values.yaml 28.8 KB
Newer Older
1
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Used to generate top-level secrets (overridden by custom-values.yaml)
16

17
18
19
# Subcharts configuration

# Dynamo operator configuration
20
dynamo-operator:
21
  # -- Whether to enable the Dynamo Kubernetes operator deployment
22
  enabled: true
23
24

  # -- NATS server address for operator communication (leave empty to use the bundled NATS chart). Format: "nats://hostname:port"
25
  natsAddr: ""
26
27

  # -- etcd server address for operator state storage (leave empty to use the bundled etcd chart). Format: "http://hostname:port" or "https://hostname:port"
28
  etcdAddr: ""
29

Biswa Panda's avatar
Biswa Panda committed
30
31
32
33
  nats:
    # -- Whether the NATS is enabled
    enabled: true

34
35
36
  # -- URL for the Model Express server if not deployed by this helm chart. This is ignored if Model Express server is installed by this helm chart (global.model-express.enabled is true).
  modelExpressURL: ""
  # -- Namespace access controls for the operator
37
  namespaceRestriction:
38
39
    # -- Whether to restrict operator to specific namespaces. By default, the operator will run with cluster-wide permissions. Only 1 instance of the operator should be deployed in the cluster. If you want to deploy multiple operator instances, you can set this to true and specify the target namespace (by default, the target namespace is the helm release namespace).
    enabled: false
40
    # -- Target namespace for operator deployment (leave empty for current namespace)
41
    targetNamespace:
42
43
44
45
46
47
48
    # Namespace scope marker lease configuration (used to prevent conflicts when running both cluster-wide and namespace-restricted operators)
    lease:
      # Duration before the namespace scope marker lease expires if not renewed (namespace-restricted mode only). When a namespace-restricted operator is running, it creates a lease in its namespace. The cluster-wide operator detects this lease and excludes that namespace from processing. If the namespace operator stops renewing the lease (e.g., crashes), the lease expires and the cluster-wide operator automatically resumes processing that namespace.
      duration: 30s
      # Interval for renewing the namespace scope marker lease (namespace-restricted mode only). The namespace-restricted operator renews its lease at this interval to signal it's still running.
      renewInterval: 10s

49
50
  # -- The Dynamo discovery backend to use. Default is "kubernetes" for Kubernetes API service discovery. Set to "etcd" to use ETCD for discovery. --
  discoveryBackend: "kubernetes"
51
52

  # Controller manager configuration
53
  controllerManager:
54
    # -- Node tolerations for controller manager pods
55
    tolerations: []
56

57
    # -- Affinity for controller manager pods
58
    affinity: {}
59

60
61
62
63
64
65
66
    # Leader election configuration for cluster-wide coordination
    leaderElection:
      # -- Leader election ID for cluster-wide coordination. WARNING: All cluster-wide operators must use the SAME ID to prevent split-brain. Different IDs would allow multiple leaders simultaneously.
      id: ""  # If empty, defaults to: dynamo.nvidia.com (shared across all cluster-wide operators)
      # -- Namespace for leader election leases (only used in cluster-wide mode). If empty, defaults to kube-system for cluster-wide coordination. All cluster-wide operators should use the SAME namespace for proper leader election.
      namespace: ""

67
    manager:
68
      # Container image configuration for the operator manager
69
      image:
70
        # -- Official NVIDIA Dynamo operator image repository
71
        repository: "nvcr.io/nvidia/ai-dynamo/kubernetes-operator"
72
        # -- Image tag (leave empty to use chart default)
73
        tag: ""
74
        # -- Image pull policy - when to pull the image
75
        pullPolicy: IfNotPresent
76
77

      # Command line arguments for the operator manager
78
      args:
79
        # -- Health probe endpoint for Kubernetes health checks
80
        - --health-probe-bind-address=:8081
81
        # -- Metrics endpoint for Prometheus scraping (localhost only for security)
82
        - --metrics-bind-address=127.0.0.1:8080
83
84

  # -- Secrets for pulling private container images
85
  imagePullSecrets: []
86
87

  # Core Dynamo platform configuration
88
  dynamo:
89
    # -- How long to wait before forcefully terminating Grove instances
90
    groveTerminationDelay: 4h
91
92

    # Internal utility images used by the platform
93
    internalImages:
94
      # -- Debugger image for troubleshooting deployments
95
      debugger: python:3.12-slim
96
97

    # -- Whether to enable restricted security contexts for enhanced security
98
    enableRestrictedSecurityContext: false
99
100

    # Docker registry configuration for private repositories
101
    dockerRegistry:
102
      # -- Whether to use Kubernetes secrets for registry authentication
103
      useKubernetesSecret: false
104
      # -- Docker registry server URL
105
      server:
106
      # -- Registry username
107
      username:
108
      # -- Registry password (consider using existingSecretName instead)
109
      password:
110
      # -- Name of existing Kubernetes secret containing registry credentials
111
      existingSecretName:
112
      # -- Whether the registry uses HTTPS
113
      secure: true
114
115

    # Ingress configuration for external access
116
    ingress:
117
      # -- Whether to create ingress resources
118
      enabled: false
119
      # -- Ingress class name (e.g., "nginx", "traefik")
120
      className:
121
      # -- Secret name containing TLS certificates
122
      tlsSecretName: my-tls-secret
123
124

    # Istio service mesh configuration
125
    istio:
126
      # -- Whether to enable Istio integration
127
      enabled: false
128
      # -- Istio gateway name for routing
129
      gateway:
130
131

    # -- Host suffix for generated ingress hostnames
132
    ingressHostSuffix: ""
133
134

    # -- Whether VirtualServices should support HTTPS routing
135
    virtualServiceSupportsHTTPS: false
136

137
138
139
140
141
    # Metrics configuration
    metrics:
      # -- Endpoint that services can use to retrieve metrics. If set, dynamo operator will automatically inject the PROMETHEUS_ENDPOINT environment variable into services it manages. Users can override the value of the PROMETHEUS_ENDPOINT environment variable by modifying the corresponding deployment's environment variables
      prometheusEndpoint: ""

142
143
144
145
146
147
148
149
150
    # MPI Run configuration
    mpiRun:
      # -- Name of the secret containing the SSH key for MPI Run
      secretName: "mpi-run-ssh-secret"
      # SSH key generation configuration
      sshKeygen:
        # -- Whether to enable SSH key generation for MPI Run
        enabled: true

151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
  # Webhook configuration for admission control and validation
  webhook:
    # -- Whether to enable admission webhooks for resource validation. When enabled, the operator will validate DynamoComponentDeployment and DynamoGraphDeployment resources before they are created or updated in the cluster. Enabled by default for production-ready validation and better error reporting.
    enabled: true

    # Certificate configuration for webhook TLS
    certificateSecret:
      # -- Name of the Kubernetes secret containing webhook TLS certificates. The secret must contain three keys: tls.crt (server certificate), tls.key (server private key), and ca.crt (Certificate Authority certificate).
      name: webhook-server-cert

      # -- Whether to manage the certificate secret externally. When false (default), certificates are automatically generated via Helm hooks during installation. When true, you must create the secret manually before installing the chart.
      external: false

    # -- Certificate validity duration in days for auto-generated certificates. Only used when certManager.enabled=false and certificateSecret.external=false. After this duration, certificates will expire and need to be regenerated.
    certificateValidity: 365

    # Container image for certificate generation and CA injection jobs
    # Only used when certManager.enabled=false and certificateSecret.external=false
    certGenerator:
      image:
        # -- Container image repository for certificate generation jobs. This image must contain both openssl and kubectl commands.
        repository: bitnami/kubectl
        # -- Container image tag for certificate generation jobs
        tag: latest
        # -- Image pull policy for certificate generation jobs
        pullPolicy: IfNotPresent

    # -- CA bundle (base64 encoded) for webhook validation. Only used when certificateSecret.external=true. For automatic certificate generation or cert-manager integration, leave this empty as it will be injected automatically.
    caBundle: ""

    # -- Webhook failure policy controls how Kubernetes handles requests when the webhook is unavailable. 'Fail' (recommended for production) rejects requests if the webhook cannot be reached, ensuring strict validation. 'Ignore' allows requests through if the webhook is unavailable, providing availability over validation guarantees.
    failurePolicy: Fail

    # -- Timeout in seconds for webhook validation calls. If the webhook doesn't respond within this time, the request will be handled according to the failurePolicy.
    timeoutSeconds: 10

    # Namespace selector for webhook scope control
    # -- Custom namespace selector for webhook validation. Use this to include or exclude specific namespaces from webhook validation. For CLUSTER-WIDE operators, you can exclude namespaces managed by namespace-restricted operators by using: matchExpressions: [{ key: "dynamo-operator", operator: "NotIn", values: ["namespace-restricted"] }]. For NAMESPACE-RESTRICTED operators, leave empty as it will be auto-configured to match only the operator's namespace.
    namespaceSelector: {}

    # cert-manager integration for automated certificate lifecycle management
    certManager:
      # -- Whether to use cert-manager for automatic certificate management. Requires cert-manager to be installed in the cluster. When enabled, cert-manager will automatically generate, renew, and rotate certificates, and the automatic certificate generation via Helm hooks will be disabled.
      enabled: false

      # Certificate configuration for cert-manager
      certificate:
        # -- Certificate duration for webhook certificates managed by cert-manager (e.g., "8760h" for 1 year). cert-manager will automatically renew the certificate before it expires.
        duration: "8760h"

        # -- Time before certificate expiration to trigger renewal (e.g., "360h" for 15 days). cert-manager will attempt to renew the certificate when this threshold is reached.
        renewBefore: "360h"

        # Root CA configuration for cert-manager
        rootCA:
          # -- Duration for the root CA certificate (e.g., "87600h" for 10 years). The root CA typically has a much longer lifetime than the leaf certificates it signs.
          duration: "87600h"

          # -- Time before root CA expiration to trigger renewal (e.g., "720h" for 30 days). Renewing a CA can be disruptive as all signed certificates must be reissued.
          renewBefore: "720h"

212
213
214
215
216
217
218
219
220
221
222
223

# Grove component - distributed inference orchestration
grove:
  # -- Whether to enable Grove for multi-node inference coordination, if enabled, the Grove operator will be deployed cluster-wide
  enabled: false

# Kai Scheduler component - advanced workload scheduling
kai-scheduler:
  # -- Whether to enable Kai Scheduler for intelligent resource allocation, if enabled, the Kai Scheduler operator will be deployed cluster-wide
  enabled: false

# etcd configuration - distributed key-value store for operator state
224
etcd:
225

226
  # -- Whether to enable etcd deployment, disable if you want to use an external etcd instance. For complete configuration options, see: https://github.com/bitnami/charts/tree/main/bitnami/etcd , all etcd settings should be prefixed with "etcd."
227
  enabled: true
228

229
  image:
230
    # -- following bitnami announcement for brownout - https://github.com/bitnami/charts/tree/main/bitnami/etcd#%EF%B8%8F-important-notice-upcoming-changes-to-the-bitnami-catalog, we need to use the legacy repository until we migrate to the new "secure" repository
231
    repository: bitnamilegacy/etcd
232
    tag: 3.5.18-debian-12-r5
233

234
  # Persistent storage configuration for etcd data
235
  persistence:
236
    # Whether to enable persistent storage (recommended for production)
237
238
239
    enabled: true
    # Use the cluster default storage-class or override with a named class
    storageClass: null
240
    # Size of persistent volume for etcd data
241
    size: 1Gi
242
243

  # Pre-upgrade job configuration
244
  preUpgradeJob:
245
    # Whether to run pre-upgrade validation jobs
246
    enabled: false
247
248

  # Number of etcd replicas (1 for single-node, 3+ for HA)
249
  replicaCount: 1
250
251
252

  # Authentication and authorization settings
  # Explicitly remove authentication for simplified internal communication
253
254
  auth:
    rbac:
255
      # Whether to create RBAC authentication (disabled for internal use)
256
257
      create: false

258
  # Health check configuration
259
  readinessProbe:
260
    # Whether to enable readiness probes (disabled to reduce startup complexity)
261
262
263
    enabled: false

  livenessProbe:
264
    # Whether to enable liveness probes (disabled to reduce startup complexity)
265
266
    enabled: false

267
268
269
270
271
272
  # Pod Disruption Budget configuration
  # Should be enabled for HA deployments with 3+ replicas
  pdb:
    # Whether to create a PodDisruptionBudget (disabled for single-node deployments)
    create: false

273
  # Node tolerations for etcd pods (allows scheduling on specific nodes)
274
275
  tolerations: []

276
# NATS configuration - messaging system for operator communication
277
nats:
278
  # -- Whether to enable NATS deployment, disable if you want to use an external NATS instance. For complete configuration options, see: https://github.com/nats-io/k8s/tree/main/helm/charts/nats , all nats settings should be prefixed with "nats."
279
  enabled: true
280
281
282
283

  # TLS Certificate Authority configuration for secure communication
  # Reference a common CA Certificate or Bundle in all nats config `tls` blocks and nats-box contexts
  # Note: `tls.verify` still must be set in the appropriate nats config `tls` blocks to require mTLS
284
  tlsCA:
285
    # Whether to enable TLS CA configuration
286
287
    enabled: false

288
  # Core NATS server configuration
289
  config:
290
    # NATS clustering for high availability (multiple NATS servers)
291
    cluster:
292
      # Whether to enable NATS clustering (disabled for single-node setups)
293
294
      enabled: false

295
    # JetStream - persistent messaging and streaming capabilities
296
    jetstream:
297
      # Whether to enable JetStream (recommended for persistent messaging)
298
299
      enabled: true

300
      # File-based storage for JetStream streams and consumers
301
      fileStore:
302
        # Whether to enable file storage (persistent across restarts)
303
        enabled: true
304
        # Directory path for JetStream file storage
305
306
307
        dir: /data

        ############################################################
308
        # Persistent Volume Claim for JetStream file storage
309
310
        ############################################################
        pvc:
311
          # Whether to create a PVC for JetStream storage
312
          enabled: true
313
          # Size of the persistent volume for JetStream data
314
          size: 10Gi
315
          # Storage class name (leave empty for default)
316
317
          storageClassName:

318
          # Advanced PVC configuration (merge additional fields)
319
320
321
          # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#persistentvolumeclaim-v1-core
          merge: {}
          patch: []
322
          # PVC name (defaults to "{{ include "nats.fullname" $ }}-js")
323
324
          name:

325
        # Maximum size for JetStream file storage (defaults to PVC size)
326
327
        maxSize:

328
      # Memory-based storage for JetStream (non-persistent)
329
      memoryStore:
330
        # Whether to enable memory storage (faster but not persistent)
331
332
        enabled: false

333
334
      # Advanced JetStream configuration
      # For options see: https://docs.nats.io/running-a-nats-service/configuration#jetstream
335
336
337
      merge: {}
      patch: []

338
    # Core NATS server settings
339
    nats:
340
      # Port for NATS client connections
341
      port: 4222
342
343

      # TLS configuration for encrypted connections
344
      tls:
345
        # Whether to enable TLS encryption
346
        enabled: false
347
348
        # Advanced TLS configuration
        # For options see: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
349
350
351
        merge: {}
        patch: []

352
    # Leaf nodes for creating NATS topologies and remote connections
353
    leafnodes:
354
      # Whether to enable leaf node connections
355
356
      enabled: false

357
    # WebSocket support for browser-based NATS clients
358
    websocket:
359
      # Whether to enable WebSocket protocol support
360
361
      enabled: false

362
    # MQTT protocol bridge for IoT device connectivity
363
    mqtt:
364
      # Whether to enable MQTT protocol support
365
366
      enabled: false

367
    # Gateway connections for multi-cluster NATS deployments
368
    gateway:
369
      # Whether to enable gateway connections
370
371
      enabled: false

372
    # HTTP monitoring endpoint for NATS server metrics
373
    monitor:
374
      # Whether to enable HTTP monitoring interface
375
      enabled: true
376
      # Port for monitoring HTTP endpoint
377
      port: 8222
378
379

      # TLS configuration for monitoring endpoint
380
      tls:
381
382
        # Whether to enable HTTPS for monitoring (requires config.nats.tls enabled)
        # When enabled, monitoring port will use HTTPS with the options from config.nats.tls
383
384
        enabled: false

385
    # Go pprof profiling endpoint for performance debugging
386
    profiling:
387
      # Whether to enable profiling endpoint (for debugging only)
388
      enabled: false
389
      # Port for profiling endpoint
390
391
      port: 65432

392
    # Account resolver for multi-tenant NATS deployments
393
    resolver:
394
      # Whether to enable account resolution (for advanced multi-tenancy)
395
396
      enabled: false

397
398
399
    # Server naming configuration
    # Adds a prefix to the server name, which defaults to the pod name
    # Helpful for ensuring server name is unique in a super cluster
400
401
    serverNamePrefix: ""

402
403
404
    # Advanced NATS configuration merging and patching
    # For complete options see: https://docs.nats.io/running-a-nats-service/configuration
    # Special rules apply:
405
406
407
408
409
    #  1. strings that start with << and end with >> will be unquoted
    #     use this for variables and numbers with units
    #  2. keys ending in $include will be switched to include directives
    #     keys are sorted alphabetically, use prefix before $includes to control includes ordering
    #     paths should be relative to /etc/nats-config/nats.conf
410
    # Example:
411
412
413
414
415
416
417
418
    #   merge:
    #     $include: ./my-config.conf
    #     zzz$include: ./my-config-last.conf
    #     server_name: nats
    #     authorization:
    #       token: << $TOKEN >>
    #     jetstream:
    #       max_memory_store: << 1GB >>
419
    merge:
420
421
422
      # 15MB to accommodate prompt embeddings: 10MB decoded → ~13.3MB base64-encoded + metadata
      # Also allows larger context: 256K tokens (int32 - 4 bytes each) = 1MB
      max_payload: 15728640
423
424
425
    patch: []

  ############################################################
426
  # NATS container configuration in StatefulSet
427
428
  ############################################################
  container:
429
    # NATS server container image configuration
430
    image:
431
      # Official NATS server repository
432
      repository: nats
433
      # NATS server version (Alpine-based for smaller size)
434
      tag: 2.10.21-alpine
435
      # Image pull policy (leave empty for chart default)
436
      pullPolicy:
437
      # Custom registry URL (leave empty for Docker Hub)
438
439
      registry:

440
441
    # Container port configuration
    # Note: Ports must also be enabled in the config section above
442
443
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#containerport-v1-core
    ports:
444
      # Main NATS client connection port
445
      nats: {}
446
      # Leaf node connection port
447
      leafnodes: {}
448
      # WebSocket connection port
449
      websocket: {}
450
      # MQTT protocol port
451
      mqtt: {}
452
      # Cluster communication port
453
      cluster: {}
454
      # Gateway connection port
455
      gateway: {}
456
      # HTTP monitoring port
457
      monitor: {}
458
      # Go profiling port
459
460
      profiling: {}

461
462
463
    # Environment variables for the NATS container
    # Map with key as env var name, value can be string or map
    # Example:
464
465
466
467
468
469
470
471
472
    #   env:
    #     GOMEMLIMIT: 7GiB
    #     TOKEN:
    #       valueFrom:
    #         secretKeyRef:
    #           name: nats-auth
    #           key: token
    env: {}

473
    # Advanced container configuration merging and patching
474
475
476
477
478
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
    merge: {}
    patch: []

  ############################################################
479
  # Configuration reloader container for hot config updates
480
481
  ############################################################
  reloader:
482
    # Whether to enable the config reloader sidecar container
483
    enabled: true
484
485

    # Config reloader container image
486
    image:
487
      # Official NATS config reloader repository
488
      repository: natsio/nats-server-config-reloader
489
      # Config reloader version
490
      tag: 0.16.0
491
      # Image pull policy (leave empty for chart default)
492
      pullPolicy:
493
      # Custom registry URL (leave empty for Docker Hub)
494
495
      registry:

496
    # Environment variables for the reloader container
497
498
    env: {}

499
500
    # Volume mount prefixes from NATS container to share with reloader
    # All NATS container volume mounts with these prefixes will be mounted into the reloader
501
502
503
    natsVolumeMountPrefixes:
    - /etc/

504
    # Advanced reloader container configuration
505
506
507
508
509
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
    merge: {}
    patch: []

  ############################################################
510
  # Prometheus metrics exporter container (optional)
511
  ############################################################
512
  # Note: config.monitor must be enabled for this to work
513
  promExporter:
514
    # Whether to enable Prometheus metrics exporter sidecar
515
516
517
    enabled: false

  ############################################################
518
  # Kubernetes Service for NATS access
519
520
  ############################################################
  service:
521
    # Whether to create a Kubernetes Service for NATS
522
523
    enabled: true

524
525
526
    # Service port configuration
    # Additional boolean field 'enabled' controls whether port is exposed in the service
    # Note: Ports must also be enabled in the config section above
527
528
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#serviceport-v1-core
    ports:
529
      # Main NATS client connection port
530
531
      nats:
        enabled: true
532
      # Leaf node connection port
533
534
      leafnodes:
        enabled: true
535
      # WebSocket connection port
536
537
      websocket:
        enabled: true
538
      # MQTT protocol port
539
540
      mqtt:
        enabled: true
541
      # Cluster communication port (typically internal only)
542
543
      cluster:
        enabled: false
544
      # Gateway connection port (typically internal only)
545
546
      gateway:
        enabled: false
547
      # HTTP monitoring port (typically internal only)
548
549
      monitor:
        enabled: false
550
      # Go profiling port (typically internal only)
551
552
553
      profiling:
        enabled: false

554
    # Advanced service configuration
555
556
557
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core
    merge: {}
    patch: []
558
    # Service name (defaults to "{{ include "nats.fullname" $ }}")
559
560
561
    name:

  ############################################################
562
  # Advanced NATS Kubernetes resource configuration
563
564
  ############################################################

565
  # StatefulSet configuration for NATS server persistence
566
  statefulSet:
567
    # Advanced StatefulSet configuration merging and patching
568
569
570
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#statefulset-v1-apps
    merge: {}
    patch: []
571
    # StatefulSet name (defaults to "{{ include "nats.fullname" $ }}")
572
573
    name:

574
  # Pod template configuration for NATS StatefulSet
575
  podTemplate:
576
577
    # Whether to add a hash of the ConfigMap as a pod annotation
    # This will cause the StatefulSet to roll when the ConfigMap is updated
578
579
    configChecksumAnnotation: true

580
581
582
583
584
585
586
    # Pod topology spread constraints for better distribution across nodes
    # Map of topologyKey: topologySpreadConstraint
    # labelSelector will be added automatically to match StatefulSet pods
    # Example:
    #   topologySpreadConstraints:
    #     kubernetes.io/hostname:
    #       maxSkew: 1
587
588
    topologySpreadConstraints: {}

589
    # Advanced pod template configuration
590
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#pod-v1-core
591
592
    merge:
      spec:
593
        # Node tolerations for NATS pods (allows scheduling on specific nodes)
594
        tolerations: []
595
596
    patch: []

597
  # Headless service for StatefulSet pod discovery
598
  headlessService:
599
    # Advanced headless service configuration
600
601
602
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core
    merge: {}
    patch: []
603
    # Headless service name (defaults to "{{ include "nats.fullname" $ }}-headless")
604
605
    name:

606
  # ConfigMap for NATS server configuration
607
  configMap:
608
    # Advanced ConfigMap configuration
609
610
611
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#configmap-v1-core
    merge: {}
    patch: []
612
    # ConfigMap name (defaults to "{{ include "nats.fullname" $ }}-config")
613
614
    name:

615
  # Pod Disruption Budget for controlled rolling updates
616
  podDisruptionBudget:
617
    # Whether to create a PodDisruptionBudget (recommended for production)
618
619
    enabled: true

620
  # Service Account for NATS server pods
621
  serviceAccount:
622
    # Whether to create and use a dedicated service account
623
624
625
    enabled: false

  ############################################################
626
627
  # NATS Box - CLI tools and debugging container
  # NATS Box provides CLI tools for interacting with NATS server
628
629
  ############################################################
  natsBox:
630
    # Whether to deploy NATS Box for CLI access and debugging
631
    enabled: false
632
633

    ############################################################
634
    # NATS client contexts for authentication and connection
635
636
    ############################################################
    contexts:
637
      # Default context configuration
638
      default:
639
        # Credentials-based authentication
640
        creds:
641
          # Inline credentials file contents (base64 encoded)
642
          contents:
643
          # Name of existing secret containing credentials file
644
          secretName:
645
          # Directory to mount credentials (defaults to /etc/nats-creds/<context-name>)
646
          dir:
647
          # Key name in secret for credentials file
648
          key: nats.creds
649
650

        # NKey-based authentication (public/private key pairs)
651
        nkey:
652
          # Inline NKey file contents (base64 encoded)
653
          contents:
654
          # Name of existing secret containing NKey file
655
          secretName:
656
          # Directory to mount NKey (defaults to /etc/nats-nkeys/<context-name>)
657
          dir:
658
          # Key name in secret for NKey file
659
          key: nats.nk
660
661

        # TLS client certificate authentication
662
        tls:
663
          # Name of existing secret containing TLS client certificates
664
          secretName:
665
          # Directory to mount certificates (defaults to /etc/nats-certs/<context-name>)
666
          dir:
667
          # Certificate file name in secret
668
          cert: tls.crt
669
          # Private key file name in secret
670
671
          key: tls.key

672
673
        # Advanced context configuration
        # For options see: https://docs.nats.io/using-nats/nats-tools/nats_cli#nats-contexts
674
675
676
        merge: {}
        patch: []

677
    # Name of context to select by default for NATS CLI operations
678
679
680
    defaultContextName: default

    ############################################################
681
    # NATS Box container configuration
682
683
    ############################################################
    container:
684
      # NATS Box container image
685
      image:
686
        # Official NATS Box repository with CLI tools
687
        repository: natsio/nats-box
688
        # NATS Box version
689
        tag: 0.14.5
690
        # Image pull policy (leave empty for chart default)
691
        pullPolicy:
692
        # Custom registry URL (leave empty for Docker Hub)
693
694
        registry:

695
      # Environment variables for NATS Box container
696
697
      env: {}

698
      # Advanced container configuration
699
700
701
      # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
      merge: {}
      patch: []
702
703

    # Service Account for NATS Box deployment
704
    serviceAccount:
705
      # Whether to create and use a dedicated service account for NATS Box
706
      enabled: false
707

708
    # Pod template configuration for NATS Box deployment
709
710
711
    podTemplate:
      merge:
        spec:
712
          # Node tolerations for NATS Box pods
713
714
          tolerations: []
      patch: []