opensearch-operator

nameOverride: ""

fullnameOverride: ""

podAnnotations: {}

podLabels: {}

nodeSelector: {}

tolerations: []

securityContext:

runAsNonRoot: true

priorityClassName: ""

manager:

securityContext:

allowPrivilegeEscalation: false

extraEnv: []

resources:

limits:

cpu: 1000m

memory: 500Mi

requests:

cpu: 200m

memory: 350Mi

livenessProbe:

failureThreshold: 3

httpGet:

path: /healthz

port: 8081

periodSeconds: 15

successThreshold: 1

timeoutSeconds: 3

initialDelaySeconds: 10

readinessProbe:

failureThreshold: 3

httpGet:

path: /readyz

port: 8081

periodSeconds: 15

successThreshold: 1

timeoutSeconds: 3

initialDelaySeconds: 10

# Set this to true to enable the standard go pprof endpoints on port 6060 (https://pkg.go.dev/net/http/pprof)

# Should only be used for debugging purposes

pprofEndpointsEnabled: false

image:

repository: cgr.dev/chainguard-private/opensearch-k8s-operator-fips

## tag default uses appVersion from Chart.yaml, to override specify tag tag: "v1.1"

tag: 3.0.0-r1@sha256:dc3afa280e952d7c77ddbdc0f368df460f84a5dc56e64eac8ba65d5850d14512

pullPolicy: "Always"

## Optional array of imagePullSecrets containing private registry credentials

imagePullSecrets: []

# - name: secretName

dnsBase: cluster.local

# Log level of the operator. Possible values: debug, info, warn, error

loglevel: info

# If a watchNamespace is specified, the manager's cache will be restricted to

# watch objects in the desired namespace. Defaults is to watch all namespaces.

# To watch multiple namespaces, separate them by commas, or define it as a list.

# Examples:

# watchNamespace: ns1,ns2

# watchNamespace: [ns1, ns2]

watchNamespace:

# -- Global default max concurrent reconciles for all controllers.

maxConcurrentReconciles: 1

# -- Per-controller overrides (controller name -> max concurrent reconciles). Example: `{opensearchcluster: 4}`.

maxConcurrentReconcilesPerController: {}

metricsBindAddress: 127.0.0.1:8080

# Install the Custom Resource Definitions with Helm

installCRDs: true

legacyAPI:

# -- Enable support for the deprecated `opensearch.opster.io/v1` API group. When false, deprecated CRDs, webhooks, RBAC rules, and manager watches are skipped.

enabled: true

serviceAccount:

# Specifies whether a service account should be created

create: true

# The name of the service account to use.

# If not set and create is true, a name is generated using the fullname template

name: ""

# kubeRbacProxy has been replaced with controller-runtime's built-in

# WithAuthenticationAndAuthorization for metrics endpoint protection.

# This provides equivalent security functionality without external dependencies.

#

# kubeRbacProxy:

# enable: false

## If this is set to true, RoleBindings will be used instead of ClusterRoleBindings, in order to restrict permissions

## to the namespace where the operator and OpenSearch cluster are deployed. In that case, specify the namespace in the

## manager.watchNamespace field.

##

## When useRoleBindings is true:

## - Manager and proxy roles will be created as namespace-scoped Roles instead of ClusterRoles

## - The metrics ClusterRole will NOT be created, as nonResourceURLs (like /metrics) cannot be used in namespace-scoped Roles

## - The operator's /metrics endpoint is exposed via kube-apiserver and requires authentication (TokenReviews) and

## authorization (SubjectAccessReviews). If you need to access metrics with monitoring tools, you must create the

## appropriate ClusterRole and ClusterRoleBinding manually

##

## If false (default), ClusterRoleBindings will be used and the metrics ClusterRole will be created

useRoleBindings: false

# Webhook configuration

webhook:

# Enable validation webhooks

enabled: true

# Port exposed by the webhook server container

port: 9443

# Failure policy for webhooks. Options: Fail, Ignore

failurePolicy: Fail

# Secret name for webhook TLS certificates (used when certManager.enabled is false)

# Defaults to: <release-name>-opensearch-operator-webhook-server-cert

# If certManager is disabled, you must manually create this secret with:

# - tls.crt: The TLS certificate

# - tls.key: The TLS private key

# - ca.crt: The CA certificate (optional, for client verification)

# The certificate should be valid for:

# - <release-name>-opensearch-operator-webhook-service.<namespace>.svc

# - <release-name>-opensearch-operator-webhook-service.<namespace>.svc.cluster.local

secretName: ""

# Cert-manager configuration for webhook certificates

certManager:

# Enable cert-manager for automatic certificate management

# If set to false, you must manually create the TLS secret (see webhook.secretName above)

enabled: true