values.yaml 31 KB
Newer Older
1
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Used to generate top-level secrets (overridden by custom-values.yaml)
16

17
18
19
20
21
22
23
global:
  etcd:
    # -- Whether this chart should install the bundled etcd subchart.
    # When true, deploys etcd and auto-configures the operator with its address.
    # When false, etcd is not deployed. Use dynamo-operator.etcdAddr to point at an external instance if you are bringing your own etcd.
    install: false

24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
  kai-scheduler:
    # -- Whether this chart should install the bundled kai-scheduler subchart.
    # When true, deploys kai-scheduler and its CRDs. Integration is automatically enabled.
    # NOTE: For production environments, it is recommended to install kai-scheduler separately.
    install: false
    # -- Whether to enable Kai Scheduler integration (queue creation, schedulerName injection).
    # Set to true when kai-scheduler is available in the cluster (installed externally).
    # Automatically enabled when install=true. The operator uses this to decide whether to
    # inject schedulerName and queue labels into pod templates.
    enabled: false

  grove:
    # -- Whether this chart should install the bundled Grove subchart.
    # When true, deploys the Grove operator cluster-wide. Integration is automatically enabled.
    # NOTE: For production environments, it is recommended to install Grove separately.
    install: false
    # -- Whether to enable Grove integration (multinode orchestration via PodCliqueSets).
    # Set to true when Grove is available in the cluster (installed externally).
    # Automatically true when install=true. The operator uses this to decide whether to
    # create PodCliqueSets for multinode deployments.
    enabled: false

46
47
48
# Subcharts configuration

# Dynamo operator configuration
49
dynamo-operator:
50
  # -- Whether to enable the Dynamo Kubernetes operator deployment
51
  enabled: true
52

53
54
55
56
  # -- Whether to manage CRDs via a pre-install/pre-upgrade hook Job.
  # The Job runs the operator image with the crd-apply tool to apply CRDs via server-side apply.
  upgradeCRD: true

57
  # -- NATS server address for operator communication (leave empty to use the bundled NATS chart). Format: "nats://hostname:port"
58
  natsAddr: ""
59

60
  # -- etcd server address for an external etcd instance. Only needed when using external etcd without the bundled subchart. Format: "http://hostname:port" or "https://hostname:port"
61
  etcdAddr: ""
62

Biswa Panda's avatar
Biswa Panda committed
63
64
65
66
  nats:
    # -- Whether the NATS is enabled
    enabled: true

67
68
69
  # -- URL for the Model Express server if not deployed by this helm chart. This is ignored if Model Express server is installed by this helm chart (global.model-express.enabled is true).
  modelExpressURL: ""
  # -- Namespace access controls for the operator
70
  namespaceRestriction:
71
72
    # -- Whether to restrict operator to specific namespaces. By default, the operator will run with cluster-wide permissions. Only 1 instance of the operator should be deployed in the cluster. If you want to deploy multiple operator instances, you can set this to true and specify the target namespace (by default, the target namespace is the helm release namespace).
    enabled: false
73
    # -- Target namespace for operator deployment (leave empty for current namespace)
74
    targetNamespace:
75
76
77
78
79
80
81
    # Namespace scope marker lease configuration (used to prevent conflicts when running both cluster-wide and namespace-restricted operators)
    lease:
      # Duration before the namespace scope marker lease expires if not renewed (namespace-restricted mode only). When a namespace-restricted operator is running, it creates a lease in its namespace. The cluster-wide operator detects this lease and excludes that namespace from processing. If the namespace operator stops renewing the lease (e.g., crashes), the lease expires and the cluster-wide operator automatically resumes processing that namespace.
      duration: 30s
      # Interval for renewing the namespace scope marker lease (namespace-restricted mode only). The namespace-restricted operator renews its lease at this interval to signal it's still running.
      renewInterval: 10s

82
83
84
85
86
87
88
  # -- GPU discovery configuration (only applies when namespaceRestriction.enabled=true)
  gpuDiscovery:
    # -- Whether to provision a ClusterRole for the namespace-scoped operator to read GPU node labels.
    # When true (default), Helm creates a ClusterRole/ClusterRoleBinding granting node read access.
    # Set to false if your installer lacks ClusterRole creation permissions.
    enabled: true

89
90
  # -- The Dynamo discovery backend to use. Default is "kubernetes" for Kubernetes API service discovery. Set to "etcd" to use ETCD for discovery. --
  discoveryBackend: "kubernetes"
91
92

  # Controller manager configuration
93
  controllerManager:
94
    # -- Node tolerations for controller manager pods
95
    tolerations: []
96

97
    # -- Affinity for controller manager pods
98
    affinity: {}
99

100
101
102
103
104
105
106
    # Leader election configuration for cluster-wide coordination
    leaderElection:
      # -- Leader election ID for cluster-wide coordination. WARNING: All cluster-wide operators must use the SAME ID to prevent split-brain. Different IDs would allow multiple leaders simultaneously.
      id: ""  # If empty, defaults to: dynamo.nvidia.com (shared across all cluster-wide operators)
      # -- Namespace for leader election leases (only used in cluster-wide mode). If empty, defaults to kube-system for cluster-wide coordination. All cluster-wide operators should use the SAME namespace for proper leader election.
      namespace: ""

107
    manager:
108
      # Container image configuration for the operator manager
109
      image:
110
        # -- Official NVIDIA Dynamo operator image repository
111
        repository: "nvcr.io/nvidia/ai-dynamo/kubernetes-operator"
112
        # -- Image tag (leave empty to use chart default)
113
        tag: ""
114
        # -- Image pull policy - when to pull the image
115
        pullPolicy: IfNotPresent
116
117

      # Command line arguments for the operator manager
118
      args:
119
        # -- Health probe endpoint for Kubernetes health checks
120
        - --health-probe-bind-address=:8081
121
        # -- Metrics endpoint for Prometheus scraping (localhost only for security)
122
        - --metrics-bind-address=127.0.0.1:8080
123
124

  # -- Secrets for pulling private container images
125
  imagePullSecrets: []
126
127

  # Core Dynamo platform configuration
128
  dynamo:
129
    # -- How long to wait before forcefully terminating Grove instances
130
    groveTerminationDelay: 4h
131
132

    # Docker registry configuration for private repositories
133
    dockerRegistry:
134
      # -- Whether to use Kubernetes secrets for registry authentication
135
      useKubernetesSecret: false
136
      # -- Docker registry server URL
137
      server:
138
      # -- Registry username
139
      username:
140
      # -- Registry password (consider using existingSecretName instead)
141
      password:
142
      # -- Name of existing Kubernetes secret containing registry credentials
143
      existingSecretName:
144
      # -- Whether the registry uses HTTPS
145
      secure: true
146
147

    # Ingress configuration for external access
148
    ingress:
149
      # -- Whether to create ingress resources
150
      enabled: false
151
      # -- Ingress class name (e.g., "nginx", "traefik")
152
      className:
153
      # -- Secret name containing TLS certificates
154
      tlsSecretName: my-tls-secret
155
156

    # Istio service mesh configuration
157
    istio:
158
      # -- Whether to enable Istio integration
159
      enabled: false
160
      # -- Istio gateway name for routing
161
      gateway:
162
163

    # -- Host suffix for generated ingress hostnames
164
    ingressHostSuffix: ""
165
166

    # -- Whether VirtualServices should support HTTPS routing
167
    virtualServiceSupportsHTTPS: false
168

169
170
171
172
173
    # Metrics configuration
    metrics:
      # -- Endpoint that services can use to retrieve metrics. If set, dynamo operator will automatically inject the PROMETHEUS_ENDPOINT environment variable into services it manages. Users can override the value of the PROMETHEUS_ENDPOINT environment variable by modifying the corresponding deployment's environment variables
      prometheusEndpoint: ""

174
175
176
177
178
    # MPI Run configuration
    mpiRun:
      # -- Name of the secret containing the SSH key for MPI Run
      secretName: "mpi-run-ssh-secret"

179
180
181
182
183
184
185
  # Webhook configuration for admission control and validation
  webhook:
    # Certificate configuration for webhook TLS
    certificateSecret:
      # -- Name of the Kubernetes secret containing webhook TLS certificates. The secret must contain three keys: tls.crt (server certificate), tls.key (server private key), and ca.crt (Certificate Authority certificate).
      name: webhook-server-cert

186
      # -- Whether to manage the certificate secret externally. When false (default), the operator's built-in cert-controller generates and rotates certificates automatically. When true, you must create the secret manually before installing the chart.
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
      external: false

    # -- CA bundle (base64 encoded) for webhook validation. Only used when certificateSecret.external=true. For automatic certificate generation or cert-manager integration, leave this empty as it will be injected automatically.
    caBundle: ""

    # -- Webhook failure policy controls how Kubernetes handles requests when the webhook is unavailable. 'Fail' (recommended for production) rejects requests if the webhook cannot be reached, ensuring strict validation. 'Ignore' allows requests through if the webhook is unavailable, providing availability over validation guarantees.
    failurePolicy: Fail

    # -- Timeout in seconds for webhook validation calls. If the webhook doesn't respond within this time, the request will be handled according to the failurePolicy.
    timeoutSeconds: 10

    # Namespace selector for webhook scope control
    # -- Custom namespace selector for webhook validation. Use this to include or exclude specific namespaces from webhook validation. For CLUSTER-WIDE operators, you can exclude namespaces managed by namespace-restricted operators by using: matchExpressions: [{ key: "dynamo-operator", operator: "NotIn", values: ["namespace-restricted"] }]. For NAMESPACE-RESTRICTED operators, leave empty as it will be auto-configured to match only the operator's namespace.
    namespaceSelector: {}

    # cert-manager integration for automated certificate lifecycle management
    certManager:
204
      # -- Whether to use cert-manager for automatic certificate management. Requires cert-manager to be installed in the cluster. When enabled, cert-manager will provision and rotate certificates instead of the operator's built-in cert-controller.
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
      enabled: false

      # Certificate configuration for cert-manager
      certificate:
        # -- Certificate duration for webhook certificates managed by cert-manager (e.g., "8760h" for 1 year). cert-manager will automatically renew the certificate before it expires.
        duration: "8760h"

        # -- Time before certificate expiration to trigger renewal (e.g., "360h" for 15 days). cert-manager will attempt to renew the certificate when this threshold is reached.
        renewBefore: "360h"

        # Root CA configuration for cert-manager
        rootCA:
          # -- Duration for the root CA certificate (e.g., "87600h" for 10 years). The root CA typically has a much longer lifetime than the leaf certificates it signs.
          duration: "87600h"

          # -- Time before root CA expiration to trigger renewal (e.g., "720h" for 30 days). Renewing a CA can be disruptive as all signed certificates must be reissued.
          renewBefore: "720h"

223
224
225
226
227
  # Checkpoint configuration for fast pod restore using CRIU/cuda-checkpoint
  # NOTE: The checkpoint infrastructure (PVC + DaemonSet) must be installed separately
  # using the chrek Helm chart in each namespace where checkpointing is needed.
  checkpoint:
    # -- Whether to enable checkpoint/restore functionality
228
    enabled: false
229

230
231
232
    # -- Path written by worker when model is loaded and ready for checkpointing
    readyForCheckpointFilePath: "/tmp/ready-for-checkpoint"

233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
    # Storage configuration
    # These settings tell the operator where to find checkpoint storage
    # Must match the configuration in the chrek chart
    storage:
      # -- Storage backend type: pvc, s3, or oci
      type: pvc

      # PVC storage configuration (used when type=pvc)
      pvc:
        # -- Name of the PVC created by the chrek chart
        pvcName: "chrek-pvc"
        # -- Base path within the PVC for storing checkpoints
        basePath: "/checkpoints"

      # S3 storage configuration (used when type=s3)
      s3:
        # -- S3 URI in format: s3://[endpoint/]bucket/prefix
        uri: ""
        # -- Reference to a secret containing AWS credentials
        credentialsSecretRef: ""

      # OCI registry storage configuration (used when type=oci)
      oci:
        # -- OCI URI in format: oci://registry/repository
        uri: ""
        # -- Reference to a docker config secret for registry authentication
        credentialsSecretRef: ""

261
# Grove component - distributed inference orchestration
262
# Installation is controlled by global.grove.install above.
263
grove:
264
265
266
267
  # -- Node tolerations for Grove pods
  tolerations: []
  # -- Affinity for Grove pods
  affinity: {}
268
269

# Kai Scheduler component - advanced workload scheduling
270
271
# Installation is controlled by global.kai-scheduler.install above.
# Integration is controlled by global.kai-scheduler.enabled above.
272
kai-scheduler:
273
274
275
276
277
278
  # Global configuration for kai-scheduler (applies to all components including crd-upgrader)
  global:
    # -- Node tolerations for kai-scheduler pods
    tolerations: []
    # -- Affinity for kai-scheduler pods
    affinity: {}
279

280
281
# etcd configuration - distributed key-value store
# Installation is controlled by global.etcd.install above.
282
etcd:
283
  image:
284
    # -- following bitnami announcement for brownout - https://github.com/bitnami/charts/tree/main/bitnami/etcd#%EF%B8%8F-important-notice-upcoming-changes-to-the-bitnami-catalog, we need to use the legacy repository until we migrate to the new "secure" repository
285
    repository: bitnamilegacy/etcd
286
    tag: 3.5.18-debian-12-r5
287

288
  # Persistent storage configuration for etcd data
289
  persistence:
290
    # Whether to enable persistent storage (recommended for production)
291
292
293
    enabled: true
    # Use the cluster default storage-class or override with a named class
    storageClass: null
294
    # Size of persistent volume for etcd data
295
    size: 1Gi
296
297

  # Pre-upgrade job configuration
298
  preUpgradeJob:
299
    # Whether to run pre-upgrade validation jobs
300
    enabled: false
301
302

  # Number of etcd replicas (1 for single-node, 3+ for HA)
303
  replicaCount: 1
304
305
306

  # Authentication and authorization settings
  # Explicitly remove authentication for simplified internal communication
307
308
  auth:
    rbac:
309
      # Whether to create RBAC authentication (disabled for internal use)
310
311
      create: false

312
  # Health check configuration
313
  readinessProbe:
314
    # Whether to enable readiness probes (disabled to reduce startup complexity)
315
316
317
    enabled: false

  livenessProbe:
318
    # Whether to enable liveness probes (disabled to reduce startup complexity)
319
320
    enabled: false

321
322
323
324
325
326
  # Pod Disruption Budget configuration
  # Should be enabled for HA deployments with 3+ replicas
  pdb:
    # Whether to create a PodDisruptionBudget (disabled for single-node deployments)
    create: false

327
  # Node tolerations for etcd pods (allows scheduling on specific nodes)
328
329
  tolerations: []

330
331
332
  # Affinity for etcd pods
  affinity: {}

333
# NATS configuration - messaging system for operator communication
334
nats:
335
  # -- Whether to enable NATS deployment, disable if you want to use an external NATS instance. For complete configuration options, see: https://github.com/nats-io/k8s/tree/main/helm/charts/nats , all nats settings should be prefixed with "nats."
336
  enabled: true
337
338
339
340

  # TLS Certificate Authority configuration for secure communication
  # Reference a common CA Certificate or Bundle in all nats config `tls` blocks and nats-box contexts
  # Note: `tls.verify` still must be set in the appropriate nats config `tls` blocks to require mTLS
341
  tlsCA:
342
    # Whether to enable TLS CA configuration
343
344
    enabled: false

345
  # Core NATS server configuration
346
  config:
347
    # NATS clustering for high availability (multiple NATS servers)
348
    cluster:
349
      # Whether to enable NATS clustering (disabled for single-node setups)
350
351
      enabled: false

352
    # JetStream - persistent messaging and streaming capabilities
353
    jetstream:
354
      # Whether to enable JetStream (recommended for persistent messaging)
355
356
      enabled: true

357
      # File-based storage for JetStream streams and consumers
358
      fileStore:
359
        # Whether to enable file storage (persistent across restarts)
360
        enabled: true
361
        # Directory path for JetStream file storage
362
363
364
        dir: /data

        ############################################################
365
        # Persistent Volume Claim for JetStream file storage
366
367
        ############################################################
        pvc:
368
          # Whether to create a PVC for JetStream storage
369
          enabled: true
370
          # Size of the persistent volume for JetStream data
371
          size: 10Gi
372
          # Storage class name (leave empty for default)
373
374
          storageClassName:

375
          # Advanced PVC configuration (merge additional fields)
376
377
378
          # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#persistentvolumeclaim-v1-core
          merge: {}
          patch: []
379
          # PVC name (defaults to "{{ include "nats.fullname" $ }}-js")
380
381
          name:

382
        # Maximum size for JetStream file storage (defaults to PVC size)
383
384
        maxSize:

385
      # Memory-based storage for JetStream (non-persistent)
386
      memoryStore:
387
        # Whether to enable memory storage (faster but not persistent)
388
389
        enabled: false

390
391
      # Advanced JetStream configuration
      # For options see: https://docs.nats.io/running-a-nats-service/configuration#jetstream
392
393
394
      merge: {}
      patch: []

395
    # Core NATS server settings
396
    nats:
397
      # Port for NATS client connections
398
      port: 4222
399
400

      # TLS configuration for encrypted connections
401
      tls:
402
        # Whether to enable TLS encryption
403
        enabled: false
404
405
        # Advanced TLS configuration
        # For options see: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
406
407
408
        merge: {}
        patch: []

409
    # Leaf nodes for creating NATS topologies and remote connections
410
    leafnodes:
411
      # Whether to enable leaf node connections
412
413
      enabled: false

414
    # WebSocket support for browser-based NATS clients
415
    websocket:
416
      # Whether to enable WebSocket protocol support
417
418
      enabled: false

419
    # MQTT protocol bridge for IoT device connectivity
420
    mqtt:
421
      # Whether to enable MQTT protocol support
422
423
      enabled: false

424
    # Gateway connections for multi-cluster NATS deployments
425
    gateway:
426
      # Whether to enable gateway connections
427
428
      enabled: false

429
    # HTTP monitoring endpoint for NATS server metrics
430
    monitor:
431
      # Whether to enable HTTP monitoring interface
432
      enabled: true
433
      # Port for monitoring HTTP endpoint
434
      port: 8222
435
436

      # TLS configuration for monitoring endpoint
437
      tls:
438
439
        # Whether to enable HTTPS for monitoring (requires config.nats.tls enabled)
        # When enabled, monitoring port will use HTTPS with the options from config.nats.tls
440
441
        enabled: false

442
    # Go pprof profiling endpoint for performance debugging
443
    profiling:
444
      # Whether to enable profiling endpoint (for debugging only)
445
      enabled: false
446
      # Port for profiling endpoint
447
448
      port: 65432

449
    # Account resolver for multi-tenant NATS deployments
450
    resolver:
451
      # Whether to enable account resolution (for advanced multi-tenancy)
452
453
      enabled: false

454
455
456
    # Server naming configuration
    # Adds a prefix to the server name, which defaults to the pod name
    # Helpful for ensuring server name is unique in a super cluster
457
458
    serverNamePrefix: ""

459
460
461
    # Advanced NATS configuration merging and patching
    # For complete options see: https://docs.nats.io/running-a-nats-service/configuration
    # Special rules apply:
462
463
464
465
466
    #  1. strings that start with << and end with >> will be unquoted
    #     use this for variables and numbers with units
    #  2. keys ending in $include will be switched to include directives
    #     keys are sorted alphabetically, use prefix before $includes to control includes ordering
    #     paths should be relative to /etc/nats-config/nats.conf
467
    # Example:
468
469
470
471
472
473
474
475
    #   merge:
    #     $include: ./my-config.conf
    #     zzz$include: ./my-config-last.conf
    #     server_name: nats
    #     authorization:
    #       token: << $TOKEN >>
    #     jetstream:
    #       max_memory_store: << 1GB >>
476
    merge:
477
478
479
      # 15MB to accommodate prompt embeddings: 10MB decoded → ~13.3MB base64-encoded + metadata
      # Also allows larger context: 256K tokens (int32 - 4 bytes each) = 1MB
      max_payload: 15728640
480
481
482
    patch: []

  ############################################################
483
  # NATS container configuration in StatefulSet
484
485
  ############################################################
  container:
486
    # NATS server container image configuration
487
    image:
488
      # Official NATS server repository
489
      repository: nats
490
      # NATS server version (Alpine-based for smaller size)
491
      tag: 2.10.21-alpine
492
      # Image pull policy (leave empty for chart default)
493
      pullPolicy:
494
      # Custom registry URL (leave empty for Docker Hub)
495
496
      registry:

497
498
    # Container port configuration
    # Note: Ports must also be enabled in the config section above
499
500
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#containerport-v1-core
    ports:
501
      # Main NATS client connection port
502
      nats: {}
503
      # Leaf node connection port
504
      leafnodes: {}
505
      # WebSocket connection port
506
      websocket: {}
507
      # MQTT protocol port
508
      mqtt: {}
509
      # Cluster communication port
510
      cluster: {}
511
      # Gateway connection port
512
      gateway: {}
513
      # HTTP monitoring port
514
      monitor: {}
515
      # Go profiling port
516
517
      profiling: {}

518
519
520
    # Environment variables for the NATS container
    # Map with key as env var name, value can be string or map
    # Example:
521
522
523
524
525
526
527
528
529
    #   env:
    #     GOMEMLIMIT: 7GiB
    #     TOKEN:
    #       valueFrom:
    #         secretKeyRef:
    #           name: nats-auth
    #           key: token
    env: {}

530
    # Advanced container configuration merging and patching
531
532
533
534
535
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
    merge: {}
    patch: []

  ############################################################
536
  # Configuration reloader container for hot config updates
537
538
  ############################################################
  reloader:
539
    # Whether to enable the config reloader sidecar container
540
    enabled: true
541
542

    # Config reloader container image
543
    image:
544
      # Official NATS config reloader repository
545
      repository: natsio/nats-server-config-reloader
546
      # Config reloader version
547
      tag: 0.16.0
548
      # Image pull policy (leave empty for chart default)
549
      pullPolicy:
550
      # Custom registry URL (leave empty for Docker Hub)
551
552
      registry:

553
    # Environment variables for the reloader container
554
555
    env: {}

556
557
    # Volume mount prefixes from NATS container to share with reloader
    # All NATS container volume mounts with these prefixes will be mounted into the reloader
558
559
560
    natsVolumeMountPrefixes:
    - /etc/

561
    # Advanced reloader container configuration
562
563
564
565
566
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
    merge: {}
    patch: []

  ############################################################
567
  # Prometheus metrics exporter container (optional)
568
  ############################################################
569
  # Note: config.monitor must be enabled for this to work
570
  promExporter:
571
    # Whether to enable Prometheus metrics exporter sidecar
572
573
574
    enabled: false

  ############################################################
575
  # Kubernetes Service for NATS access
576
577
  ############################################################
  service:
578
    # Whether to create a Kubernetes Service for NATS
579
580
    enabled: true

581
582
583
    # Service port configuration
    # Additional boolean field 'enabled' controls whether port is exposed in the service
    # Note: Ports must also be enabled in the config section above
584
585
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#serviceport-v1-core
    ports:
586
      # Main NATS client connection port
587
588
      nats:
        enabled: true
589
      # Leaf node connection port
590
591
      leafnodes:
        enabled: true
592
      # WebSocket connection port
593
594
      websocket:
        enabled: true
595
      # MQTT protocol port
596
597
      mqtt:
        enabled: true
598
      # Cluster communication port (typically internal only)
599
600
      cluster:
        enabled: false
601
      # Gateway connection port (typically internal only)
602
603
      gateway:
        enabled: false
604
      # HTTP monitoring port (typically internal only)
605
606
      monitor:
        enabled: false
607
      # Go profiling port (typically internal only)
608
609
610
      profiling:
        enabled: false

611
    # Advanced service configuration
612
613
614
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core
    merge: {}
    patch: []
615
    # Service name (defaults to "{{ include "nats.fullname" $ }}")
616
617
618
    name:

  ############################################################
619
  # Advanced NATS Kubernetes resource configuration
620
621
  ############################################################

622
  # StatefulSet configuration for NATS server persistence
623
  statefulSet:
624
    # Advanced StatefulSet configuration merging and patching
625
626
627
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#statefulset-v1-apps
    merge: {}
    patch: []
628
    # StatefulSet name (defaults to "{{ include "nats.fullname" $ }}")
629
630
    name:

631
  # Pod template configuration for NATS StatefulSet
632
  podTemplate:
633
634
    # Whether to add a hash of the ConfigMap as a pod annotation
    # This will cause the StatefulSet to roll when the ConfigMap is updated
635
636
    configChecksumAnnotation: true

637
638
639
640
641
642
643
    # Pod topology spread constraints for better distribution across nodes
    # Map of topologyKey: topologySpreadConstraint
    # labelSelector will be added automatically to match StatefulSet pods
    # Example:
    #   topologySpreadConstraints:
    #     kubernetes.io/hostname:
    #       maxSkew: 1
644
645
    topologySpreadConstraints: {}

646
    # Advanced pod template configuration
647
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#pod-v1-core
648
649
    merge:
      spec:
650
        # Node tolerations for NATS pods (allows scheduling on specific nodes)
651
        tolerations: []
652
653
        # Affinity for NATS pods
        affinity: {}
654
655
    patch: []

656
  # Headless service for StatefulSet pod discovery
657
  headlessService:
658
    # Advanced headless service configuration
659
660
661
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core
    merge: {}
    patch: []
662
    # Headless service name (defaults to "{{ include "nats.fullname" $ }}-headless")
663
664
    name:

665
  # ConfigMap for NATS server configuration
666
  configMap:
667
    # Advanced ConfigMap configuration
668
669
670
    # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#configmap-v1-core
    merge: {}
    patch: []
671
    # ConfigMap name (defaults to "{{ include "nats.fullname" $ }}-config")
672
673
    name:

674
  # Pod Disruption Budget for controlled rolling updates
675
  podDisruptionBudget:
676
    # Whether to create a PodDisruptionBudget (recommended for production)
677
678
    enabled: true

679
  # Service Account for NATS server pods
680
  serviceAccount:
681
    # Whether to create and use a dedicated service account
682
683
684
    enabled: false

  ############################################################
685
686
  # NATS Box - CLI tools and debugging container
  # NATS Box provides CLI tools for interacting with NATS server
687
688
  ############################################################
  natsBox:
689
    # Whether to deploy NATS Box for CLI access and debugging
690
    enabled: false
691
692

    ############################################################
693
    # NATS client contexts for authentication and connection
694
695
    ############################################################
    contexts:
696
      # Default context configuration
697
      default:
698
        # Credentials-based authentication
699
        creds:
700
          # Inline credentials file contents (base64 encoded)
701
          contents:
702
          # Name of existing secret containing credentials file
703
          secretName:
704
          # Directory to mount credentials (defaults to /etc/nats-creds/<context-name>)
705
          dir:
706
          # Key name in secret for credentials file
707
          key: nats.creds
708
709

        # NKey-based authentication (public/private key pairs)
710
        nkey:
711
          # Inline NKey file contents (base64 encoded)
712
          contents:
713
          # Name of existing secret containing NKey file
714
          secretName:
715
          # Directory to mount NKey (defaults to /etc/nats-nkeys/<context-name>)
716
          dir:
717
          # Key name in secret for NKey file
718
          key: nats.nk
719
720

        # TLS client certificate authentication
721
        tls:
722
          # Name of existing secret containing TLS client certificates
723
          secretName:
724
          # Directory to mount certificates (defaults to /etc/nats-certs/<context-name>)
725
          dir:
726
          # Certificate file name in secret
727
          cert: tls.crt
728
          # Private key file name in secret
729
730
          key: tls.key

731
732
        # Advanced context configuration
        # For options see: https://docs.nats.io/using-nats/nats-tools/nats_cli#nats-contexts
733
734
735
        merge: {}
        patch: []

736
    # Name of context to select by default for NATS CLI operations
737
738
739
    defaultContextName: default

    ############################################################
740
    # NATS Box container configuration
741
742
    ############################################################
    container:
743
      # NATS Box container image
744
      image:
745
        # Official NATS Box repository with CLI tools
746
        repository: natsio/nats-box
747
        # NATS Box version
748
        tag: 0.14.5
749
        # Image pull policy (leave empty for chart default)
750
        pullPolicy:
751
        # Custom registry URL (leave empty for Docker Hub)
752
753
        registry:

754
      # Environment variables for NATS Box container
755
756
      env: {}

757
      # Advanced container configuration
758
759
760
      # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
      merge: {}
      patch: []
761
762

    # Service Account for NATS Box deployment
763
    serviceAccount:
764
      # Whether to create and use a dedicated service account for NATS Box
765
      enabled: false
766

767
    # Pod template configuration for NATS Box deployment
768
769
770
    podTemplate:
      merge:
        spec:
771
          # Node tolerations for NATS Box pods
772
          tolerations: []
773
774
          # Affinity for NATS Box pods
          affinity: {}
775
      patch: []