-
Notifications
You must be signed in to change notification settings - Fork 48
/
default_values.yaml
1904 lines (1622 loc) · 69 KB
/
default_values.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
## --------------------------------------------------------------------------------
##
## argocd
##
## --------------------------------------------------------------------------------
argocd:
## a prefix to use for argocd application names
## - allows a single instance of argocd to manage deployKF across multiple clusters
## - if non-empty, `argocd.destination` must be a remote cluster, this is because
## a single cluster can only have one instance of deployKF
##
appNamePrefix: ""
## the namespace in which argocd is deployed
##
namespace: argocd
## the project used for deployKF argocd applications
##
project: default
## the source used for deployKF argocd applications
##
source:
## plugin configs
##
plugin:
## if the argocd plugin is being used
## - note, this value is automatically set to true when using the plugin
##
enabled: false
## configs specifying the git repo which contains your generated manifests
##
repo:
## the URL of your manifest git repo
## - for example, if you are using a GitHub repo named 'deployKF/examples', you might set this value
## to "https://github.com/deployKF/examples" or "git@github.com:deployKF/examples.git"
##
url: ""
## the git revision which contains your generated manifests
## - for example, if you are using the 'main' branch of your repo, you might set this value to "main"
##
revision: ""
## the path within your repo where the generated manifests are stored
## - for example, if you are using a folder named 'GENERATOR_OUTPUT' at the root of your repo,
## you might set this value to "./GENERATOR_OUTPUT/"
##
path: ""
## the destination used for deployKF argocd applications
## - the value of `destination.name` takes precedence over `destination.server`
##
destination:
server: https://kubernetes.default.svc
name: ""
## --------------------------------------------------------------------------------
##
## deploykf-dependencies
##
## --------------------------------------------------------------------------------
deploykf_dependencies:
## --------------------------------------
## cert-manager
## --------------------------------------
cert_manager:
enabled: true
namespace: cert-manager
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##
valuesOverrides: {}
## extra manifests
## - a list of strings containing extra Kubernetes resource manifests
## - strings can include deployKF templates `{{< ... >}}` and Helm templates `{{ ... }}`
##
extraManifests: []
## chart overrides
##
charts:
certManager:
name: cert-manager
version: 1.12.2
repository: https://charts.jetstack.io
trustManager:
name: trust-manager
version: 0.5.0
repository: https://charts.jetstack.io
## image overrides
##
images:
certManagerController:
repository: quay.io/jetstack/cert-manager-controller
tag: ~
pullPolicy: IfNotPresent
certManagerWebhook:
repository: quay.io/jetstack/cert-manager-webhook
tag: ~
pullPolicy: IfNotPresent
certManagerCainjector:
repository: quay.io/jetstack/cert-manager-cainjector
tag: ~
pullPolicy: IfNotPresent
certManagerAcmesolver:
repository: quay.io/jetstack/cert-manager-acmesolver
tag: ~
certManagerCtl:
repository: quay.io/jetstack/cert-manager-ctl
tag: ~
pullPolicy: IfNotPresent
trustManager:
repository: quay.io/jetstack/trust-manager
tag: ~
pullPolicy: IfNotPresent
trustManagerDefaultPackage:
repository: quay.io/jetstack/cert-manager-package-debian
tag: ~
pullPolicy: IfNotPresent
## cert-manager controller configs
##
controller:
## PodSecurityContext configs
##
securityContext:
fsGroup: 1001
## ServiceAccount configs
##
serviceAccount:
create: true
name: "cert-manager"
annotations: {}
## extra command line args
## - https://cert-manager.io/v1.11-docs/cli/controller/
##
extraArgs:
## automatically remove generated secrets when the certificate resource is deleted
- --enable-certificate-owner-ref=true
## istio gateway certificate issuer configs
## - if you wish to use your own ClusterIssuer, set `clusterIssuer.enabled` to false
## and set `clusterIssuer.issuerName` to the name of your issuer, (this still works when you
## bring your own cert-manager deployment by setting `cert_manager.enabled` to false)
##
clusterIssuer:
enabled: true
issuerName: deploykf-gateway-issuer
## the type of the chart-provided ClusterIssuer
## - currently only "SELF_SIGNED" is supported, to use a different issuer type
## set `clusterIssuer.enabled` to false and provision your own issuer
##
type: SELF_SIGNED
selfSigned:
caIssuerName: selfsigned-ca-issuer
caSecretName: selfsigned-ca-issuer-root-cert
## using trust-manager, each Namespace with the "deploykf.github.io/inject-root-ca-cert=enabled" label
## is injected with a ConfigMap containing a "root-cert.pem" key that contains the self-signed root CA
## applications can then trust the issued gateway certificates by trusting this CA
injectedConfigMapName: deploykf-gateway-issuer-root-ca-cert
## --------------------------------------
## istio
## --------------------------------------
istio:
enabled: true
namespace: istio-system
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##
valuesOverrides: {}
## extra manifests
## - a list of strings containing extra Kubernetes resource manifests
## - strings can include deployKF templates `{{< ... >}}` and Helm templates `{{ ... }}`
##
extraManifests: []
## chart overrides
##
charts:
istioBase:
name: base
## NOTE: this version should be aligned with `deploykf_core.deploykf_istio_gateway.charts.istioGateway.version`
version: 1.17.3
repository: https://istio-release.storage.googleapis.com/charts
istioDaemon:
name: istiod
## NOTE: this version should be aligned with `deploykf_core.deploykf_istio_gateway.charts.istioGateway.version`
version: 1.17.3
repository: https://istio-release.storage.googleapis.com/charts
## image overrides
## - when tag is unset, default is: "{charts.istioDaemon.version}-{defaultImageVariant}"
##
images:
istioProxy:
repository: docker.io/istio/proxyv2
tag: ~
istioPilot:
repository: docker.io/istio/pilot
tag: ~
## the default image variant
## - can be one of: ["", "debug", "distroless"]
## https://istio.io/latest/docs/ops/configuration/security/harden-docker-images/
##
defaultImageVariant: distroless
## istio sidecar injector webhook configs
##
sidecarInjectorWebhook:
## additional annotations which are added to pods after sidecar injection
##
injectedAnnotations: {}
## istio mesh configs
## - note, deployKF will override some configs with the required values, even if they are set here
## - a useful config for debugging is to set `accessLogFile` as "/dev/stdout", which will print access logs to STDOUT
##
meshConfig: {}
## --------------------------------------
## kyverno
## --------------------------------------
kyverno:
enabled: true
namespace: kyverno
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##
valuesOverrides: {}
## extra manifests
## - a list of strings containing extra Kubernetes resource manifests
## - strings can include deployKF templates `{{< ... >}}` and Helm templates `{{ ... }}`
##
extraManifests: []
## chart overrides
##
charts:
kyverno:
name: kyverno
## NOTE: kyverno's chart versions are NOT aligned to the kyverno app version, see:
## https://artifacthub.io/packages/helm/kyverno/kyverno
version: 3.0.1
repository: https://kyverno.github.io/kyverno
## image overrides
##
images:
kubectl:
repository: docker.io/bitnami/kubectl
tag: ~
pullPolicy: IfNotPresent
kyverno:
repository: ghcr.io/kyverno/kyverno
tag: ~
pullPolicy: IfNotPresent
kyvernoInit:
repository: ghcr.io/kyverno/kyvernopre
tag: ~
pullPolicy: IfNotPresent
kyvernoBackgroundController:
repository: ghcr.io/kyverno/background-controller
tag: ~
pullPolicy: IfNotPresent
kyvernoCleanupController:
repository: ghcr.io/kyverno/cleanup-controller
tag: ~
pullPolicy: IfNotPresent
kyvernoReportsController:
repository: ghcr.io/kyverno/reports-controller
tag: ~
pullPolicy: IfNotPresent
## kyverno extra resource permissions
## - a list of extra kubernetes resources to allow kyverno to generate and manage
## - each element is a map with keys `apiGroups` and `resources` that contain lists of strings
##
extraResourceRules:
- apiGroups: [ "kubeflow.org" ]
resources: [ "poddefaults" ]
## --------------------------------------------------------------------------------
##
## deploykf-core
##
## --------------------------------------------------------------------------------
deploykf_core:
## --------------------------------------
## deploykf-auth
## --------------------------------------
deploykf_auth:
enabled: true
namespace: deploykf-auth
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##
valuesOverrides: {}
## extra manifests
## - a list of strings containing extra Kubernetes resource manifests
## - strings can include deployKF templates `{{< ... >}}` and Helm templates `{{ ... }}`
##
extraManifests: []
## image overrides
##
images:
dex:
repository: ghcr.io/dexidp/dex
tag: v2.37.0
pullPolicy: IfNotPresent
oauth2Proxy:
repository: quay.io/oauth2-proxy/oauth2-proxy
tag: v7.4.0
pullPolicy: IfNotPresent
kubectl:
repository: docker.io/bitnami/kubectl
tag: 1.26.6-debian-11-r8
pullPolicy: IfNotPresent
## dex configs
##
dex:
## dex static passwords
## - a list of users to create in dex's built-in password database
## - each element is a map with keys `email` and `password`,
## the `password` is a map with the following keys:
## - `value`: the password value
## - `existingSecret`: the name of a kubernetes secret containing the password (overrides `value`)
## - `existingSecretKey`: the key in the secret that contains the password
## - `type`: how the password is provided (default: "plain")
## - "plain": the password is provided as plain text
## - "hash": the password is provided as a bcrypt hash
## - a bcrypt hash for "PASSWORD_STRING" can be generated with one of the following:
## - echo "PASSWORD_STRING" | htpasswd -BinC 10 NULL | cut -d: -f2
## - python -c 'import bcrypt; print(bcrypt.hashpw(b"PASSWORD_STRING", bcrypt.gensalt(10)).decode())'
##
staticPasswords:
- email: "admin@example.com"
password:
value: "admin"
- email: "user1@example.com"
password:
value: "user1"
- email: "user2@example.com"
password:
value: "user2"
## dex connectors
## - dex connectors which allow bridging trust to external identity providers
## https://dexidp.io/docs/connectors/
## - not all connector types support refresh tokens, notably "SAML 2.0" and "OAUTH 2.0" do not
## however, most providers support "OpenID Connect" which does support refresh tokens
## without refresh tokens, users will be forced to re-authenticate every `expiry.idToken` period
## - each element is a map with keys `type`, `id`, `name`, and `config` (which are the same aas upstream dex)
## additionally, `configExistingSecret` and `configExistingSecretKey` allow you to set `config`
## from a YAML-formatted string in a kubernetes secret
## - in most cases `config.redirectURI` will be set to "https://{DEPLOYKF_HOST}/dex/callback" (if port is 443)
##
connectors: []
## dex token expiry configs
## - times are in Go duration format: https://golang.org/pkg/time/#ParseDuration
##
expiry:
## the lifetime of issued id tokens
idToken: "60m"
## refresh token configs
## - note, some dex connectors do NOT support refresh tokens
##
refreshToken:
## max time since last use of a refresh token
idle: "168h" # 7d
## max total lifetime of a refresh token
total: "2160h" # 90d
## dex OpenID Connect clients
##
clients:
## OpenID client for oauth2-proxy (deployKF Dashboard)
## - [WARNING] it is strongly recommended to enable `generateSecret` or use a custom value
##
oauth2Proxy:
clientId: "oauth2-proxy"
clientSecret:
value: "bbbbbbbbbbbbbbbb"
existingSecret: ""
existingSecretKey: "client_secret"
generateSecret: false
## OpenID client for Minio Console
## - [WARNING] it is strongly recommended to enable `generateSecret` or use a custom value
##
minioConsole:
clientId: "minio-console"
clientSecret:
value: "bbbbbbbbbbbbbbbb"
existingSecret: ""
existingSecretKey: "client_secret"
generateSecret: false
## OpenID client for Argo Server
## - [WARNING] it is strongly recommended to enable `generateSecret` or use a custom value
##
argoServer:
clientId: "argo-server"
clientSecret:
value: "bbbbbbbbbbbbbbbb"
existingSecret: ""
existingSecretKey: "client_secret"
generateSecret: false
## oauth2-proxy configs
##
oauth2Proxy:
## oauth2-proxy cookie configs
##
cookie:
## sets oauth2-proxy config `--cookie-name`
name: "_deploykf_token"
## sets oauth2-proxy config `--cookie-expire`
expire: "168h" # 7d
## sets oauth2-proxy config `--cookie-refresh`
refresh: "60m"
## sets oauth2-proxy config `--cookie-secret`
## - [WARNING] it is strongly recommended to enable `generateSecret` or use a custom value
##
secret:
value: "cccccccccccccccc"
existingSecret: ""
existingSecretKey: "cookie_secret"
generateSecret: false
## --------------------------------------
## deploykf-dashboard
## --------------------------------------
deploykf_dashboard:
enabled: true
namespace: deploykf-dashboard
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##
valuesOverrides: {}
## extra manifests
## - a list of strings containing extra Kubernetes resource manifests
## - strings can include deployKF templates `{{< ... >}}` and Helm templates `{{ ... }}`
##
extraManifests: []
## image overrides
##
images:
dashboard:
repository: ghcr.io/deploykf/dashboard
tag: 0.1.0
pullPolicy: IfNotPresent
profileController:
repository: kubeflownotebookswg/profile-controller
tag: v1.7.0
pullPolicy: IfNotPresent
kfamApi:
repository: kubeflownotebookswg/kfam
tag: v1.7.0
pullPolicy: IfNotPresent
## configs dashboard navigation
##
navigation:
## external links that appear in the sidebar
## - a list of extra links to appear in the dashboard sidebar
## - each element is a map with the following keys:
## - `text`: the text that appears in the sidebar (example: "deployKF")
## - `url`: the url to navigate to when the link is clicked (example: "https://deploykf.org")
## - `icon`: the icon that appears in the sidebar (example: "launch")
## - can be any "iron-icon" name, include any "xxxx:" prefix, but not "icons:"
## https://www.webcomponents.org/element/@polymer/iron-icons/demo/demo/index.html
##
externalLinks: []
## links that appear in the home page
## - a list of extra links to appear in the dashboard
## - each element is a map with the following keys:
## - `text`: the text that appears in the homepage (example: "deployKF Website")
## - `desc`: the description which appears below (example: "The tool that deployed your ML platform!")
## - `link`: the url to navigate to when the link is clicked (example: "https://deploykf.org")
##
documentationItems:
- text: deployKF Website
desc: The tool that deployed your ML platform!
link: https://github.com/deployKF/deployKF
## --------------------------------------
## deploykf-istio-gateway
## --------------------------------------
deploykf_istio_gateway:
enabled: true
namespace: deploykf-istio-gateway
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##
valuesOverrides: {}
## extra manifests
## - a list of strings containing extra Kubernetes resource manifests
## - strings can include deployKF templates `{{< ... >}}` and Helm templates `{{ ... }}`
##
extraManifests: []
## chart overrides
##
charts:
istioGateway:
## if false, you must create your own istio gateway ~deployment~ and ~service~
## - you do NOT need to create resources like `networking.istio.io/Gateway`
## - you must set the other values to match your deployment,
## otherwise deployKF will be unable to use them
enabled: true
name: gateway
## NOTE: this version should be aligned with `deploykf_dependencies.istio.charts.istioDaemon.version`
version: 1.17.3
repository: https://istio-release.storage.googleapis.com/charts
## istio gateway configs
##
gateway:
name: deploykf-gateway
hostname: deploykf.example.com
ports:
http: 80
https: 443
tls:
enabled: true
## the pod labels used by the gateway to find the ingress gateway deployment
##
selectorLabels:
app: deploykf-gateway
istio: deploykf-gateway
## if the "PROXY Protocol" is enabled on the gateway
## - https://istio.io/v1.16/docs/ops/configuration/traffic-management/network-topologies/#proxy-protocol
##
enableProxyProtocol: false
## the number of x-forwarded-for HTTP header hops to trust
## - important if using a LoadBalancer (like AWS NLB) as the Service type of deploykf-istio-gateway
##
xffNumTrustedHops: 0
## if the email passed in `X-Auth-Request-Email` by `oauth2-proxy` is cast to lowercase
## - note, this will only affect the email passed to Kubeflow apps, other apps connected to
## dex OIDC will still receive the original email, so it's usually best to standardize
## the emails in your upstream identity system
## - this may be helpful if your identity system returns emails with uppercase letters and you
## want to standardize on lowercase emails for RoleBindings
## - this value will also affect the profiles generated by `deploykf-profiles-generator`
##
emailToLowercase: false
## istio gateway deployment configs
##
gatewayDeployment:
replicaCount: 1
serviceAccount:
name: deploykf-gateway
annotations: {}
autoscaling:
enabled: true
minReplicas: 1
maxReplicas: 5
targetCPUUtilizationPercentage: 80
podAnnotations: {}
## istio gateway service configs
##
gatewayService:
name: deploykf-gateway
annotations: {}
type: LoadBalancer
loadBalancerIP: ""
loadBalancerSourceRanges: []
## --------------------------------------
## deploykf-profiles-generator
## --------------------------------------
deploykf_profiles_generator:
enabled: true
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##
valuesOverrides: {}
## extra manifests
## - a list of strings containing extra Kubernetes resource manifests
## - strings can include deployKF templates `{{< ... >}}` and Helm templates `{{ ... }}`
##
extraManifests: []
## profile defaults
##
profileDefaults:
## a common prefix to add to all profile names
##
profileNamePrefix: ""
## the default email to set as the owner of profiles
## - [WARNING] treat the default owner as a super-admin service account,
## that is, people should NOT use this account day-to-day
## - [WARNING] changing the `ownerEmail` of profiles requires ~manual~ steps
## https://github.com/kubeflow/kubeflow/issues/6576
##
ownerEmail: "admin@example.com"
## the default access for members of profiles, when not explicitly specified
## - `role`: the Kubernetes RBAC role to bind to the user in the profile namespace
## - "edit": binds "ClusterRole/kubeflow-edit" (can view/create/delete resources)
## - "view": binds "ClusterRole/kubeflow-view" (cam view resources)
## - `notebooksAccess`: if the user can ~connect~ to kubeflow notebooks in the profile
## note, the ability to create/delete notebook resources is controlled by `role`
##
memberAccess:
role: view
notebooksAccess: false
## the default list of plugins for profiles, when not explicitly specified
## - each entry is a map with the following keys:
## - `kind`: the kind of plugin
## - "AwsIamForServiceAccount": manages AWS IRSA for the profile namespace
## - "WorkloadIdentity": manages GCP WorkloadIdentity for the profile namespace
## - `spec`: a map of plugin-specific configurations
## - spec for AwsIamForServiceAccount:
## https://github.com/kubeflow/kubeflow/blob/v1.7.0/components/profile-controller/controllers/plugin_iam.go#L30
## - spec for WorkloadIdentity:
## https://github.com/kubeflow/kubeflow/blob/v1.7.0/components/profile-controller/controllers/plugin_workload_identity.go#L39
##
## ____ EXAMPLE _______________
## plugins:
## - ## EKS IRSA plugin
## kind: AwsIamForServiceAccount
## spec:
## awsIamRole: arn:aws:iam::000000000000:role/MY_ROLE_NAME
## AnnotateOnly: true
##
## - ## GKE WorkloadIdentity plugin
## kind: WorkloadIdentity
## spec:
## gcpServiceAccount: SA_NAME@PROJECT_ID.iam.gserviceaccount.com
##
plugins: []
## the default resource quota for profiles, when not explicitly specified
## - spec for ResourceQuotaSpec:
## https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#resourcequotaspec-v1-core
##
resourceQuotaSpec: {}
## the default tool configs for profiles
##
tools:
## the default Kubeflow Pipelines configs for profiles
##
kubeflowPipelines:
## the default Kubeflow Pipelines object store auth configs for profiles
## - the behaviour of these configs depends on `kubeflow_tools.kubeflow_pipelines.objectStore`
## - when `kubeflow_tools.kubeflow_pipelines.objectStore.useExternal`:
## - is false (default):
## - minio is automatically configured to generate unique service-account credentials for each
## profile and store them in a kubernetes secret named `existingSecret` in the minio namespace
## - this secret will be cloned into the profile's namespace and kept in sync with the original
## - note, generated credentials only have access to `kubeflow_tools.pipelines.bucket` under "artifacts/{profile_name}/"
## - note, no credentials are generated for profiles which set `objectStoreAuth`
## - note, the value of `existingSecret` MUST contain "{profile_name}"
## - note, the value of `existingSecretNamespace` is ignored
## - is true:
## - a kubernetes secret named `existingSecret` must exist the namespace `existingSecretNamespace`
## with the keys `existingSecretAccessKeyKey` and `existingSecretSecretKeyKey`
## - this secret will be cloned into the profile's namespace and kept in sync with the original
## - note, all occurances of "{profile_name}" in `existingSecret` are replaced with the profile name
## - note, the default value of `existingSecretNamespace` is the kubeflow-pipelines namespace
## - when `kubeflow_tools.kubeflow_pipelines.objectStore.auth.fromEnv`:
## - is false (default):
## - normal behaviour
## - is true:
## - default configs are ignored to allow for environment-based authentication (e.g. AWS IRSA)
## - if a profile explicitly sets `objectStoreAuth` then it will still be used
##
objectStoreAuth:
existingSecret: "kubeflow-pipelines--profile-object-store-auth--{profile_name}"
existingSecretNamespace: ""
existingSecretAccessKeyKey: "access_key"
existingSecretSecretKeyKey: "secret_key"
## user entities
## - a list of users that can be referenced when defining profile members
## - each element is a map with the following keys:
## - `id`: a unique identifier for the user
## - `email`: the email of the user (must exactly match the email from your identity provider)
##
users:
- id: user-1
email: "user1@example.com"
- id: user-2
email: "user2@example.com"
## group entities
## - a list of groups that can be referenced when defining profile members
## - each element is a map with the following keys:
## - `id`: a unique identifier for the group
## - `users`: a list of user IDs that are members of the group
##
groups:
- id: team-1
users:
- user-1
- user-2
## profile definitions
## - [WARNING] changing the `ownerEmail` of a profile requires ~manual~ steps
## https://github.com/kubeflow/kubeflow/issues/6576
## - a list of profile definitions to be generated
## - each element is a map with the following keys:
## - `name`: the name of the profile (must be unique)
## note, the name of a profile is also its namespace name
## - `members`: a list of members and their access to this profile (default: [])
## note, if a user appears in multiple memberships, the most permissive access is used
## each element is a map with the following keys:
## - `user`: the ID of a user (mutually exclusive with `group`)
## - `group`: the ID of a group (mutually exclusive with `user`)
## - `access`: a map with configs for this member's access to the profile:
## - `role`: the Kubernetes RBAC role to bind to the user (default: `profileDefaults.memberAccess.role`)
## - `notebooksAccess`: if the user can ~connect~ to kubeflow notebooks (default: `profileDefaults.memberAccess.notebooksAccess`)
## - `ownerEmail`: the email to set as the owner of the profile (default: `profileDefaults.ownerEmail`)
## - `plugins`: the list of plugins for this profile (default: `profileDefaults.plugins`)
## - `resourceQuotaSpec`: the resource quota for this profile (default: `profileDefaults.resourceQuotaSpec`)
## - `tools`: a map with configs for tools:
## - `kubeflowPipelines`: a map with configs for Kubeflow Pipelines:
## - `objectStoreAuth`: a map with configs for object store auth (default: `profileDefaults.tools.kubeflowPipelines.objectStoreAuth`)
## - `existingSecret`: the name of an existing kubernetes secret
## - `existingSecretNamespace`: the namespace containing the kubernetes secret (default: namespace of this profile)
## - `existingSecretAccessKeyKey`: the key within the secret that contains the access-key (default: "access_key")
## - `existingSecretSecretKeyKey`: the key within the secret that contains the secret-key (default: "secret_key")
##
profiles:
- name: team-1
members:
- group: team-1
access:
role: edit
notebooksAccess: true
- name: team-1-prod
members:
- group: team-1
access:
role: view
notebooksAccess: false
## --------------------------------------------------------------------------------
##
## deploykf-opt
##
## --------------------------------------------------------------------------------
deploykf_opt:
## --------------------------------------
## deploykf-minio
## --------------------------------------
deploykf_minio:
enabled: false
namespace: deploykf-minio
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##
valuesOverrides: {}
## extra manifests
## - a list of strings containing extra Kubernetes resource manifests
## - strings can include deployKF templates `{{< ... >}}` and Helm templates `{{ ... }}`
##
extraManifests: []
## image overrides
##
images:
minio:
repository: docker.io/minio/minio
tag: RELEASE.2023-08-04T17-40-21Z
pullPolicy: IfNotPresent
minioMc:
repository: docker.io/minio/mc
tag: RELEASE.2023-08-01T23-30-57Z
pullPolicy: IfNotPresent
kubectl:
repository: docker.io/bitnami/kubectl
tag: 1.26.6-debian-11-r8
pullPolicy: IfNotPresent
## persistence configs
##
persistence:
enabled: true
## the name of an existing PersistentVolumeClaim to use
## - if non-emtpy, you must manually create a PVC with this name
##
existingClaim: ""
## the sub-path within the PersistentVolume to mount, instead of the root
##
subPath: ""
## the name of the StorageClass requested by the PersistentVolumeClaim
## - if set to "", then `PersistentVolumeClaim/spec.storageClassName` is omitted
## - if set to "-", then `PersistentVolumeClaim/spec.storageClassName` is set to ""
##
storageClass: ""
## the access mode of the PersistentVolumeClaim
##
accessMode: ReadWriteOnce
## the initial size for the PersistentVolumeClaim to request
## - if your StorageClass has `allowVolumeExpansion=true`, kubernetes allows the
## PVC to grow in size as needed, starting from this value
##
size: 5Gi
## root user configs for minio
## - [WARNING] it is strongly recommended to enable `generateSecret` or use a custom value
##
rootUser:
username: minioadmin
password: minioadmin
existingSecret: ""
existingSecretUsernameKey: "username"
existingSecretPasswordKey: "password"
generateSecret: false
## service accounts for the root user
## - these service accounts are created and/or updated by a post-install job
## - each element in the list is a map with the following fields:
## - `accessKey`: the access-key for the service account
## - `secretKey`: the secret-key for the service account
## - `existingSecret`: the name of an existing secret containing the access & secret keys
## - `existingSecretAccessKeyKey`: the key in the secret containing the access-key (default: "access_key")
## - `existingSecretSecretKeyKey`: the key in the secret containing the secret-key (default: "secret_key")
## - `generateSecret`: if true, random keys are generated and stored in `existingSecret` (default: false)
## note, `existingSecret` must be set to a unique value for each service account
## note, the job will fail if the secret already exists in the cluster
## - `policy`: the minio policy document as a YAML map, ~not a string~ (default: empty/root-access)
## https://min.io/docs/minio/container/administration/identity-access-management/policy-based-access-control.html
## - [WARNING] if a `policy` is not specified, the service account will have root access
## - [WARNING] unlisted minio service accounts will be removed from minio
## - [WARNING] unlisted kubernetes secrets with this label will be removed from the cluster:
## "deploykf-minio.deploykf.org/generated-minio-root-service-account: true"
##
serviceAccounts: []
## identity configs
##
identity:
## OpenID Connect configs (connects to `deploykf-auth` dex)
##
openid:
## sets `MINIO_IDENTITY_OPENID_CLAIM_NAME`
## - if set to "email", access `policies` are automatically generated for each user
## based on their `access.role` in each profile
##
policyClaim: "email"
## sets `MINIO_IDENTITY_OPENID_SCOPES`
## - NOTE: minio-console does not yet support refresh tokens, so "offline_access" is not used:
## https://github.com/minio/console/issues/2643
scopes: "openid,email,groups,profile,offline_access"
## minio buckets
## - these buckets are created and/or updated by a post-install job
## - each element is a map with the following keys:
## - `name`: the name of the bucket
## - `versioning`: the name of the policy to apply to the bucket
## - if Kubeflow Pipelines is enabled, a bucket named `kubeflow_tools.pipelines.bucket.name`
## is automatically added to this list, with `versioning` disabled
##
buckets: []
## minio access policies
## - [WARNING] existing policies that have "@" in their name will be removed from minio if they are not listed here
## - these policies are created and/or updated by a post-install job
## - each element is a map with the following keys:
## - `name`: the name of the policy
## - `policy`: the minio policy document as a YAML map, ~not a string~
## https://min.io/docs/minio/container/administration/identity-access-management/policy-based-access-control.html
## - if Kubeflow Pipelines is enabled, and `identity.openid.policyClaim` is set to "email",
## policies are automatically generated for each user based on their `access.role` in each profile
##
policies: []
## --------------------------------------
## deploykf-mysql
## --------------------------------------
deploykf_mysql:
enabled: false
namespace: deploykf-mysql
## values overrides
## - [WARNING] it is very easy to break something with this feature
## - a map or string with values to override those generated by deployKF
## - strings can include deployKF templates `{{< ... >}}`
##