|
| 1 | +# backend |
| 2 | + |
| 3 | +A Helm chart for kube-bind backend deployment |
| 4 | + |
| 5 | +   |
| 6 | + |
| 7 | +## Installation |
| 8 | + |
| 9 | +```bash |
| 10 | +helm install kube-bind-backend oci://ghcr.io/kube-bind/charts/backend --version <version> |
| 11 | +``` |
| 12 | + |
| 13 | +## Configuration |
| 14 | + |
| 15 | +See [values.yaml](values.yaml) for the full list of configurable parameters. |
| 16 | + |
| 17 | +## Values |
| 18 | + |
| 19 | +| Key | Type | Default | Description | |
| 20 | +|-----|------|---------|-------------| |
| 21 | +| affinity | object | `{}` | Affinity rules for pod scheduling | |
| 22 | +| autoscaling.enabled | bool | `false` | Enable horizontal pod autoscaling | |
| 23 | +| autoscaling.maxReplicas | int | `100` | Maximum number of replicas | |
| 24 | +| autoscaling.minReplicas | int | `1` | Minimum number of replicas | |
| 25 | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | Target CPU utilization percentage | |
| 26 | +| backend.apibindingIgnorePrefixes | list | `[]` | Name prefixes of APIBindings to ignore when generating APIServiceExportTemplates | |
| 27 | +| backend.apiexportEndpointSliceName | string | `""` | APIExport EndpointSlice name to watch | |
| 28 | +| backend.clusterScopeIsolation | string | `"prefix"` | Cluster-scope isolation mode. Options: none, prefix, namespaced | |
| 29 | +| backend.consumerScope | string | `"namespaced"` | Consumer scope. Options: "namespaced" | |
| 30 | +| backend.cookieEncryptionKey | string | `""` | Cookie encryption key (base64 encoded). Empty generates random key on each start (not for production!) | |
| 31 | +| backend.cookieSigningKey | string | `""` | Cookie signing key (base64 encoded). Empty generates random key on each start (not for production!) | |
| 32 | +| backend.externalAddress | string | `""` | External address clients use to reach the backend | |
| 33 | +| backend.externalServerName | string | `""` | External server name for TLS SNI | |
| 34 | +| backend.extraArgs | list | `[]` | Extra command-line arguments to pass to the backend | |
| 35 | +| backend.frontendDisabled | bool | `false` | Disable the frontend UI | |
| 36 | +| backend.listenAddress | string | `"0.0.0.0:8080"` | Address the backend listens on | |
| 37 | +| backend.loggingLevel | int | `2` | Logging verbosity level | |
| 38 | +| backend.multiclusterRuntimeProvider | string | `""` | Multicluster runtime provider (e.g., "kcp") | |
| 39 | +| backend.namespacePrefix | string | `"kube-bind-"` | Prefix for namespaces created by kube-bind | |
| 40 | +| backend.oidc.allowedGroups | list | `[]` | List of groups allowed to access bindings. With embedded OIDC, system:authenticated is added automatically | |
| 41 | +| backend.oidc.allowedUsers | list | `[]` | List of users allowed to access bindings | |
| 42 | +| backend.oidc.callbackUrl | string | `""` | OIDC callback URL | |
| 43 | +| backend.oidc.clientId | string | `""` | OIDC client ID | |
| 44 | +| backend.oidc.clientSecret | string | `""` | OIDC client secret (plaintext, prefer clientSecretName for production) | |
| 45 | +| backend.oidc.clientSecretKey | string | `""` | Key within the secret (e.g., "client-secret") | |
| 46 | +| backend.oidc.clientSecretName | string | `""` | Name of the Kubernetes secret containing the OIDC client secret | |
| 47 | +| backend.oidc.issuerUrl | string | `""` | OIDC issuer URL (leave empty for embedded OIDC server) | |
| 48 | +| backend.oidc.type | string | `"embedded"` | OIDC provider type. Options: "embedded" or "external" | |
| 49 | +| backend.prettyName | string | `""` | Human-readable name for this backend instance | |
| 50 | +| backend.schemaSource | string | `""` | Schema source (e.g., "apiresourceschemas") | |
| 51 | +| backend.tls.certSecretName | string | `""` | Name of the Kubernetes secret containing TLS certificate | |
| 52 | +| backend.tls.enabled | bool | `false` | Enable TLS for the backend | |
| 53 | +| backend.tls.tlsCertFile | string | `"/etc/kube-bind/tls/tls.crt"` | Path to TLS certificate file inside the container | |
| 54 | +| backend.tls.tlsKeyFile | string | `"/etc/kube-bind/tls/tls.key"` | Path to TLS key file inside the container | |
| 55 | +| certManager.clusterIssuer | string | `""` | Name of the ClusterIssuer to use | |
| 56 | +| certManager.enabled | bool | `false` | Enable cert-manager integration for automatic TLS certificates | |
| 57 | +| examples.enabled | bool | `false` | Enable example resources to seed on first start | |
| 58 | +| fullnameOverride | string | `""` | Override the full release name | |
| 59 | +| gatewayApi.enabled | bool | `false` | Enable Gateway API resources | |
| 60 | +| gatewayApi.gateway.annotations | object | `{}` | Annotations to add to the Gateway resource | |
| 61 | +| gatewayApi.gateway.className | string | `""` | Gateway class name | |
| 62 | +| gatewayApi.gateway.httpPort | int | `80` | HTTP listener port | |
| 63 | +| gatewayApi.gateway.httpsPort | int | `443` | HTTPS listener port | |
| 64 | +| gatewayApi.gateway.tls.certificateRefs | list | `[]` | TLS certificate references for the Gateway | |
| 65 | +| gatewayApi.route.annotations | object | `{}` | Annotations to add to the HTTPRoute resource | |
| 66 | +| gatewayApi.route.hostnames | list | `[]` | Hostnames for the HTTPRoute | |
| 67 | +| gatewayApi.route.path | string | `"/"` | Path match for the HTTPRoute | |
| 68 | +| gatewayApi.route.pathType | string | `"PathPrefix"` | Path match type for the HTTPRoute | |
| 69 | +| hostAliases | list | `[]` | Host aliases for /etc/hosts injection into pods | |
| 70 | +| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | |
| 71 | +| image.repository | string | `"ghcr.io/kube-bind/backend"` | Image repository | |
| 72 | +| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion | |
| 73 | +| imagePullSecrets | list | `[]` | Secrets for pulling images from a private repository | |
| 74 | +| initContainers | list | `[]` | Additional init containers | |
| 75 | +| livenessProbe | object | `{"httpGet":{"path":"/healthz","port":"http"}}` | Liveness probe configuration | |
| 76 | +| nameOverride | string | `""` | Override the chart name | |
| 77 | +| nodeSelector | object | `{}` | Node selector for pod scheduling | |
| 78 | +| podAnnotations | object | `{}` | Annotations to add to the pod | |
| 79 | +| podLabels | object | `{}` | Labels to add to the pod | |
| 80 | +| podSecurityContext | object | `{}` | Pod security context | |
| 81 | +| rbac.create | bool | `true` | Specifies whether RBAC resources should be created | |
| 82 | +| readinessProbe | object | `{"httpGet":{"path":"/healthz","port":"http"}}` | Readiness probe configuration | |
| 83 | +| replicaCount | int | `1` | Number of replicas for the backend deployment | |
| 84 | +| resources | object | `{}` | Resource requests and limits | |
| 85 | +| securityContext | object | `{}` | Container security context | |
| 86 | +| service.httpsNodePort | string | `""` | NodePort for HTTPS (only used when type is NodePort) | |
| 87 | +| service.httpsPort | int | `8443` | HTTPS service port | |
| 88 | +| service.nodePort | string | `""` | NodePort for HTTP (only used when type is NodePort) | |
| 89 | +| service.port | int | `8080` | HTTP service port | |
| 90 | +| service.type | string | `"ClusterIP"` | Service type | |
| 91 | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | |
| 92 | +| serviceAccount.automount | bool | `true` | Automatically mount the ServiceAccount's API credentials | |
| 93 | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | |
| 94 | +| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | |
| 95 | +| tolerations | list | `[]` | Tolerations for pod scheduling | |
| 96 | +| volumeMounts | list | `[]` | Additional volumeMounts on the output Deployment definition | |
| 97 | +| volumes | list | `[]` | Additional volumes on the output Deployment definition | |
| 98 | + |
| 99 | +--- |
| 100 | + |
| 101 | +*This README is generated by [helm-docs](https://github.com/norwoodj/helm-docs). Do not edit manually.* |
0 commit comments