❯ grep -v '^ *#.*$\|^$' values-openvox.yaml
---
global:
  runAsNonRoot: false
  imagePullSecrets:
  curl:
    image: curlimages/curl
    tag: 8.11.1
    imagePullPolicy: IfNotPresent
  r10k:
    image: puppet/r10k
    tag: 3.15.2
    imagePullPolicy: IfNotPresent
  pgchecker:
    image: docker.io/busybox
    tag: 1.37
    imagePullPolicy: IfNotPresent
  puppetdbexporter:
    image: camptocamp/prometheus-puppetdb-exporter
    tag: 1.1.0
    imagePullPolicy: IfNotPresent
  jmxexporter:
    image: bitnami/jmx-exporter
    tag: 0.20.0-debian-12-r13
    imagePullPolicy: IfNotPresent
  postgresql:
    auth:
      username: puppet
      password: "[REDACTED]"
      database: puppet
      existingSecret: ""
      secretKeys:
        usernameKey: username
        userPasswordKey: password
  securityContext:
    runAsUser: 999 # "puppet" UID
    runAsGroup: 999 # "puppet" GID
    fsGroup: 999 # "puppet" GID
  extraEnv: {}
  extraEnvSecret: ""
  extraLabels: {}
puppetserver:
  name: puppetserver
  image: ghcr.io/openvoxproject/openvoxserver
  tag: 8.8.0-main
  pullPolicy: IfNotPresent
  persistence:
    ca:
      existingClaim: ""
      accessModes: []
      storageClass: ""
      annotations: {}
      size: ""
    code:
      existingClaim: ""
      accessModes: []
      storageClass: ""
      annotations: {}
      size: ""
    data:
      enabled: true
      existingClaim: ""
      accessModes: []
      storageClass: ""
      annotations: {}
      size: ""
    confd:
      enabled: true
      existingClaim: ""
      accessModes: []
      storageClass: ""
      annotations: {}
      size: ""
    puppet:
      existingClaim: ""
      accessModes: []
      storageClass: ""
      annotations: {}
      size: ""
    server:
      existingClaim: ""
      accessModes: []
      storageClass: ""
      annotations: {}
      size: ""
  masters:
    resources:
      requests:
        memory: 1024Mi
        cpu: 750m
      limits:
        memory: 2048Mi
        cpu: 1500m
    podAntiAffinity: false
    podDisruptionBudget:
      enabled: false
      minAvailable: 1
    networkPolicy:
      enabled: false
      policyTypes:
        - Egress
        - Ingress
      additionnalIngressRules:
        - from:
            - namespaceSelector: {}
          ports:
            - port: 8140
    extraContainers: []
    extraEnv: {}
    extraEnvSecret: ""
    extraLabels: {}
    annotations: {}
    podAnnotations: {}
    updateStrategy:
      type: RollingUpdate
    readinessProbePeriodSeconds: 60
    readinessProbeTimeout: 20
    readinessProbeFailureThreshold: 3
    readinessProbeSuccessThreshold: 1
    livenessProbePeriodSeconds: 30
    livenessProbeTimeout: 10
    livenessProbeFailureThreshold: 3
    livenessProbeSuccessThreshold: 1
    startupProbePeriodSeconds: 60
    startupProbeFailureThreshold: 30
    readinessProbeScheme: HTTPS
    fqdns:
      serverName: "ppt.dodges.it"
      alternateServerNames: "ppt.dodges.it" # Comma-separated
    service:
      type: ClusterIP
      ports:
        puppetserver:
          port: 8140
      annotations: {}
      labels: {}
      loadBalancerIP: ""
    ingress:
      enabled: true
      annotations:
        kubernetes.io/ingress.class: nginx
        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
        cert-manager.io/cluster-issuer: "letsencrypt"
      extraLabels: {}
      hosts:
        - ppt.dodges.it
      tls:
        - secretName: ppt-le-secret
          hosts:
            - ppt.dodges.it
    multiMasters:
      enabled: false
      manualScaling:
        masters: 1
      autoScaling:
        enabled: false
        minMasters: 1
        maxMasters: 3
        cpuUtilizationPercentage: 75
        memoryUtilizationPercentage: 75
    backup:
      enabled: false
      resources: {}
      failedJobsHistoryLimit: 5
      successfulJobsHistoryLimit: 2
      schedule: "@every 12h"
      image: restic/restic
      tag: 0.17.3
      pullPolicy: IfNotPresent
      caConfigMap: ""
      serviceAccount:
        enabled: false
        create: false
        annotations: {}
      restic:
        keep_last: 90 # days
        repository: "" # "s3:https://s3.minio.xx/backups/"
        existingSecret: "" # to use this instead of the below
        access_key_id: "" # s3 access key
        secret_access_key: "" # s3 secret access key
        password: "" # restic encryption password
  compilers:
    enabled: false
    kind: StatefulSet
    resources: {}
    podAntiAffinity: false
    podDisruptionBudget:
      enabled: false
      minAvailable: 1
    networkPolicy:
      enabled: false
      policyTypes:
        - Egress
        - Ingress
      additionnalIngressRules:
        - from:
            - namespaceSelector: {}
          ports:
            - port: 8140
      additionnalEgressRules: []
    annotations: {}
    podAnnotations: {}
    extraContainers: []
    extraEnv: {}
    extraEnvSecret: ""
    extraLabels: {}
    updateStrategy:
      type: RollingUpdate
    readinessProbeScheme: HTTPS
    readinessProbePeriodSeconds: 60
    readinessProbeTimeout: 20
    readinessProbeFailureThreshold: 3
    readinessProbeSuccessThreshold: 1
    livenessProbePeriodSeconds: 30
    livenessProbeTimeout: 10
    livenessProbeFailureThreshold: 3
    livenessProbeSuccessThreshold: 1
    startupProbePeriodSeconds: 15
    startupProbeFailureThreshold: 30
    manualScaling:
      compilers: 1
    autoScaling:
      enabled: false
      minCompilers: 1
      maxCompilers: 3
      cpuUtilizationPercentage: 75
      memoryUtilizationPercentage: 75
    podManagementPolicy: OrderedReady
    fqdns:
      alternateServerNames: "" # Comma-separated
    service:
      type: ClusterIP
      ports:
        puppetserver:
          port: 8140
      annotations: {}
      labels: {}
      loadBalancerIP: ""
      headless:
        ports:
          https:
            port: 443
            targetPort: 8140
            protocol: TCP
        annotations: {}
        labels: {}
    ingress:
      enabled: false
      annotations:
        {}
      extraLabels: {}
      hosts: []
      tls: []
  preGeneratedCertsJob:
    enabled: false
    importPuppetdb: true
    jobDeadline: 300
  customconfigs:
    enabled: false
    configmaps: {}
  customentrypoints:
    enabled: false
    configmaps: {}
  extraSecrets: []
  extraInitArgs: ""
  serviceAccount:
    enabled: false
    create: false
    annotations:
  rbac:
    create: false
    annotations:
  psp:
    create: false
    annotations:
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - all
      add:
        - CAP_CHOWN
        - CAP_SETUID
        - CAP_SETGID
        - CAP_DAC_OVERRIDE
        - CAP_AUDIT_WRITE
        - CAP_FOWNER
        - CHOWN
        - SETUID
        - SETGID
        - DAC_OVERRIDE
        - AUDIT_WRITE
        - FOWNER
  puppeturl: "ssh://REDACTED"
  puppetbasedir: /etc/puppetlabs/code/environments
r10k:
  name: r10k
  image: "{{ .Values.global.r10k.image }}"
  tag: "{{ .Values.global.r10k.tag }}"
  imagePullPolicy: "{{ .Values.global.r10k.imagePullPolicy }}"
  asSidecar: true
  podSecurityContext:
    runAsNonRoot: true
  containerSecurityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - all
  updateStrategy:
    type: RollingUpdate
  code:
    resources:
      requests:
        memory: 256Mi
        cpu: 200m
      limits:
        memory: 512Mi
        cpu: 300m
    command:
      - "/bin/sh"
      - "-c"
    args:
      - /etc/puppetlabs/puppet/r10k_code_entrypoint.sh;
    cronJob:
      enabled: true
      schedule: "*/5 * * * *"
      splay: false
      splayLimit: 60
      successFile: ~/.r10k_code_cronjob.success
    extraArgs: []
    extraEnv:
      {}
    extraEnvSecret: ""
    extraSettings: {}
    extraRepos: {}
    defaultRepoExtraConf: {}
    viaHttps:
      credentials:
        netrc:
          value: # |
        existingSecret: ""
      customCa:
        cert:
          value: # |
        existingSecret: ""
    viaSsh:
      credentials:
        ssh:
          value: |
            -----BEGIN OPENSSH PRIVATE KEY-----
            [REDACTED]
            -----END OPENSSH PRIVATE KEY-----
        known_hosts:
          value: |
            [gitlab.peslerbe.com]:5201 ssh-ed25519 [REDACTED]
            [gitlab.peslerbe.com]:5201 ssh-rsa [REDACTED]
        existingSecret: ""
  hiera:
    resources: {}
    cronJob:
      enabled: true
      schedule: "*/4 * * * *"
      splay: false
      splayLimit: 60
      successFile: ~/.r10k_hiera_cronjob.success
    extraArgs: []
    extraEnv: {}
    extraEnvSecret: ""
    extraSettings: {}
    extraRepos: {}
    defaultRepoExtraConf: {}
    viaHttps:
      credentials:
        netrc:
          value: # |
        existingSecret: ""
    viaSsh:
      credentials:
        ssh:
          value: # |
        known_hosts:
          value: # |
        existingSecret: ""
puppetdb:
  enabled: true
  name: puppetdb
  image: ghcr.io/openvoxproject/openvoxdb
  tag: 8.9.0-main
  pullPolicy: IfNotPresent
  resources:
    requests:
      memory: 512Mi
      cpu: 500m
    limits:
      memory: 1024Mi
      cpu: 1000m
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - all
      add:
        - CAP_FOWNER
        - CAP_CHOWN
        - CAP_SETUID
        - CAP_SETGID
        - CAP_DAC_OVERRIDE
        - FOWNER
        - CHOWN
        - SETUID
        - SETGID
        - DAC_OVERRIDE
  networkPolicy:
    enabled: false
    policyTypes:
      - Egress
      - Ingress
    additionnalIngressRules:
      - from:
          - namespaceSelector: {}
        ports:
          - port: 9090
    additionnalEgressRules: []
  extraContainers:
    - name: "shellscript"
      image: ubuntu:latest
      command: ["sleep", "infinity"]
  extraInitContainers: []
  extraEnv:
    OPENVOXDB_POSTGRES_HOSTNAME: postgres-postgresql-primary.postgres
    OPENVOXDB_POSTGRES_DATABASE: puppet
    OPENVOXDB_POSTGRES_USER: puppet
    OPENVOXDB_POSTGRES_PASSWORD: [REDACTED]
    OPENVOXDB_JAVA_ARGS: -Djava.net.preferIPv4Stack=true -Xms256m -Xmx256m -XX:+UseParallelGC -Xlog:gc*:file=/tmp/openvoxdb_gc.log -Djdk.tls.ephemeralDHKeySize=2048
    LOGDIR: /tmp
  extraEnvSecret: ""
  extraLabels: {}
  annotations: {}
  podAnnotations: {}
  updateStrategy:
    type: Recreate
  service:
    type: ClusterIP
    annotations: {}
    labels: {}
    loadBalancerIP: ""
    clusterIP: ""
  customconfigs:
    enabled: false
    configmaps: {}
  metrics:
    enabled: false
  persistence:
    existingClaim: ""
    accessModes: []
    storageClass: ""
    annotations: {}
    size: ""
  serviceAccount:
    enabled: false
    create: false
    annotations:
  rbac:
    create: false
    annotations:
  psp:
    create: false
    annotations:
  fqdns:
    serverName: "ppt.dodges.it"
    alternateServerNames: "ppt.dodges.it" # Comma-separated
postgresql:
  enabled: false
  architecture: standalone
  networkPolicy:
    enabled: true
    egressRules:
      denyConnectionsToExternal: true
  primary:
    initdb:
      scriptsConfigMap: "postgresql-custom-extensions"
    persistence:
      enabled: true
      size: 10Gi
      annotations:
        helm.sh/resource-policy: keep
puppetboard:
  enabled: false
  name: puppetboard
  image: ghcr.io/voxpupuli/puppetboard
  tag: 6.0.0
  port: 9090
  pullPolicy: IfNotPresent
  service:
    targetPort: puppetboard
  resources: {}
  extraEnv: {}
  extraEnvSecret: ""
  securityContext:
    runAsNonRoot: true
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - all
  ingress:
    enabled: false
    annotations:
      {}
    extraLabels: {}
    hosts: []
    tls: []
hiera:
  name: hiera
  hieradataurl: "" # [email protected]:$SOMEUSER/hieradata.git
  config: # |-
  eyaml:
    existingMap: ""
    existingSecret: ""
    private_key: # |
    public_key: # |
nameOverride: ""
kubeVersionOverride: ""
nodeSelector: {}
affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 1
        preference:
          matchExpressions:
            - key: dodges.it/type
              operator: In
              values:
                - compute
tolerations: []
priorityClass: high-priority
podAnnotations: {}
storage:
  accessModes:
    - ReadWriteOnce
  storageClass: "ceph-block"
  annotations: {}
  size: 400Mi
singleCA:
  enabled: false
  crl:
    url:
    asSidecar: true
    image: "{{ .Values.global.r10k.image }}"
    tag: "{{ .Values.global.r10k.tag }}"
    imagePullPolicy: "{{ .Values.global.r10k.imagePullPolicy }}"
    cronJob:
      schedule: "0 * * * *"
      failedJobsHistoryLimit: 2
      successfulJobsHistoryLimit: 1
    extraEnv: {}
    extraEnvSecret: ""
    resources:
      requests:
        memory: 128Mi
        cpu: 50m
      limits:
        memory: 2048Mi
        cpu: 100m
    securityContext:
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      capabilities:
        drop:
          - all
  config: ""
  certificates:
    existingSecret:
      {}
    secretKeys:
      puppetCert: puppet.pem
      puppetKey: puppet.key
      puppetdbCert: puppetdb.pem
      puppetdbKey: puppetdb.key
      crlKey: crl.pem
  puppetdb:
    overrideHostname: "ppt.dodges.it"
metrics:
  prometheus:
    puppetdb:
      enabled: false
      image: "{{ .Values.global.puppetdbexporter.image }}"
      tag: "{{ .Values.global.puppetdbexporter.tag }}"
      imagePullPolicy: "{{ .Values.global.puppetdbexporter.imagePullPolicy }}"
      port: 9635
      resources: {}
      interval:
        30s
      extraEnv:
        PUPPETDB_SSL_SKIP_VERIFY: "True"
        PUPPETDB_URL: "http://openvoxserver-puppetserver-puppet.ppt:8140"
      extraEnvSecret: ""
      serviceMonitor:
        enabled: true
        metricRelabelings: []
        relabelings: []
        jobLabel: puppetdb
        interval: 30s
        honorLabels: true
        additionalLabels:
          release: mon
    jmx:
      enabled: false
      image: "{{ .Values.global.jmxexporter.image }}"
      tag: "{{ .Values.global.jmxexporter.tag }}"
      imagePullPolicy: "{{ .Values.global.jmxexporter.imagePullPolicy }}"
      port: 5556
      resources: {}
      extraEnv: {}
      extraEnvSecret: ""
      config: |-
        hostPort: localhost:31000
        lowercaseOutputName: true
        lowercaseOutputLabelNames: true
        whitelistObjectNames:
          - puppetserver:name=puppetlabs.*.http.active-requests
          - puppetserver:name=puppetlabs.*.http.total-requests
        rules:
          - pattern: 'puppetserver<name=puppetlabs.*.http.active-requests><>Count'
            name: puppetserver_http_requests_active
            type: GAUGE
            help: "The number of active HTTP requests."
          - pattern: 'puppetserver<name=puppetlabs.*.http.total-requests><>Count'
            name: puppetserver_http_requests_total
            type: COUNTER
            help: "The number of active HTTP requests."
      serviceMonitor:
        enabled: true
        metricRelabelings: []
        relabelings: []
        jobLabel: jmx
        interval: 30s
        honorLabels: true
        additionalLabels:
          release: mon