values.yaml 31.5 KB
Newer Older
1
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Used to generate top-level secrets (overridden by custom-values.yaml)
16

17
18
19
# Subcharts configuration

# Dynamo operator configuration
20
dynamo-operator:
21
  # -- Whether to enable the Dynamo Kubernetes operator deployment
22
  enabled: true
23
24

  # -- NATS server address for operator communication (leave empty to use the bundled NATS chart). Format: "nats://hostname:port"
25
  natsAddr: ""
26
27

  # -- etcd server address for operator state storage (leave empty to use the bundled etcd chart). Format: "http://hostname:port" or "https://hostname:port"
28
  etcdAddr: ""
29

Biswa Panda's avatar
Biswa Panda committed
30
31
32
33
  nats:
    # -- Whether the NATS is enabled
    enabled: true

34
35
36
  # -- URL for the Model Express server if not deployed by this helm chart. This is ignored if Model Express server is installed by this helm chart (global.model-express.enabled is true).
  modelExpressURL: ""
  # -- Namespace access controls for the operator
37
  namespaceRestriction:
38
39
    # -- Whether to restrict operator to specific namespaces. By default, the operator will run with cluster-wide permissions. Only 1 instance of the operator should be deployed in the cluster. If you want to deploy multiple operator instances, you can set this to true and specify the target namespace (by default, the target namespace is the helm release namespace).
    enabled: false
40
    # -- Target namespace for operator deployment (leave empty for current namespace)
41
    targetNamespace:
42
43
44
45
46
47
48
    # Namespace scope marker lease configuration (used to prevent conflicts when running both cluster-wide and namespace-restricted operators)
    lease:
      # Duration before the namespace scope marker lease expires if not renewed (namespace-restricted mode only). When a namespace-restricted operator is running, it creates a lease in its namespace. The cluster-wide operator detects this lease and excludes that namespace from processing. If the namespace operator stops renewing the lease (e.g., crashes), the lease expires and the cluster-wide operator automatically resumes processing that namespace.
      duration: 30s
      # Interval for renewing the namespace scope marker lease (namespace-restricted mode only). The namespace-restricted operator renews its lease at this interval to signal it's still running.
      renewInterval: 10s

49
50
51
52
53
54
55
  # -- GPU discovery configuration (only applies when namespaceRestriction.enabled=true)
  gpuDiscovery:
    # -- Whether to provision a ClusterRole for the namespace-scoped operator to read GPU node labels.
    # When true (default), Helm creates a ClusterRole/ClusterRoleBinding granting node read access.
    # Set to false if your installer lacks ClusterRole creation permissions.
    enabled: true

56
57
  # -- The Dynamo discovery backend to use. Default is "kubernetes" for Kubernetes API service discovery. Set to "etcd" to use ETCD for discovery. --
  discoveryBackend: "kubernetes"
58
59

  # Controller manager configuration
60
  controllerManager:
61
    # -- Node tolerations for controller manager pods
62
    tolerations: []
63

64
    # -- Affinity for controller manager pods
65
    affinity: {}
66

67
68
69
70
71
72
73
    # Leader election configuration for cluster-wide coordination
    leaderElection:
      # -- Leader election ID for cluster-wide coordination. WARNING: All cluster-wide operators must use the SAME ID to prevent split-brain. Different IDs would allow multiple leaders simultaneously.
      id: ""  # If empty, defaults to: dynamo.nvidia.com (shared across all cluster-wide operators)
      # -- Namespace for leader election leases (only used in cluster-wide mode). If empty, defaults to kube-system for cluster-wide coordination. All cluster-wide operators should use the SAME namespace for proper leader election.
      namespace: ""

74
    manager:
75
      # Container image configuration for the operator manager
76
      image:
77
        # -- Official NVIDIA Dynamo operator image repository
78
        repository: "nvcr.io/nvidia/ai-dynamo/kubernetes-operator"
79
        # -- Image tag (leave empty to use chart default)
80
        tag: ""
81
        # -- Image pull policy - when to pull the image
82
        pullPolicy: IfNotPresent
83
84

      # Command line arguments for the operator manager
85
      args:
86
        # -- Health probe endpoint for Kubernetes health checks
87
        - --health-probe-bind-address=:8081
88
        # -- Metrics endpoint for Prometheus scraping (localhost only for security)
89
        - --metrics-bind-address=127.0.0.1:8080
90
91

  # -- Secrets for pulling private container images
92
  imagePullSecrets: []
93
94

  # Core Dynamo platform configuration
95
  dynamo:
96
    # -- How long to wait before forcefully terminating Grove instances
97
    groveTerminationDelay: 4h
98
99

    # Internal utility images used by the platform
100
    internalImages:
101
      # -- Debugger image for troubleshooting deployments
102
      debugger: python:3.12-slim
103
104

    # -- Whether to enable restricted security contexts for enhanced security
105
    enableRestrictedSecurityContext: false
106
107

    # Docker registry configuration for private repositories
108
    dockerRegistry:
109
      # -- Whether to use Kubernetes secrets for registry authentication
110
      useKubernetesSecret: false
111
      # -- Docker registry server URL
112
      server:
113
      # -- Registry username
114
      username:
115
      # -- Registry password (consider using existingSecretName instead)
116
      password:
117
      # -- Name of existing Kubernetes secret containing registry credentials
118
      existingSecretName:
119
      # -- Whether the registry uses HTTPS
120
      secure: true
121
122

    # Ingress configuration for external access
123
    ingress:
124
      # -- Whether to create ingress resources
125
      enabled: false
126
      # -- Ingress class name (e.g., "nginx", "traefik")
127
      className:
128
      # -- Secret name containing TLS certificates
129
      tlsSecretName: my-tls-secret
130
131

    # Istio service mesh configuration
132
    istio:
133
      # -- Whether to enable Istio integration
134
      enabled: false
135
      # -- Istio gateway name for routing
136
      gateway:
137
138

    # -- Host suffix for generated ingress hostnames
139
    ingressHostSuffix: ""
140
141

    # -- Whether VirtualServices should support HTTPS routing
142
    virtualServiceSupportsHTTPS: false
143

144
145
146
147
148
    # Metrics configuration
    metrics:
      # -- Endpoint that services can use to retrieve metrics. If set, dynamo operator will automatically inject the PROMETHEUS_ENDPOINT environment variable into services it manages. Users can override the value of the PROMETHEUS_ENDPOINT environment variable by modifying the corresponding deployment's environment variables
      prometheusEndpoint: ""

149
150
151
152
153
154
155
156
157
    # MPI Run configuration
    mpiRun:
      # -- Name of the secret containing the SSH key for MPI Run
      secretName: "mpi-run-ssh-secret"
      # SSH key generation configuration
      sshKeygen:
        # -- Whether to enable SSH key generation for MPI Run
        enabled: true

158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
  # Webhook configuration for admission control and validation
  webhook:
    # -- Whether to enable admission webhooks for resource validation. When enabled, the operator will validate DynamoComponentDeployment and DynamoGraphDeployment resources before they are created or updated in the cluster. Enabled by default for production-ready validation and better error reporting.
    enabled: true

    # Certificate configuration for webhook TLS
    certificateSecret:
      # -- Name of the Kubernetes secret containing webhook TLS certificates. The secret must contain three keys: tls.crt (server certificate), tls.key (server private key), and ca.crt (Certificate Authority certificate).
      name: webhook-server-cert

      # -- Whether to manage the certificate secret externally. When false (default), certificates are automatically generated via Helm hooks during installation. When true, you must create the secret manually before installing the chart.
      external: false

    # -- Certificate validity duration in days for auto-generated certificates. Only used when certManager.enabled=false and certificateSecret.external=false. After this duration, certificates will expire and need to be regenerated.
    certificateValidity: 365

    # Container image for certificate generation and CA injection jobs
    # Only used when certManager.enabled=false and certificateSecret.external=false
    certGenerator:
      image:
        # -- Container image repository for certificate generation jobs. This image must contain both openssl and kubectl commands.
        repository: bitnami/kubectl
        # -- Container image tag for certificate generation jobs
        tag: latest
        # -- Image pull policy for certificate generation jobs
        pullPolicy: IfNotPresent

    # -- CA bundle (base64 encoded) for webhook validation. Only used when certificateSecret.external=true. For automatic certificate generation or cert-manager integration, leave this empty as it will be injected automatically.
    caBundle: ""

    # -- Webhook failure policy controls how Kubernetes handles requests when the webhook is unavailable. 'Fail' (recommended for production) rejects requests if the webhook cannot be reached, ensuring strict validation. 'Ignore' allows requests through if the webhook is unavailable, providing availability over validation guarantees.
    failurePolicy: Fail

    # -- Timeout in seconds for webhook validation calls. If the webhook doesn't respond within this time, the request will be handled according to the failurePolicy.
    timeoutSeconds: 10

    # Namespace selector for webhook scope control
    # -- Custom namespace selector for webhook validation. Use this to include or exclude specific namespaces from webhook validation. For CLUSTER-WIDE operators, you can exclude namespaces managed by namespace-restricted operators by using: matchExpressions: [{ key: "dynamo-operator", operator: "NotIn", values: ["namespace-restricted"] }]. For NAMESPACE-RESTRICTED operators, leave empty as it will be auto-configured to match only the operator's namespace.
    namespaceSelector: {}

    # cert-manager integration for automated certificate lifecycle management
    certManager:
      # -- Whether to use cert-manager for automatic certificate management. Requires cert-manager to be installed in the cluster. When enabled, cert-manager will automatically generate, renew, and rotate certificates, and the automatic certificate generation via Helm hooks will be disabled.
      enabled: false

      # Certificate configuration for cert-manager
      certificate:
        # -- Certificate duration for webhook certificates managed by cert-manager (e.g., "8760h" for 1 year). cert-manager will automatically renew the certificate before it expires.
        duration: "8760h"

        # -- Time before certificate expiration to trigger renewal (e.g., "360h" for 15 days). cert-manager will attempt to renew the certificate when this threshold is reached.
        renewBefore: "360h"

        # Root CA configuration for cert-manager
        rootCA:
          # -- Duration for the root CA certificate (e.g., "87600h" for 10 years). The root CA typically has a much longer lifetime than the leaf certificates it signs.
          duration: "87600h"

          # -- Time before root CA expiration to trigger renewal (e.g., "720h" for 30 days). Renewing a CA can be disruptive as all signed certificates must be reissued.
          renewBefore: "720h"

219
220
221
222
223
  # Checkpoint configuration for fast pod restore using CRIU/cuda-checkpoint
  # NOTE: The checkpoint infrastructure (PVC + DaemonSet) must be installed separately
  # using the chrek Helm chart in each namespace where checkpointing is needed.
  checkpoint:
    # -- Whether to enable checkpoint/restore functionality
224
    enabled: false
225

226
227
228
229
230
231
232
233
234
    # -- Image used for init containers in checkpoint jobs (e.g., signal file cleanup)
    initContainerImage: "busybox:latest"

    # -- Path written by worker when model is loaded and ready for checkpointing
    readyForCheckpointFilePath: "/tmp/ready-for-checkpoint"

    # -- Path written by restore-entrypoint after successful CRIU restore
    restoreMarkerFilePath: "/tmp/dynamo-restored"

235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
    # Storage configuration
    # These settings tell the operator where to find checkpoint storage
    # Must match the configuration in the chrek chart
    storage:
      # -- Storage backend type: pvc, s3, or oci
      type: pvc

      # -- Host path for signal files (communication between checkpoint pod and DaemonSet)
      signalHostPath: "/var/lib/chrek/signals"

      # PVC storage configuration (used when type=pvc)
      pvc:
        # -- Name of the PVC created by the chrek chart
        pvcName: "chrek-pvc"
        # -- Base path within the PVC for storing checkpoints
        basePath: "/checkpoints"

      # S3 storage configuration (used when type=s3)
      s3:
        # -- S3 URI in format: s3://[endpoint/]bucket/prefix
        uri: ""
        # -- Reference to a secret containing AWS credentials
        credentialsSecretRef: ""

      # OCI registry storage configuration (used when type=oci)
      oci:
        # -- OCI URI in format: oci://registry/repository
        uri: ""
        # -- Reference to a docker config secret for registry authentication
        credentialsSecretRef: ""

266
267
268
269
# Grove component - distributed inference orchestration
grove:
  # -- Whether to enable Grove for multi-node inference coordination, if enabled, the Grove operator will be deployed cluster-wide
  enabled: false
270
271
272
273
  # -- Node tolerations for Grove pods
  tolerations: []
  # -- Affinity for Grove pods
  affinity: {}
274
275
276
277
278

# Kai Scheduler component - advanced workload scheduling
kai-scheduler:
  # -- Whether to enable Kai Scheduler for intelligent resource allocation, if enabled, the Kai Scheduler operator will be deployed cluster-wide
  enabled: false
279
280
281
282
283
284
  # Global configuration for kai-scheduler (applies to all components including crd-upgrader)
  global:
    # -- Node tolerations for kai-scheduler pods
    tolerations: []
    # -- Affinity for kai-scheduler pods
    affinity: {}
285
286

# etcd configuration - distributed key-value store for operator state
287
etcd:
288

289
  # -- Whether to enable etcd deployment, disable if you want to use an external etcd instance. For complete configuration options, see: https://github.com/bitnami/charts/tree/main/bitnami/etcd , all etcd settings should be prefixed with "etcd."
290
  enabled: true
291

292
  image:
293
    # -- following bitnami announcement for brownout - https://github.com/bitnami/charts/tree/main/bitnami/etcd#%EF%B8%8F-important-notice-upcoming-changes-to-the-bitnami-catalog, we need to use the legacy repository until we migrate to the new "secure" repository
294
    repository: bitnamilegacy/etcd
295
    tag: 3.5.18-debian-12-r5
296

297
  # Persistent storage configuration for etcd data
298
  persistence:
299
    # Whether to enable persistent storage (recommended for production)
300
301
302
    enabled: true
    # Use the cluster default storage-class or override with a named class
    storageClass: null
303
    # Size of persistent volume for etcd data
304
    size: 1Gi
305
306

  # Pre-upgrade job configuration
307
  preUpgradeJob:
308
    # Whether to run pre-upgrade validation jobs
309
    enabled: false
310
311

  # Number of etcd replicas (1 for single-node, 3+ for HA)
312
  replicaCount: 1
313
314
315

  # Authentication and authorization settings
  # Explicitly remove authentication for simplified internal communication
316
317
  auth:
    rbac:
318
      # Whether to create RBAC authentication (disabled for internal use)
319
320
      create: false

321
  # Health check configuration
322
  readinessProbe:
323
    # Whether to enable readiness probes (disabled to reduce startup complexity)
324
325
326
    enabled: false

  livenessProbe:
327
    # Whether to enable liveness probes (disabled to reduce startup complexity)
328
329
    enabled: false

330
331
332
333
334
335
  # Pod Disruption Budget configuration
  # Should be enabled for HA deployments with 3+ replicas
  pdb:
    # Whether to create a PodDisruptionBudget (disabled for single-node deployments)
    create: false

336
  # Node tolerations for etcd pods (allows scheduling on specific nodes)
337
338
  tolerations: []

339
340
341
  # Affinity for etcd pods
  affinity: {}

342
# NATS configuration - messaging system for operator communication
343
nats:
344
  # -- Whether to enable NATS deployment, disable if you want to use an external NATS instance. For complete configuration options, see: https://github.com/nats-io/k8s/tree/main/helm/charts/nats , all nats settings should be prefixed with "nats."
345
  enabled: true
346
347
348
349

  # TLS Certificate Authority configuration for secure communication
  # Reference a common CA Certificate or Bundle in all nats config `tls` blocks and nats-box contexts
  # Note: `tls.verify` still must be set in the appropriate nats config `tls` blocks to require mTLS
350
  tlsCA:
351
    # Whether to enable TLS CA configuration
352
353
    enabled: false

354
  # Core NATS server configuration
355
  config:
356
    # NATS clustering for high availability (multiple NATS servers)
357
    cluster:
358
      # Whether to enable NATS clustering (disabled for single-node setups)
359
360
      enabled: false

361
    # JetStream - persistent messaging and streaming capabilities
362
    jetstream:
363
      # Whether to enable JetStream (recommended for persistent messaging)
364
365
      enabled: true

366
      # File-based storage for JetStream streams and consumers
367
      fileStore:
368
        # Whether to enable file storage (persistent across restarts)
369
        enabled: true
370
        # Directory path for JetStream file storage
371
372
373
        dir: /data

        ############################################################
374
        # Persistent Volume Claim for JetStream file storage
375
376
        ############################################################
        pvc:
377
          # Whether to create a PVC for JetStream storage
378
          enabled: true
379
          # Size of the persistent volume for JetStream data
380
          size: 10Gi
381
          # Storage class name (leave empty for default)
382
383
          storageClassName:

384
          # Advanced PVC configuration (merge additional fields)
385
386
387
          # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#persistentvolumeclaim-v1-core
          merge: {}
          patch: []
388
          # PVC name (defaults to "{{ include "nats.fullname" $ }}-js")
389
390
          name:

391
        # Maximum size for JetStream file storage (defaults to PVC size)
392
393
        maxSize:

394
      # Memory-based storage for JetStream (non-persistent)
395
      memoryStore:
396
        # Whether to enable memory storage (faster but not persistent)
397
398
        enabled: false

399
400
      # Advanced JetStream configuration
      # For options see: https://docs.nats.io/running-a-nats-service/configuration#jetstream
401
402
403
      merge: {}
      patch: []

404
    # Core NATS server settings
405
    nats:
406
      # Port for NATS client connections
407
      port: 4222
408
409

      # TLS configuration for encrypted connections
410
      tls:
411
        # Whether to enable TLS encryption
412
        enabled: false
413
414
        # Advanced TLS configuration
        # For options see: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
415
416
417
        merge: {}
        patch: []

418
    # Leaf nodes for creating NATS topologies and remote connections
419
    leafnodes:
420
      # Whether to enable leaf node connections
421
422
      enabled: false

423
    # WebSocket support for browser-based NATS clients
424
    websocket:
425
      # Whether to enable WebSocket protocol support
426
427
      enabled: false

428
    # MQTT protocol bridge for IoT device connectivity
429
    mqtt:
430
      # Whether to enable MQTT protocol support
431
432
      enabled: false

433
    # Gateway connections for multi-cluster NATS deployments
434
    gateway:
435
      # Whether to enable gateway connections
436
437
      enabled: false

438
    # HTTP monitoring endpoint for NATS server metrics
439
    monitor:
440
      # Whether to enable HTTP monitoring interface
441
      enabled: true
442
      # Port for monitoring HTTP endpoint
443
      port: 8222
444
445

      # TLS configuration for monitoring endpoint
446
      tls:
447
448
        # Whether to enable HTTPS for monitoring (requires config.nats.tls enabled)
        # When enabled, monitoring port will use HTTPS with the options from config.nats.tls
449
450
        enabled: false

451
    # Go pprof profiling endpoint for performance debugging
452
    profiling:
453
      # Whether to enable profiling endpoint (for debugging only)
454
      enabled: false
455
      # Port for profiling endpoint
456
457
      port: 65432

458
    # Account resolver for multi-tenant NATS deployments
459
    resolver:
460
      # Whether to enable account resolution (for advanced multi-tenancy)
461
462
      enabled: false

463
464
465
    # Server naming configuration
    # Adds a prefix to the server name, which defaults to the pod name
    # Helpful for ensuring server name is unique in a super cluster
466
467
    serverNamePrefix: ""

468
469
470
    # Advanced NATS configuration merging and patching
    # For complete options see: https://docs.nats.io/running-a-nats-service/configuration
    # Special rules apply:
471
472
473
474
475
    #  1. strings that start with << and end with >> will be unquoted
    #     use this for variables and numbers with units
    #  2. keys ending in $include will be switched to include directives
    #     keys are sorted alphabetically, use prefix before $includes to control includes ordering
    #     paths should be relative to /etc/nats-config/nats.conf
476
    # Example:
477
478
479
480
481
482
483
484
    #   merge:
    #     $include: ./my-config.conf
    #     zzz$include: ./my-config-last.conf
    #     server_name: nats
    #     authorization:
    #       token: << $TOKEN >>
    #     jetstream:
    #       max_memory_store: << 1GB >>
485
    merge:
486
487
488
      # 15MB to accommodate prompt embeddings: 10MB decoded → ~13.3MB base64-encoded + metadata
      # Also allows larger context: 256K tokens (int32 - 4 bytes each) = 1MB
      max_payload: 15728640
489
490
491
    patch: []

  ############################################################
492
  # NATS container configuration in StatefulSet
493
494
  ############################################################
  container:
495
    # NATS server container image configuration
496
    image:
497
      # Official NATS server repository
498
      repository: nats
499
      # NATS server version (Alpine-based for smaller size)
500
      tag: 2.10.21-alpine
501
      # Image pull policy (leave empty for chart default)
502
      pullPolicy:
503
      # Custom registry URL (leave empty for Docker Hub)
504
505
      registry:

506
507
    # Container port configuration
    # Note: Ports must also be enabled in the config section above
508
509
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#containerport-v1-core
    ports:
510
      # Main NATS client connection port
511
      nats: {}
512
      # Leaf node connection port
513
      leafnodes: {}
514
      # WebSocket connection port
515
      websocket: {}
516
      # MQTT protocol port
517
      mqtt: {}
518
      # Cluster communication port
519
      cluster: {}
520
      # Gateway connection port
521
      gateway: {}
522
      # HTTP monitoring port
523
      monitor: {}
524
      # Go profiling port
525
526
      profiling: {}

527
528
529
    # Environment variables for the NATS container
    # Map with key as env var name, value can be string or map
    # Example:
530
531
532
533
534
535
536
537
538
    #   env:
    #     GOMEMLIMIT: 7GiB
    #     TOKEN:
    #       valueFrom:
    #         secretKeyRef:
    #           name: nats-auth
    #           key: token
    env: {}

539
    # Advanced container configuration merging and patching
540
541
542
543
544
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
    merge: {}
    patch: []

  ############################################################
545
  # Configuration reloader container for hot config updates
546
547
  ############################################################
  reloader:
548
    # Whether to enable the config reloader sidecar container
549
    enabled: true
550
551

    # Config reloader container image
552
    image:
553
      # Official NATS config reloader repository
554
      repository: natsio/nats-server-config-reloader
555
      # Config reloader version
556
      tag: 0.16.0
557
      # Image pull policy (leave empty for chart default)
558
      pullPolicy:
559
      # Custom registry URL (leave empty for Docker Hub)
560
561
      registry:

562
    # Environment variables for the reloader container
563
564
    env: {}

565
566
    # Volume mount prefixes from NATS container to share with reloader
    # All NATS container volume mounts with these prefixes will be mounted into the reloader
567
568
569
    natsVolumeMountPrefixes:
    - /etc/

570
    # Advanced reloader container configuration
571
572
573
574
575
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
    merge: {}
    patch: []

  ############################################################
576
  # Prometheus metrics exporter container (optional)
577
  ############################################################
578
  # Note: config.monitor must be enabled for this to work
579
  promExporter:
580
    # Whether to enable Prometheus metrics exporter sidecar
581
582
583
    enabled: false

  ############################################################
584
  # Kubernetes Service for NATS access
585
586
  ############################################################
  service:
587
    # Whether to create a Kubernetes Service for NATS
588
589
    enabled: true

590
591
592
    # Service port configuration
    # Additional boolean field 'enabled' controls whether port is exposed in the service
    # Note: Ports must also be enabled in the config section above
593
594
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#serviceport-v1-core
    ports:
595
      # Main NATS client connection port
596
597
      nats:
        enabled: true
598
      # Leaf node connection port
599
600
      leafnodes:
        enabled: true
601
      # WebSocket connection port
602
603
      websocket:
        enabled: true
604
      # MQTT protocol port
605
606
      mqtt:
        enabled: true
607
      # Cluster communication port (typically internal only)
608
609
      cluster:
        enabled: false
610
      # Gateway connection port (typically internal only)
611
612
      gateway:
        enabled: false
613
      # HTTP monitoring port (typically internal only)
614
615
      monitor:
        enabled: false
616
      # Go profiling port (typically internal only)
617
618
619
      profiling:
        enabled: false

620
    # Advanced service configuration
621
622
623
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core
    merge: {}
    patch: []
624
    # Service name (defaults to "{{ include "nats.fullname" $ }}")
625
626
627
    name:

  ############################################################
628
  # Advanced NATS Kubernetes resource configuration
629
630
  ############################################################

631
  # StatefulSet configuration for NATS server persistence
632
  statefulSet:
633
    # Advanced StatefulSet configuration merging and patching
634
635
636
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#statefulset-v1-apps
    merge: {}
    patch: []
637
    # StatefulSet name (defaults to "{{ include "nats.fullname" $ }}")
638
639
    name:

640
  # Pod template configuration for NATS StatefulSet
641
  podTemplate:
642
643
    # Whether to add a hash of the ConfigMap as a pod annotation
    # This will cause the StatefulSet to roll when the ConfigMap is updated
644
645
    configChecksumAnnotation: true

646
647
648
649
650
651
652
    # Pod topology spread constraints for better distribution across nodes
    # Map of topologyKey: topologySpreadConstraint
    # labelSelector will be added automatically to match StatefulSet pods
    # Example:
    #   topologySpreadConstraints:
    #     kubernetes.io/hostname:
    #       maxSkew: 1
653
654
    topologySpreadConstraints: {}

655
    # Advanced pod template configuration
656
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#pod-v1-core
657
658
    merge:
      spec:
659
        # Node tolerations for NATS pods (allows scheduling on specific nodes)
660
        tolerations: []
661
662
        # Affinity for NATS pods
        affinity: {}
663
664
    patch: []

665
  # Headless service for StatefulSet pod discovery
666
  headlessService:
667
    # Advanced headless service configuration
668
669
670
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core
    merge: {}
    patch: []
671
    # Headless service name (defaults to "{{ include "nats.fullname" $ }}-headless")
672
673
    name:

674
  # ConfigMap for NATS server configuration
675
  configMap:
676
    # Advanced ConfigMap configuration
677
678
679
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#configmap-v1-core
    merge: {}
    patch: []
680
    # ConfigMap name (defaults to "{{ include "nats.fullname" $ }}-config")
681
682
    name:

683
  # Pod Disruption Budget for controlled rolling updates
684
  podDisruptionBudget:
685
    # Whether to create a PodDisruptionBudget (recommended for production)
686
687
    enabled: true

688
  # Service Account for NATS server pods
689
  serviceAccount:
690
    # Whether to create and use a dedicated service account
691
692
693
    enabled: false

  ############################################################
694
695
  # NATS Box - CLI tools and debugging container
  # NATS Box provides CLI tools for interacting with NATS server
696
697
  ############################################################
  natsBox:
698
    # Whether to deploy NATS Box for CLI access and debugging
699
    enabled: false
700
701

    ############################################################
702
    # NATS client contexts for authentication and connection
703
704
    ############################################################
    contexts:
705
      # Default context configuration
706
      default:
707
        # Credentials-based authentication
708
        creds:
709
          # Inline credentials file contents (base64 encoded)
710
          contents:
711
          # Name of existing secret containing credentials file
712
          secretName:
713
          # Directory to mount credentials (defaults to /etc/nats-creds/<context-name>)
714
          dir:
715
          # Key name in secret for credentials file
716
          key: nats.creds
717
718

        # NKey-based authentication (public/private key pairs)
719
        nkey:
720
          # Inline NKey file contents (base64 encoded)
721
          contents:
722
          # Name of existing secret containing NKey file
723
          secretName:
724
          # Directory to mount NKey (defaults to /etc/nats-nkeys/<context-name>)
725
          dir:
726
          # Key name in secret for NKey file
727
          key: nats.nk
728
729

        # TLS client certificate authentication
730
        tls:
731
          # Name of existing secret containing TLS client certificates
732
          secretName:
733
          # Directory to mount certificates (defaults to /etc/nats-certs/<context-name>)
734
          dir:
735
          # Certificate file name in secret
736
          cert: tls.crt
737
          # Private key file name in secret
738
739
          key: tls.key

740
741
        # Advanced context configuration
        # For options see: https://docs.nats.io/using-nats/nats-tools/nats_cli#nats-contexts
742
743
744
        merge: {}
        patch: []

745
    # Name of context to select by default for NATS CLI operations
746
747
748
    defaultContextName: default

    ############################################################
749
    # NATS Box container configuration
750
751
    ############################################################
    container:
752
      # NATS Box container image
753
      image:
754
        # Official NATS Box repository with CLI tools
755
        repository: natsio/nats-box
756
        # NATS Box version
757
        tag: 0.14.5
758
        # Image pull policy (leave empty for chart default)
759
        pullPolicy:
760
        # Custom registry URL (leave empty for Docker Hub)
761
762
        registry:

763
      # Environment variables for NATS Box container
764
765
      env: {}

766
      # Advanced container configuration
767
768
769
      # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
      merge: {}
      patch: []
770
771

    # Service Account for NATS Box deployment
772
    serviceAccount:
773
      # Whether to create and use a dedicated service account for NATS Box
774
      enabled: false
775

776
    # Pod template configuration for NATS Box deployment
777
778
779
    podTemplate:
      merge:
        spec:
780
          # Node tolerations for NATS Box pods
781
          tolerations: []
782
783
          # Affinity for NATS Box pods
          affinity: {}
784
      patch: []