | [] |
backend.podSecurityContext.supplementalGroups |
Set filesystem extra groups for backend pods | [] |
backend.podSecurityContext.fsGroup |
Set fsGroup in backend pods' Security Context | 1001 |
backend.containerSecurityContext.enabled |
Enabled backend container' Security Context | true |
backend.containerSecurityContext.seLinuxOptions |
Set SELinux options in backend container | {} |
backend.containerSecurityContext.runAsUser |
Set runAsUser in backend container' Security Context | 1001 |
backend.containerSecurityContext.runAsGroup |
Set runAsGroup in backend container' Security Context | 1001 |
backend.containerSecurityContext.runAsNonRoot |
Set runAsNonRoot in backend container' Security Context | true |
backend.containerSecurityContext.readOnlyRootFilesystem |
Set readOnlyRootFilesystem in backend container' Security Context | true |
backend.containerSecurityContext.privileged |
Set privileged in backend container' Security Context | false |
backend.containerSecurityContext.allowPrivilegeEscalation |
Set allowPrivilegeEscalation in backend container' Security Context | false |
backend.containerSecurityContext.capabilities.drop |
List of capabilities to be dropped in backend container | ["ALL"] |
backend.containerSecurityContext.seccompProfile.type |
Set seccomp profile in backend container | RuntimeDefault |
backend.command |
Override default backend container command (useful when using custom images) | [] |
backend.args |
Override default backend container args (useful when using custom images) | [] |
backend.automountServiceAccountToken |
Mount Service Account token in backend pods | true |
backend.hostAliases |
backend pods host aliases | [] |
backend.deploymentAnnotations |
Annotations for backend deployment | {} |
backend.podLabels |
Extra labels for backend pods | {} |
backend.podAnnotations |
Annotations for backend pods | {} |
backend.podAffinityPreset |
Pod affinity preset. Ignored if backend.affinity is set. Allowed values: soft or hard |
"" |
backend.podAntiAffinityPreset |
Pod anti-affinity preset. Ignored if backend.affinity is set. Allowed values: soft or hard |
soft |
backend.nodeAffinityPreset.type |
Node affinity preset type. Ignored if backend.affinity is set. Allowed values: soft or hard |
"" |
backend.nodeAffinityPreset.key |
Node label key to match. Ignored if backend.affinity is set |
"" |
backend.nodeAffinityPreset.values |
Node label values to match. Ignored if backend.affinity is set |
[] |
backend.affinity |
Affinity for backend pods assignment | {} |
backend.nodeSelector |
Node labels for backend pods assignment | {} |
backend.tolerations |
Tolerations for backend pods assignment | [] |
backend.updateStrategy.type |
backend deployment strategy type | RollingUpdate |
backend.priorityClassName |
backend pods' priorityClassName | "" |
backend.topologySpreadConstraints |
Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains | [] |
backend.schedulerName |
Name of the k8s scheduler (other than default) for backend pods | "" |
backend.terminationGracePeriodSeconds |
Seconds backend pods need to terminate gracefully | "" |
backend.lifecycleHooks |
for backend containers to automate configuration before or after startup | {} |
backend.extraEnvVars |
Array with extra environment variables to add to backend containers | [] |
backend.extraEnvVarsCM |
Name of existing ConfigMap containing extra env vars for backend containers | "" |
backend.extraEnvVarsSecret |
Name of existing Secret containing extra env vars for backend containers | "" |
backend.extraVolumes |
Optionally specify extra list of additional volumes for the backend pods | [] |
backend.extraVolumeMounts |
Optionally specify extra list of additional volumeMounts for the backend containers | [] |
backend.sidecars |
Add additional sidecar containers to the backend pods | [] |
backend.initContainers |
Add additional init containers to the backend pods | [] |
backend.pdb.create |
Enable/disable a Pod Disruption Budget creation | true |
backend.pdb.minAvailable |
Minimum number/percentage of pods that should remain scheduled | "" |
backend.pdb.maxUnavailable |
Maximum number/percentage of pods that may be made unavailable. Defaults to 1 if both backend.pdb.minAvailable and backend.pdb.maxUnavailable are empty. |
"" |
backend.autoscaling.vpa.enabled |
Enable VPA for backend pods | false |
backend.autoscaling.vpa.annotations |
Annotations for VPA resource | {} |
backend.autoscaling.vpa.controlledResources |
VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | [] |
backend.autoscaling.vpa.maxAllowed |
VPA Max allowed resources for the pod | {} |
backend.autoscaling.vpa.minAllowed |
VPA Min allowed resources for the pod | {} |
backend.autoscaling.vpa.updatePolicy.updateMode |
Autoscaling update policy | Auto |
backend.autoscaling.hpa.enabled |
Enable HPA for backend pods | false |
backend.autoscaling.hpa.minReplicas |
Minimum number of replicas | "" |
backend.autoscaling.hpa.maxReplicas |
Maximum number of replicas | "" |
backend.autoscaling.hpa.targetCPU |
Target CPU utilization percentage | "" |
backend.autoscaling.hpa.targetMemory |
Target Memory utilization percentage | "" |
backend.serviceAccount.create |
Specifies whether a ServiceAccount should be created | true |
backend.serviceAccount.name |
The name of the ServiceAccount to use. | "" |
backend.serviceAccount.annotations |
Additional Service Account annotations (evaluated as a template) | {} |
backend.serviceAccount.automountServiceAccountToken |
Automount service account token for the backend service account | true |
backend.serviceAccount.imagePullSecrets |
Add image pull secrets to the backend service account | [] |
backend.rbac.create |
Specifies whether RBAC resources should be created | true |
backend.networkPolicy.enabled |
Specifies whether a NetworkPolicy should be created | true |
backend.networkPolicy.allowExternal |
Don't require server label for connections | true |
backend.networkPolicy.allowExternalEgress |
Allow the pod to access any range of port and all destinations. | true |
backend.networkPolicy.extraIngress |
Add extra ingress rules to the NetworkPolicy | [] |
backend.networkPolicy.extraEgress |
Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | [] |
backend.cleanupSchedule |
The interval in seconds at which the cleanup job runs | 300 |
backend.openSearch.url |
The URL at which OpenSearch is available | http://{{ .Release.Name }}-opensearch:9200 |
backend.openSearch.username |
The username that is used for authenticating with OpenSearch | admin |
backend.openSearch.certificateFile |
The path to a custom OpenSearch certificate file | "" |
backend.openSearch.skipSSLVerify |
Skip SSL verification | false |
backend.openSearch.indexPrefix |
A prefix for OpenSearch indices | "" |
backend.apps.downloadLocation |
The location to a git repository from which default appps are downloaded on startup. | https://github.com/shuffle/python-apps |
backend.apps.downloadBranch |
The branch from which apps should be downloaded on startup. | master |
backend.apps.forceUpdate |
Force an update of apps on startup. | false |
frontend Parameters
| Name | Description | Value |
|---|---|---|
frontend.image.registry |
frontend image registry | ghcr.io |
frontend.image.repository |
frontend image repository | shuffle/shuffle-frontend |
frontend.image.tag |
frontend image tag (immutable tags are recommended, defaults to appVersion) | "" |
frontend.image.digest |
frontend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | "" |
frontend.image.pullPolicy |
frontend image pull policy | IfNotPresent |
frontend.image.pullSecrets |
frontend image pull secrets | [] |
frontend.replicaCount |
Number of frontend replicas to deploy | 1 |
frontend.containerPorts.http |
frontend HTTP container port | 80 |
frontend.containerPorts.https |
frontend HTTPS container port | 443 |
frontend.extraContainerPorts |
Optionally specify extra list of additional ports for frontend containers | [] |
frontend.livenessProbe.enabled |
Enable livenessProbe on frontend containers | false |
frontend.livenessProbe.initialDelaySeconds |
Initial delay seconds for livenessProbe | 0 |
frontend.livenessProbe.periodSeconds |
Period seconds for livenessProbe | 15 |
frontend.livenessProbe.timeoutSeconds |
Timeout seconds for livenessProbe | 1 |
frontend.livenessProbe.failureThreshold |
Failure threshold for livenessProbe | 4 |
frontend.livenessProbe.successThreshold |
Success threshold for livenessProbe | 1 |
frontend.readinessProbe.enabled |
Enable readinessProbe on frontend containers | false |
frontend.readinessProbe.initialDelaySeconds |
Initial delay seconds for readinessProbe | 0 |
frontend.readinessProbe.periodSeconds |
Period seconds for readinessProbe | 5 |
frontend.readinessProbe.timeoutSeconds |
Timeout seconds for readinessProbe | 1 |
frontend.readinessProbe.failureThreshold |
Failure threshold for readinessProbe | 3 |
frontend.readinessProbe.successThreshold |
Success threshold for readinessProbe | 1 |
frontend.startupProbe.enabled |
Enable startupProbe on frontend containers | false |
frontend.startupProbe.initialDelaySeconds |
Initial delay seconds for startupProbe | 0 |
frontend.startupProbe.periodSeconds |
Period seconds for startupProbe | 1 |
frontend.startupProbe.timeoutSeconds |
Timeout seconds for startupProbe | 1 |
frontend.startupProbe.failureThreshold |
Failure threshold for startupProbe | 60 |
frontend.startupProbe.successThreshold |
Success threshold for startupProbe | 1 |
frontend.customLivenessProbe |
Custom livenessProbe that overrides the default one | {} |
frontend.customReadinessProbe |
Custom readinessProbe that overrides the default one | {} |
frontend.customStartupProbe |
Custom startupProbe that overrides the default one | {} |
frontend.resourcesPreset |
Set frontend container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production). | nano |
frontend.resources |
Set frontend container requests and limits for different resources like CPU or memory (essential for production workloads) | {} |
frontend.podSecurityContext.enabled |
Enable frontend pods' Security Context | false |
frontend.podSecurityContext.fsGroupChangePolicy |
Set filesystem group change policy for frontend pods | Always |
frontend.podSecurityContext.sysctls |
Set kernel settings using the sysctl interface for frontend pods | [] |
frontend.podSecurityContext.supplementalGroups |
Set filesystem extra groups for frontend pods | [] |
frontend.podSecurityContext.fsGroup |
Set fsGroup in frontend pods' Security Context | 1001 |
frontend.containerSecurityContext.enabled |
Enabled frontend container' Security Context | false |
frontend.containerSecurityContext.seLinuxOptions |
Set SELinux options in frontend container | {} |
frontend.containerSecurityContext.runAsUser |
Set runAsUser in frontend container' Security Context | 1001 |
frontend.containerSecurityContext.runAsGroup |
Set runAsGroup in frontend container' Security Context | 1001 |
frontend.containerSecurityContext.runAsNonRoot |
Set runAsNonRoot in frontend container' Security Context | true |
frontend.containerSecurityContext.readOnlyRootFilesystem |
Set readOnlyRootFilesystem in frontend container' Security Context | true |
frontend.containerSecurityContext.privileged |
Set privileged in frontend container' Security Context | false |
frontend.containerSecurityContext.allowPrivilegeEscalation |
Set allowPrivilegeEscalation in frontend container' Security Context | false |
frontend.containerSecurityContext.capabilities.drop |
List of capabilities to be dropped in frontend container | ["ALL"] |
frontend.containerSecurityContext.seccompProfile.type |
Set seccomp profile in frontend container | RuntimeDefault |
frontend.command |
Override default frontend container command (useful when using custom images) | [] |
frontend.args |
Override default frontend container args (useful when using custom images) | [] |
frontend.automountServiceAccountToken |
Mount Service Account token in frontend pods | false |
frontend.hostAliases |
frontend pods host aliases | [] |
frontend.deploymentAnnotations |
Annotations for frontend deployment | {} |
frontend.podLabels |
Extra labels for frontend pods | {} |
frontend.podAnnotations |
Annotations for frontend pods | {} |
frontend.podAffinityPreset |
Pod affinity preset. Ignored if frontend.affinity is set. Allowed values: soft or hard |
"" |
frontend.podAntiAffinityPreset |
Pod anti-affinity preset. Ignored if frontend.affinity is set. Allowed values: soft or hard |
soft |
frontend.nodeAffinityPreset.type |
Node affinity preset type. Ignored if frontend.affinity is set. Allowed values: soft or hard |
"" |
frontend.nodeAffinityPreset.key |
Node label key to match. Ignored if frontend.affinity is set |
"" |
frontend.nodeAffinityPreset.values |
Node label values to match. Ignored if frontend.affinity is set |
[] |
frontend.affinity |
Affinity for frontend pods assignment | {} |
frontend.nodeSelector |
Node labels for frontend pods assignment | {} |
frontend.tolerations |
Tolerations for frontend pods assignment | [] |
frontend.updateStrategy.type |
frontend deployment strategy type | RollingUpdate |
frontend.priorityClassName |
frontend pods' priorityClassName | "" |
frontend.topologySpreadConstraints |
Topology Spread Constraints for frontend pod assignment spread across your cluster among failure-domains | [] |
frontend.schedulerName |
Name of the k8s scheduler (other than default) for frontend pods | "" |
frontend.terminationGracePeriodSeconds |
Seconds frontend pods need to terminate gracefully | "" |
frontend.lifecycleHooks |
for frontend containers to automate configuration before or after startup | {} |
frontend.extraEnvVars |
Array with extra environment variables to add to frontend containers | [] |
frontend.extraEnvVarsCM |
Name of existing ConfigMap containing extra env vars for frontend containers | "" |
frontend.extraEnvVarsSecret |
Name of existing Secret containing extra env vars for frontend containers | "" |
frontend.extraVolumes |
Optionally specify extra list of additional volumes for the frontend pods | [] |
frontend.extraVolumeMounts |
Optionally specify extra list of additional volumeMounts for the frontend containers | [] |
frontend.sidecars |
Add additional sidecar containers to the frontend pods | [] |
frontend.initContainers |
Add additional init containers to the frontend pods | [] |
frontend.pdb.create |
Enable/disable a Pod Disruption Budget creation | true |
frontend.pdb.minAvailable |
Minimum number/percentage of pods that should remain scheduled | "" |
frontend.pdb.maxUnavailable |
Maximum number/percentage of pods that may be made unavailable. Defaults to 1 if both frontend.pdb.minAvailable and frontend.pdb.maxUnavailable are empty. |
"" |
frontend.autoscaling.vpa.enabled |
Enable VPA for frontend pods | false |
frontend.autoscaling.vpa.annotations |
Annotations for VPA resource | {} |
frontend.autoscaling.vpa.controlledResources |
VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | [] |
frontend.autoscaling.vpa.maxAllowed |
VPA Max allowed resources for the pod | {} |
frontend.autoscaling.vpa.minAllowed |
VPA Min allowed resources for the pod | {} |
frontend.autoscaling.vpa.updatePolicy.updateMode |
Autoscaling update policy | Auto |
frontend.autoscaling.hpa.enabled |
Enable HPA for frontend pods | false |
frontend.autoscaling.hpa.minReplicas |
Minimum number of replicas | "" |
frontend.autoscaling.hpa.maxReplicas |
Maximum number of replicas | "" |
frontend.autoscaling.hpa.targetCPU |
Target CPU utilization percentage | "" |
frontend.autoscaling.hpa.targetMemory |
Target Memory utilization percentage | "" |
frontend.serviceAccount.create |
Specifies whether a ServiceAccount should be created | true |
frontend.serviceAccount.name |
The name of the ServiceAccount to use. | "" |
frontend.serviceAccount.annotations |
Additional Service Account annotations (evaluated as a template) | {} |
frontend.serviceAccount.automountServiceAccountToken |
Automount service account token for the frontend service account | true |
frontend.serviceAccount.imagePullSecrets |
Add image pull secrets to the frontend service account | [] |
frontend.networkPolicy.enabled |
Specifies whether a NetworkPolicy should be created | true |
frontend.networkPolicy.allowExternal |
Don't require server label for connections | true |
frontend.networkPolicy.allowExternalEgress |
Allow the pod to access any range of port and all destinations. | true |
frontend.networkPolicy.extraIngress |
Add extra ingress rules to the NetworkPolicy | [] |
frontend.networkPolicy.extraEgress |
Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | [] |
orborus Parameters
| Name | Description | Value |
|---|---|---|
orborus.image.registry |
orborus image registry | ghcr.io |
orborus.image.repository |
orborus image repository | shuffle/shuffle-orborus |
orborus.image.tag |
orborus image tag (immutable tags are recommended, defaults to appVersion) | "" |
orborus.image.digest |
orborus image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | "" |
orborus.image.pullPolicy |
orborus image pull policy | IfNotPresent |
orborus.image.pullSecrets |
orborus image pull secrets | [] |
orborus.replicaCount |
Number of orborus replicas to deploy | 1 |
orborus.containerPorts.http |
orborus HTTP container port | 8080 |
orborus.extraContainerPorts |
Optionally specify extra list of additional ports for orborus containers | [] |
orborus.livenessProbe.enabled |
Enable livenessProbe on orborus containers | false |
orborus.livenessProbe.initialDelaySeconds |
Initial delay seconds for livenessProbe | 0 |
orborus.livenessProbe.periodSeconds |
Period seconds for livenessProbe | 15 |
orborus.livenessProbe.timeoutSeconds |
Timeout seconds for livenessProbe | 1 |
orborus.livenessProbe.failureThreshold |
Failure threshold for livenessProbe | 4 |
orborus.livenessProbe.successThreshold |
Success threshold for livenessProbe | 1 |
orborus.readinessProbe.enabled |
Enable readinessProbe on orborus containers | false |
orborus.readinessProbe.initialDelaySeconds |
Initial delay seconds for readinessProbe | 0 |
orborus.readinessProbe.periodSeconds |
Period seconds for readinessProbe | 5 |
orborus.readinessProbe.timeoutSeconds |
Timeout seconds for readinessProbe | 1 |
orborus.readinessProbe.failureThreshold |
Failure threshold for readinessProbe | 3 |
orborus.readinessProbe.successThreshold |
Success threshold for readinessProbe | 1 |
orborus.startupProbe.enabled |
Enable startupProbe on orborus containers | false |
orborus.startupProbe.initialDelaySeconds |
Initial delay seconds for startupProbe | 0 |
orborus.startupProbe.periodSeconds |
Period seconds for startupProbe | 1 |
orborus.startupProbe.timeoutSeconds |
Timeout seconds for startupProbe | 1 |
orborus.startupProbe.failureThreshold |
Failure threshold for startupProbe | 60 |
orborus.startupProbe.successThreshold |
Success threshold for startupProbe | 1 |
orborus.customLivenessProbe |
Custom livenessProbe that overrides the default one | {} |
orborus.customReadinessProbe |
Custom readinessProbe that overrides the default one | {} |
orborus.customStartupProbe |
Custom startupProbe that overrides the default one | {} |
orborus.resourcesPreset |
Set orborus container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if orborus.resources is set (orborus.resources is recommended for production). | nano |
orborus.resources |
Set orborus container requests and limits for different resources like CPU or memory (essential for production workloads) | {} |
orborus.podSecurityContext.enabled |
Enable orborus pods' Security Context | true |
orborus.podSecurityContext.fsGroupChangePolicy |
Set filesystem group change policy for orborus pods | Always |
orborus.podSecurityContext.sysctls |
Set kernel settings using the sysctl interface for orborus pods | [] |
orborus.podSecurityContext.supplementalGroups |
Set filesystem extra groups for orborus pods | [] |
orborus.podSecurityContext.fsGroup |
Set fsGroup in orborus pods' Security Context | 1001 |
orborus.containerSecurityContext.enabled |
Enabled orborus container' Security Context | true |
orborus.containerSecurityContext.seLinuxOptions |
Set SELinux options in orborus container | {} |
orborus.containerSecurityContext.runAsUser |
Set runAsUser in orborus container' Security Context | 1001 |
orborus.containerSecurityContext.runAsGroup |
Set runAsGroup in orborus container' Security Context | 1001 |
orborus.containerSecurityContext.runAsNonRoot |
Set runAsNonRoot in orborus container' Security Context | true |
orborus.containerSecurityContext.readOnlyRootFilesystem |
Set readOnlyRootFilesystem in orborus container' Security Context | true |
orborus.containerSecurityContext.privileged |
Set privileged in orborus container' Security Context | false |
orborus.containerSecurityContext.allowPrivilegeEscalation |
Set allowPrivilegeEscalation in orborus container' Security Context | false |
orborus.containerSecurityContext.capabilities.drop |
List of capabilities to be dropped in orborus container | ["ALL"] |
orborus.containerSecurityContext.seccompProfile.type |
Set seccomp profile in orborus container | RuntimeDefault |
orborus.command |
Override default orborus container command (useful when using custom images) | [] |
orborus.args |
Override default orborus container args (useful when using custom images) | [] |
orborus.automountServiceAccountToken |
Mount Service Account token in orborus pods | true |
orborus.hostAliases |
orborus pods host aliases | [] |
orborus.deploymentAnnotations |
Annotations for orborus deployment | {} |
orborus.podLabels |
Extra labels for orborus pods | {} |
orborus.podAnnotations |
Annotations for orborus pods | {} |
orborus.podAffinityPreset |
Pod affinity preset. Ignored if orborus.affinity is set. Allowed values: soft or hard |
"" |
orborus.podAntiAffinityPreset |
Pod anti-affinity preset. Ignored if orborus.affinity is set. Allowed values: soft or hard |
soft |
orborus.nodeAffinityPreset.type |
Node affinity preset type. Ignored if orborus.affinity is set. Allowed values: soft or hard |
"" |
orborus.nodeAffinityPreset.key |
Node label key to match. Ignored if orborus.affinity is set |
"" |
orborus.nodeAffinityPreset.values |
Node label values to match. Ignored if orborus.affinity is set |
[] |
orborus.affinity |
Affinity for orborus pods assignment | {} |
orborus.nodeSelector |
Node labels for orborus pods assignment | {} |
orborus.tolerations |
Tolerations for orborus pods assignment | [] |
orborus.updateStrategy.type |
orborus deployment strategy type | RollingUpdate |
orborus.priorityClassName |
orborus pods' priorityClassName | "" |
orborus.topologySpreadConstraints |
Topology Spread Constraints for orborus pod assignment spread across your cluster among failure-domains | [] |
orborus.schedulerName |
Name of the k8s scheduler (other than default) for orborus pods | "" |
orborus.terminationGracePeriodSeconds |
Seconds orborus pods need to terminate gracefully | "" |
orborus.lifecycleHooks |
for orborus containers to automate configuration before or after startup | {} |
orborus.extraEnvVars |
Array with extra environment variables to add to orborus containers | [] |
orborus.extraEnvVarsCM |
Name of existing ConfigMap containing extra env vars for orborus containers | "" |
orborus.extraEnvVarsSecret |
Name of existing Secret containing extra env vars for orborus containers | "" |
orborus.extraVolumes |
Optionally specify extra list of additional volumes for the orborus pods | [] |
orborus.extraVolumeMounts |
Optionally specify extra list of additional volumeMounts for the orborus containers | [] |
orborus.sidecars |
Add additional sidecar containers to the orborus pods | [] |
orborus.initContainers |
Add additional init containers to the orborus pods | [] |
orborus.pdb.create |
Enable/disable a Pod Disruption Budget creation | true |
orborus.pdb.minAvailable |
Minimum number/percentage of pods that should remain scheduled | "" |
orborus.pdb.maxUnavailable |
Maximum number/percentage of pods that may be made unavailable. Defaults to 1 if both orborus.pdb.minAvailable and orborus.pdb.maxUnavailable are empty. |
"" |
orborus.autoscaling.vpa.enabled |
Enable VPA for orborus pods | false |
orborus.autoscaling.vpa.annotations |
Annotations for VPA resource | {} |
orborus.autoscaling.vpa.controlledResources |
VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory | [] |
orborus.autoscaling.vpa.maxAllowed |
VPA Max allowed resources for the pod | {} |
orborus.autoscaling.vpa.minAllowed |
VPA Min allowed resources for the pod | {} |
orborus.autoscaling.vpa.updatePolicy.updateMode |
Autoscaling update policy | Auto |
orborus.autoscaling.hpa.enabled |
Enable HPA for orborus pods | false |
orborus.autoscaling.hpa.minReplicas |
Minimum number of replicas | "" |
orborus.autoscaling.hpa.maxReplicas |
Maximum number of replicas | "" |
orborus.autoscaling.hpa.targetCPU |
Target CPU utilization percentage | "" |
orborus.autoscaling.hpa.targetMemory |
Target Memory utilization percentage | "" |
orborus.serviceAccount.create |
Specifies whether a ServiceAccount should be created | true |
orborus.serviceAccount.name |
The name of the ServiceAccount to use. | "" |
orborus.serviceAccount.annotations |
Additional Service Account annotations (evaluated as a template) | {} |
orborus.serviceAccount.automountServiceAccountToken |
Automount service account token for the orborus service account | true |
orborus.serviceAccount.imagePullSecrets |
Add image pull secrets to the orborus service account | [] |
orborus.rbac.create |
Specifies whether RBAC resources should be created | true |
orborus.networkPolicy.enabled |
Specifies whether a NetworkPolicy should be created | true |
orborus.networkPolicy.allowExternal |
Don't require server label for connections | true |
orborus.networkPolicy.allowExternalEgress |
Allow the pod to access any range of port and all destinations. | true |
orborus.networkPolicy.extraIngress |
Add extra ingress rules to the NetworkPolicy | [] |
orborus.networkPolicy.extraEgress |
Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | [] |
worker Parameters
| Name | Description | Value |
|---|---|---|
worker.image.registry |
worker image registry | ghcr.io |
worker.image.repository |
worker image repository | shuffle/shuffle-worker |
worker.image.tag |
worker image tag (immutable tags are recommended, defaults to appVersion) | "" |
worker.image.digest |
worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | "" |
worker.podSecurityContext.enabled |
Enable worker pods' Security Context | true |
worker.podSecurityContext.fsGroupChangePolicy |
Set filesystem group change policy for worker pods | Always |
worker.podSecurityContext.sysctls |
Set kernel settings using the sysctl interface for worker pods | [] |
worker.podSecurityContext.supplementalGroups |
Set filesystem extra groups for worker pods | [] |
worker.podSecurityContext.fsGroup |
Set fsGroup in worker pods' Security Context | 1001 |
worker.containerSecurityContext.enabled |
Enabled worker container' Security Context | true |
worker.containerSecurityContext.seLinuxOptions |
Set SELinux options in worker container | {} |
worker.containerSecurityContext.runAsUser |
Set runAsUser in worker container' Security Context | 1001 |
worker.containerSecurityContext.runAsGroup |
Set runAsGroup in worker container' Security Context | 1001 |
worker.containerSecurityContext.runAsNonRoot |
Set runAsNonRoot in worker container' Security Context | true |
worker.containerSecurityContext.readOnlyRootFilesystem |
Set readOnlyRootFilesystem in worker container' Security Context | true |
worker.containerSecurityContext.privileged |
Set privileged in worker container' Security Context | false |
worker.containerSecurityContext.allowPrivilegeEscalation |
Set allowPrivilegeEscalation in worker container' Security Context | false |
worker.containerSecurityContext.capabilities.drop |
List of capabilities to be dropped in worker container | ["ALL"] |
worker.containerSecurityContext.seccompProfile.type |
Set seccomp profile in worker container | RuntimeDefault |
worker.serviceAccount.create |
Specifies whether a ServiceAccount should be created | true |
worker.serviceAccount.name |
The name of the ServiceAccount to use. | "" |
worker.serviceAccount.annotations |
Additional Service Account annotations (evaluated as a template) | {} |
worker.serviceAccount.automountServiceAccountToken |
Automount service account token for the worker service account | true |
worker.serviceAccount.imagePullSecrets |
Add image pull secrets to the worker service account | [] |
worker.rbac.create |
Specifies whether RBAC resources should be created | true |
worker.networkPolicy.enabled |
Specifies whether a NetworkPolicy should be created | true |
worker.networkPolicy.allowExternal |
Don't require server label for connections | true |
worker.networkPolicy.allowExternalEgress |
Allow the pod to access any range of port and all destinations. | true |
worker.networkPolicy.extraIngress |
Add extra ingress rules to the NetworkPolicy | [] |
worker.networkPolicy.extraEgress |
Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | [] |
app Parameters
| Name | Description | Value |
|---|---|---|
app.podSecurityContext.enabled |
Enable app pods' Security Context | true |
app.podSecurityContext.fsGroupChangePolicy |
Set filesystem group change policy for app pods | Always |
app.podSecurityContext.sysctls |
Set kernel settings using the sysctl interface for app pods | [] |
app.podSecurityContext.supplementalGroups |
Set filesystem extra groups for app pods | [] |
app.podSecurityContext.fsGroup |
Set fsGroup in app pods' Security Context | 1001 |
app.containerSecurityContext.enabled |
Enabled app container' Security Context | true |
app.containerSecurityContext.seLinuxOptions |
Set SELinux options in app container | {} |
app.containerSecurityContext.runAsUser |
Set runAsUser in app container' Security Context | 1001 |
app.containerSecurityContext.runAsGroup |
Set runAsGroup in app container' Security Context | 1001 |
app.containerSecurityContext.runAsNonRoot |
Set runAsNonRoot in app container' Security Context | true |
app.containerSecurityContext.readOnlyRootFilesystem |
Set readOnlyRootFilesystem in app container' Security Context | true |
app.containerSecurityContext.privileged |
Set privileged in app container' Security Context | false |
app.containerSecurityContext.allowPrivilegeEscalation |
Set allowPrivilegeEscalation in app container' Security Context | false |
app.containerSecurityContext.capabilities.drop |
List of capabilities to be dropped in app container | ["ALL"] |
app.containerSecurityContext.seccompProfile.type |
Set seccomp profile in app container | RuntimeDefault |
app.serviceAccount.create |
Specifies whether a ServiceAccount should be created | true |
app.serviceAccount.name |
The name of the ServiceAccount to use. | "" |
app.serviceAccount.annotations |
Additional Service Account annotations (evaluated as a template) | {} |
app.serviceAccount.automountServiceAccountToken |
Automount service account token for the app service account | true |
app.serviceAccount.imagePullSecrets |
Add image pull secrets to the app service account | [] |
app.rbac.create |
Specifies whether RBAC resources should be created | true |
app.networkPolicy.enabled |
Specifies whether a NetworkPolicy should be created | true |
app.networkPolicy.allowExternal |
Don't require server label for connections | true |
app.networkPolicy.allowExternalEgress |
Allow the pod to access any range of port and all destinations. | true |
app.networkPolicy.extraIngress |
Add extra ingress rules to the NetworkPolicy | [] |
app.networkPolicy.extraEgress |
Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | [] |
Traffic Exposure Parameters
| Name | Description | Value |
|---|---|---|
ingress.enabled |
Enable ingress record generation for frontend and backend | false |
ingress.pathType |
Ingress path type for the frontend path | Prefix |
ingress.backendPathType |
Ingress path type for the backend path | Prefix |
ingress.apiVersion |
Force Ingress API version (automatically detected if not set) | "" |
ingress.hostname |
Default host for the ingress record | shuffle.local |
ingress.ingressClassName |
IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | nginx |
ingress.path |
Ingress path for Shuffle frontend | "/" |
ingress.backendPath |
Ingress path for Shuffle backend | "/api/" |
ingress.annotations |
Additional annotations for the Ingress resource. | {} |
ingress.tls |
Enable TLS configuration for the host defined at ingress.hostname parameter |
false |
ingress.selfSigned |
Create a TLS secret for this ingress record using self-signed certificates generated by Helm | false |
ingress.extraHosts |
An array with additional hostname(s) to be covered with the ingress record | [] |
ingress.extraPaths |
An array with additional arbitrary paths that may need to be added to the ingress under the main host | [] |
ingress.extraTls |
TLS configuration for additional hostname(s) to be covered with this ingress record | [] |
ingress.secrets |
Custom TLS certificates as secrets | [] |
ingress.extraRules |
Additional rules to be covered with this ingress record | [] |
Istio Parameters
| Name | Description | Value |
|---|---|---|
istio.enabled |
Enable creation of an Istio Gateway and VirtualService for frontend and backend | false |
istio.apiVersion |
The istio apiVersion to use for Gateway and VirtualService resources | networking.istio.io/v1 |
istio.hosts |
One or more hosts exposed by Istio | [] |
istio.gateway.annotations |
Additional annotations for the Gateway resource | {} |
istio.gateway.selector |
The selector matches the ingress gateway pod labels | { istio: ingress } |
istio.gateway.http.enabled |
Enable HTTP server port 80 | true |
istio.gateway.http.httpsRedirect |
If set to true, a 301 redirect is send for all HTTP connections | false |
istio.gateway.https.enabled |
Enable HTTPS server on port 443 | false |
istio.gateway.https.tlsCredentialName |
The name of the secret that holds the TLS certs including the CA certificates. | "" |
istio.gateway.https.tlsCipherSuites |
If specified, only support the specified cipher list. | [] |
istio.gateway.extraServers |
Additional servers for the Gateway resource | [] |
istio.virtualService.annotations |
Additional annotations for the VirtualService resource. | {} |
istio.virtualService.backendHeaders |
Header manipulation rules for backend traffic | {} |
istio.virtualService.frontendHeaders |
Header manipulation rules for frontend traffic | {} |
Persistence Parameters
| Name | Description | Value |
|---|---|---|
persistence.enabled |
Enable persistence using Persistent Volume Claims | true |
persistence.apps.existingClaim |
Name of an existing PVC to use | "" |
persistence.apps.storageClass |
PVC Storage Class for shuffle-apps volume | "" |
persistence.apps.subPath |
The sub path used in the volume | "" |
persistence.apps.accessModes |
The access mode of the volume | ["ReadWriteOnce"] |
persistence.apps.size |
The size of the volume | 5Gi |
persistence.apps.annotations |
Annotations for the PVC | {} |
persistence.apps.selector |
Selector to match an existing Persistent Volume | {} |
persistence.appBuilder.storageClass |
PVC Storage Class for backend-apps-claim volume | "" |
persistence.appBuilder.accessModes |
The access mode of the volume | ["ReadWriteOnce"] |
persistence.appBuilder.size |
The size of the volume | 5Gi |
persistence.appBuilder.annotations |
Annotations for the PVC | {} |
persistence.appBuilder.selector |
Selector to match an existing Persistent Volume | {} |
persistence.files.existingClaim |
Name of an existing PVC to use | "" |
persistence.files.storageClass |
PVC Storage Class for shuffle-files volume | "" |
persistence.files.subPath |
The sub path used in the volume | "" |
persistence.files.accessModes |
The access mode of the volume | ["ReadWriteOnce"] |
persistence.files.size |
The size of the volume | 5Gi |
persistence.files.annotations |
Annotations for the PVC | {} |
persistence.files.selector |
Selector to match an existing Persistent Volume | {} |
Init Container Parameters
| Name | Description | Value |
|---|---|---|
volumePermissions.enabled |
Enable init container that changes the owner/group of the PV mount point to runAsUser:fsGroup |
false |
volumePermissions.image.registry |
OS Shell + Utility image registry | docker.io |
volumePermissions.image.repository |
OS Shell + Utility image repository | bitnami/os-shell |
volumePermissions.image.tag |
OS Shell + Utility image tag (immutable tags are recommended) | 12-debian-12-r30 |
volumePermissions.image.pullPolicy |
OS Shell + Utility image pull policy | IfNotPresent |
volumePermissions.image.pullSecrets |
OS Shell + Utility image pull secrets | [] |
volumePermissions.resourcesPreset |
Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | nano |
volumePermissions.resources |
Set init container requests and limits for different resources like CPU or memory (essential for production workloads) | {} |
volumePermissions.containerSecurityContext.enabled |
Enabled init container' Security Context | true |
volumePermissions.containerSecurityContext.seLinuxOptions |
Set SELinux options in init container | {} |
volumePermissions.containerSecurityContext.runAsUser |
Set init container's Security Context runAsUser | 0 |
OpenSearch Parameters
| Name | Description | Value |
|---|---|---|
opensearch.enabled |
Switch to enable or disable the opensearch helm chart | true |
Vault Parameters
| Name | Description | Value |
|---|---|---|
vault.role |
Specify the Vault role, which should be used to get the secret from Vault. | "" |
vault.secrets |
A list of VaultSecrets to create | [] |