|
| 1 | +# config-manager Chart Values |
| 2 | + |
| 3 | +This document describes the values for the `charts/config-manager` Helm chart. |
| 4 | + |
| 5 | +The chart deploys the `config-manager` Go service as a `ClusterIP` Service and Deployment, |
| 6 | +with an optional Ingress and an optional Gateway API `HTTPRoute` for external access. See |
| 7 | +`config-manager/AGENTS.md` for the runtime contract this chart configures. |
| 8 | + |
| 9 | +## Development Commands |
| 10 | + |
| 11 | +Run these commands from `helm-charts`: |
| 12 | + |
| 13 | +```bash |
| 14 | +helm lint charts/config-manager --set application.managementUiServerUrl=http://localhost |
| 15 | +helm template config-manager charts/config-manager --set application.managementUiServerUrl=http://localhost |
| 16 | +``` |
| 17 | + |
| 18 | +## Image, Service, Resources |
| 19 | + |
| 20 | +```yaml |
| 21 | +image: |
| 22 | + repository: mrflick72/vauthenticator-config-manager-k8s |
| 23 | + pullPolicy: Always |
| 24 | + tag: "latest" |
| 25 | + |
| 26 | +service: |
| 27 | + type: ClusterIP |
| 28 | + port: 8086 |
| 29 | + |
| 30 | +resources: |
| 31 | + requests: |
| 32 | + cpu: "50m" |
| 33 | + memory: "32Mi" |
| 34 | + limits: |
| 35 | + cpu: "100m" |
| 36 | + memory: "64Mi" |
| 37 | + |
| 38 | +replicaCount: 1 |
| 39 | +``` |
| 40 | +
|
| 41 | +| Name | Description | Default | |
| 42 | +| --- | --- | --- | |
| 43 | +| `image.repository` | Container image repository. | `mrflick72/vauthenticator-config-manager-k8s` | |
| 44 | +| `image.pullPolicy` | Container image pull policy. | `Always` | |
| 45 | +| `image.tag` | Container image tag. | `latest` | |
| 46 | +| `service.type` | Kubernetes service type. | `ClusterIP` | |
| 47 | +| `service.port` | Service and container port. Matches the app's `SERVER_ADDRESS` port. | `8086` | |
| 48 | +| `resources` | Container resource requests and limits. | See `values.yaml` | |
| 49 | +| `replicaCount` | Deployment replica count. | `1` | |
| 50 | +| `pod.probes.liveness.*` / `pod.probes.readiness.*` | Probe timing. Both probes call the unauthenticated `GET /api/config` endpoint. | `5`, `30` | |
| 51 | +| `labels` | Extra pod labels. | `{}` | |
| 52 | +| `selectorLabels` | Selector labels used by Deployment and Service. Change with care. | `app: vauthenticator-config-manager` | |
| 53 | +| `podAnnotations` | Extra pod annotations. | `{}` | |
| 54 | +| `imagePullSecrets` | Image pull secrets. | `[]` | |
| 55 | + |
| 56 | +## Ingress |
| 57 | + |
| 58 | +```yaml |
| 59 | +ingress: |
| 60 | + host: "*" |
| 61 | + annotations: {} |
| 62 | + tls: {} |
| 63 | + enabled: true |
| 64 | + class: nginx |
| 65 | +``` |
| 66 | + |
| 67 | +| Name | Description | Default | |
| 68 | +| --- | --- | --- | |
| 69 | +| `ingress.enabled` | Render an Ingress resource. | `true` | |
| 70 | +| `ingress.host` | Ingress host. | `"*"` | |
| 71 | +| `ingress.annotations` | Extra ingress annotations. | `{}` | |
| 72 | +| `ingress.tls` | Ingress TLS block. | `{}` | |
| 73 | +| `ingress.class` | Ingress class annotation value. | `nginx` | |
| 74 | + |
| 75 | +The rendered Ingress always routes path `/` to this Service. Since config-manager only |
| 76 | +ever serves `/api/config`, give it its own `ingress.host` rather than sharing the |
| 77 | +management UI's host, unless your ingress controller resolves overlapping host/path rules |
| 78 | +across separate Ingress objects the way you expect. |
| 79 | + |
| 80 | +## Gateway API HTTPRoute |
| 81 | + |
| 82 | +```yaml |
| 83 | +gateway: |
| 84 | + enabled: false |
| 85 | + annotations: {} |
| 86 | + labels: {} |
| 87 | + parentRefs: [] |
| 88 | + hostnames: [] |
| 89 | + rules: [] |
| 90 | +``` |
| 91 | + |
| 92 | +| Name | Description | Default | |
| 93 | +| --- | --- | --- | |
| 94 | +| `gateway.enabled` | Render a Gateway API `HTTPRoute` instead of / alongside the Ingress. | `false` | |
| 95 | +| `gateway.parentRefs` | Gateway references. Required (fails the render) when `gateway.enabled=true`. | `[]` | |
| 96 | +| `gateway.hostnames` | Hostnames for the route. | `[]` | |
| 97 | +| `gateway.rules` | Route rules. Defaults to a single `PathPrefix /` rule targeting this Service when empty. | `[]` | |
| 98 | +| `gateway.annotations` / `gateway.labels` | Extra metadata on the `HTTPRoute`. | `{}` | |
| 99 | + |
| 100 | +TLS/cert-manager is configured on the referenced Gateway listener, not on this `HTTPRoute`. |
| 101 | + |
| 102 | +## Application Configuration |
| 103 | + |
| 104 | +```yaml |
| 105 | +application: |
| 106 | + serverAddress: ":8086" |
| 107 | + managementUiServerUrl: http://management-ui-example-host.com |
| 108 | + idpBaseUrl: http://application-example-host.com |
| 109 | + clientApplicationId: vauthenticator-management-ui |
| 110 | + redirectUri: http://management-ui-example-host.com/callback |
| 111 | + authenticationCheckInterval: "15000" |
| 112 | + apiBaseUrl: http://application-example-host.com/api |
| 113 | +``` |
| 114 | + |
| 115 | +These map 1:1 to the environment variables read by config-manager (`config-manager/internal/config/config.go`): |
| 116 | + |
| 117 | +| Name | Environment variable | Description | Default | |
| 118 | +| --- | --- | --- | --- | |
| 119 | +| `application.serverAddress` | `SERVER_ADDRESS` | Listen address. | `:8086` | |
| 120 | +| `application.managementUiServerUrl` | `MANAGEMENT_UI_SERVER_URL` | Allowed CORS origin; must match the management UI host. Required, no safe default — always set explicitly. | placeholder | |
| 121 | +| `application.idpBaseUrl` | `IDP_BASE_URL` | Authorization server base URL returned to the management UI. | placeholder | |
| 122 | +| `application.clientApplicationId` | `CLIENT_APPLICATION_ID` | OAuth2 client ID returned to the management UI. | `vauthenticator-management-ui` | |
| 123 | +| `application.redirectUri` | `REDIRECT_URI` | OAuth2 redirect URI returned to the management UI. | placeholder | |
| 124 | +| `application.authenticationCheckInterval` | `AUTHENTICATION_CHECK_INTERVAL` | Auth check polling interval in milliseconds, as a string. | `15000` | |
| 125 | +| `application.apiBaseUrl` | `API_BASE_URL` | Authorization server API base URL returned to the management UI. | placeholder | |
| 126 | + |
| 127 | +All of these except `serverAddress` are required by the application at startup (see |
| 128 | +`Config.Validate()`); the Deployment template uses `required` so a missing value fails |
| 129 | +`helm template`/`helm install` with a clear error instead of deploying a broken pod. |
0 commit comments