values.schema.json

{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "$comment": "Schema of the values of the proTES chart: app-values.schema.json of the library chart foca-common 0.2.0 (the version that this release requires, with FOCA 0.17; scripts/check_release_pins.py checks that Chart.yaml and Chart.lock pin it), with the app's key (protes, with extraEnv) and Flower (flower) added; update it with the library chart",
  "$defs": {
    "tmpSizeLimit": {
      "type": [
        "string",
        "integer",
        "null"
      ],
      "pattern": "^([0-9]+(\\.[0-9]*)?|\\.[0-9]+)([KMGTPE]i|[mkMGTPE]|[eE][+-]?[0-9]+)?$",
      "not": {
        "type": "string",
        "pattern": "^(0+(\\.0*)?|\\.0+)([KMGTPE]i|[mkMGTPE]|[eE][+-]?[0-9]+)?$",
        "$comment": "Rejects all-zero quantities (Go regular expressions have no lookahead)"
      },
      "minimum": 1,
      "description": "Size limit of the emptyDir at /tmp: a positive Kubernetes quantity (e.g., 64Mi) or number of bytes; none if null"
    },
    "persistence": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "size": {
          "type": "string",
          "pattern": "^([0-9]+(\\.[0-9]*)?|\\.[0-9]+)([KMGTPE]i|[mkMGTPE]|[eE][+-]?[0-9]+)?$",
          "not": {
            "pattern": "^(0+(\\.0*)?|\\.0+)([KMGTPE]i|[mkMGTPE]|[eE][+-]?[0-9]+)?$",
            "$comment": "Rejects all-zero quantities (Go regular expressions have no lookahead)"
          },
          "description": "Size of the PersistentVolumeClaim: a positive Kubernetes quantity (e.g., 1Gi)"
        },
        "accessModes": {
          "type": "array",
          "minItems": 1,
          "items": {
            "enum": [
              "ReadWriteOnce",
              "ReadWriteOncePod",
              "ReadWriteMany"
            ]
          },
          "description": "Access modes of the PersistentVolumeClaim (writable modes only, as the data is written there); ReadWriteOnce if not set"
        },
        "storageClass": {
          "type": "string",
          "description": "Storage class of the PersistentVolumeClaim; the cluster's default class if empty; - disables dynamic provisioning"
        },
        "existingClaim": {
          "type": "string",
          "description": "Existing PersistentVolumeClaim to use instead of the component's own"
        },
        "resourcePolicy": {
          "enum": [
            "",
            "keep"
          ],
          "description": "keep: Helm keeps the component's own PersistentVolumeClaim (and its data) when the release is uninstalled or the claim is removed from it; empty: Helm deletes it"
        }
      },
      "description": "Volume with a component's data: a PersistentVolumeClaim if enabled, otherwise an emptyDir"
    },
    "parentRefs": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name"
        ],
        "additionalProperties": false,
        "properties": {
          "group": {
            "type": "string"
          },
          "kind": {
            "type": "string",
            "minLength": 1
          },
          "namespace": {
            "type": "string",
            "minLength": 1
          },
          "name": {
            "type": "string",
            "minLength": 1
          },
          "sectionName": {
            "type": "string",
            "minLength": 1
          },
          "port": {
            "type": "integer",
            "minimum": 1,
            "maximum": 65535
          }
        }
      },
      "description": "Gateway API parent references (group, kind, namespace, name, sectionName, port), e.g., a Gateway and one of its listeners"
    },
    "app": {
      "type": "object",
      "required": [
        "image",
        "probePath"
      ],
      "properties": {
        "image": {
          "type": "string",
          "minLength": 1,
          "description": "App image repository, optionally with a tag or digest"
        },
        "imagePullPolicy": {
          "enum": [
            "Always",
            "IfNotPresent",
            "Never"
          ],
          "description": "Pull policy of the app image; Always if not set"
        },
        "tag": {
          "type": "string",
          "description": "App image tag; defaults to the chart's appVersion"
        },
        "probePath": {
          "type": "string",
          "pattern": "^/",
          "description": "Path of the app's probes"
        },
        "ingress": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Create an Ingress, for any ingress controller (not with httpRoute.enabled); otherwise an OpenShift Route, if route.enabled, the cluster serves route.openshift.io/v1 and httpRoute is disabled"
            },
            "className": {
              "type": "string",
              "description": "Ingress class; the cluster's default class if empty"
            },
            "annotations": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": {
                "type": [
                  "string",
                  "null"
                ]
              },
              "description": "Annotations of the Ingress, e.g., for the ingress controller (the chart sets none for particular controllers); take precedence over those set by the chart for https, null removes them"
            },
            "https": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "description": "Request a certificate from cert-manager and serve HTTPS"
                },
                "issuer": {
                  "type": "string",
                  "description": "cert-manager ClusterIssuer"
                }
              }
            }
          }
        },
        "httpRoute": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Create a Gateway API HTTPRoute attached to parentRefs (not with ingress.enabled)"
            },
            "annotations": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": {
                "type": "string"
              },
              "description": "Annotations of the HTTPRoute"
            },
            "parentRefs": {
              "allOf": [
                {
                  "$ref": "#/$defs/parentRefs"
                }
              ],
              "description": "Gateways (or listeners, via sectionName or port) that the HTTPRoute attaches to, e.g., the HTTPS listener of a shared Gateway; required if enabled"
            },
            "filters": {
              "type": "array",
              "items": {
                "type": "object",
                "required": [
                  "type"
                ],
                "properties": {
                  "type": {
                    "type": "string",
                    "minLength": 1
                  }
                }
              },
              "description": "Filters of the HTTPRoute's rule (HTTPRouteFilter), e.g., an ExtensionRef to a resource of the Gateway implementation for body size or rate limits"
            },
            "httpsRedirect": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "description": "Create a second HTTPRoute, attached to httpsRedirect.parentRefs, that redirects HTTP to HTTPS (301)"
                },
                "parentRefs": {
                  "allOf": [
                    {
                      "$ref": "#/$defs/parentRefs"
                    }
                  ],
                  "description": "HTTP listeners of the Gateway for the redirect; must not attach to the listeners of httpRoute.parentRefs; required if enabled"
                }
              }
            }
          }
        },
        "route": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Create an OpenShift Route for all paths if neither ingress nor httpRoute is enabled and the cluster serves route.openshift.io/v1; true if not set"
            },
            "annotations": {
              "type": [
                "object",
                "null"
              ],
              "additionalProperties": {
                "type": "string"
              },
              "description": "Annotations of the OpenShift Route, e.g., for rate limits of the router"
            }
          }
        },
        "networkPolicy": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Create a NetworkPolicy allowing connections to the app only from ingressFrom"
            },
            "ingressFrom": {
              "type": "array",
              "items": {
                "type": "object",
                "minProperties": 1,
                "additionalProperties": false,
                "properties": {
                  "podSelector": {
                    "type": "object"
                  },
                  "namespaceSelector": {
                    "type": "object"
                  },
                  "ipBlock": {
                    "type": "object",
                    "required": [
                      "cidr"
                    ],
                    "additionalProperties": false,
                    "properties": {
                      "cidr": {
                        "type": "string",
                        "minLength": 1
                      },
                      "except": {
                        "type": "array",
                        "items": {
                          "type": "string",
                          "minLength": 1
                        }
                      }
                    }
                  }
                },
                "anyOf": [
                  {
                    "required": [
                      "ipBlock"
                    ],
                    "maxProperties": 1
                  },
                  {
                    "not": {
                      "required": [
                        "ipBlock"
                      ]
                    }
                  }
                ]
              },
              "description": "NetworkPolicy peers allowed to connect to the app, e.g., the pods of the ingress controller or Gateway; no defaults, as they depend on the cluster; must not be empty if enabled"
            }
          }
        },
        "podSecurityContext": {
          "type": "object",
          "description": "Security context of the pod (runAsUser, runAsGroup and fsGroup are omitted on OpenShift)"
        },
        "securityContext": {
          "type": "object",
          "description": "Security context of the container (runAsUser and runAsGroup are omitted on OpenShift)"
        },
        "tmpSizeLimit": {
          "$ref": "#/$defs/tmpSizeLimit"
        },
        "preStopSleepSeconds": {
          "type": "integer",
          "minimum": 0,
          "maximum": 300,
          "description": "Seconds that the app keeps serving after its pod is deleted (preStop hook); 0 omits the hook"
        },
        "gunicorn": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "workers",
            "threads",
            "timeout",
            "gracefulTimeout",
            "keepalive",
            "extraArgs"
          ],
          "description": "Settings of Gunicorn, the WSGI server of the app image (via GUNICORN_CMD_ARGS); omit them if the image does not run Gunicorn",
          "properties": {
            "workers": {
              "type": "integer",
              "minimum": 1,
              "maximum": 64,
              "description": "Worker processes; each loads the whole app"
            },
            "threads": {
              "type": "integer",
              "minimum": 1,
              "maximum": 256,
              "description": "Threads per worker"
            },
            "timeout": {
              "type": "integer",
              "minimum": 1,
              "maximum": 3600,
              "description": "Seconds after which workers whose main loop does not respond are restarted (slow requests in threads do not count)"
            },
            "gracefulTimeout": {
              "type": "integer",
              "minimum": 0,
              "maximum": 3600,
              "description": "Seconds that workers get to finish requests on shutdown; the termination grace period is this plus preStopSleepSeconds plus 10 seconds"
            },
            "keepalive": {
              "type": "integer",
              "minimum": 0,
              "maximum": 3600,
              "description": "Seconds after which idle keep-alive connections are closed (0: no keep-alive); longer than the idle timeout of the proxy's connections to the app"
            },
            "extraArgs": {
              "type": "array",
              "items": {
                "type": "string",
                "pattern": "^[^']*$"
              },
              "description": "Further Gunicorn options (no single quotes); --bind/-b, --preload and --graceful-timeout are rejected"
            }
          }
        },
        "resources": {
          "type": "object",
          "description": "Resource requests and limits of the container"
        }
      },
      "description": "Settings of the app container (under the key of the app chart, e.g., cloudRegistry)"
    }
  },
  "type": "object",
  "properties": {
    "nameOverride": {
      "type": "string",
      "description": "Replaces the chart name in resource names and labels; set at installation only"
    },
    "fullnameOverride": {
      "type": "string",
      "description": "Replaces the name of the app resources (MongoDB resources get the suffix -mongodb); set at installation only"
    },
    "hostName": {
      "type": "string",
      "description": "Public host name of the app (of the Ingress, HTTPRoute or Route)"
    },
    "config": {
      "type": [
        "object",
        "null"
      ],
      "description": "App config overriding the base config in the image (merged by FOCA)",
      "properties": {
        "server": {
          "type": [
            "object",
            "null"
          ],
          "properties": {
            "max_content_length": {
              "type": "integer",
              "minimum": 1,
              "description": "Size limit of request bodies, in bytes"
            }
          }
        }
      }
    },
    "mongodb": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Deploy the bundled MongoDB; if false, set config.db.host (and port) of an external one"
        },
        "image": {
          "type": "string",
          "description": "MongoDB image, pinned to a patch version or digest"
        },
        "imagePullPolicy": {
          "enum": [
            "Always",
            "IfNotPresent",
            "Never"
          ],
          "description": "Pull policy of the MongoDB image; Always if not set"
        },
        "auth": {
          "type": "object",
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Require MongoDB credentials"
            },
            "existingSecret": {
              "type": "string",
              "description": "Secret with the MongoDB credentials (keys username and password, and root-username and root-password for the bundled MongoDB); required if authentication is enabled"
            }
          }
        },
        "networkPolicy": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Create a NetworkPolicy allowing connections to MongoDB only from the app's pods"
            }
          }
        },
        "podSecurityContext": {
          "type": "object",
          "description": "Security context of the pod (runAsUser, runAsGroup and fsGroup are omitted on OpenShift)"
        },
        "securityContext": {
          "type": "object",
          "description": "Security context of the container (runAsUser and runAsGroup are omitted on OpenShift)"
        },
        "tmpSizeLimit": {
          "$ref": "#/$defs/tmpSizeLimit"
        },
        "persistence": {
          "allOf": [
            {
              "$ref": "#/$defs/persistence"
            },
            {
              "properties": {
                "enabled": {
                  "description": "Keep MongoDB's data in a PersistentVolumeClaim (also if not set); otherwise in an emptyDir (limited to size, if set), so that the data is lost when its pod is replaced"
                },
                "resourcePolicy": {
                  "description": "keep (also if not set): Helm keeps MongoDB's claim (and the database) when the release is uninstalled or the claim is removed from it, e.g., by disabling persistence (on upgrades, only once a deployed revision has set the annotation); empty: Helm deletes it"
                }
              }
            }
          ],
          "description": "Volume with MongoDB's data"
        },
        "volumeSize": {
          "allOf": [
            {
              "$ref": "#/$defs/tmpSizeLimit"
            }
          ],
          "description": "Deprecated since foca-common 0.2.0 (the setting up to 0.1.0): use persistence.size, which it sets (a positive Kubernetes quantity, e.g., 1Gi, or number of bytes; null to unset it); rendering fails if both are set"
        },
        "resources": {
          "type": "object",
          "description": "Resource requests and limits of the container"
        }
      }
    },
    "worker": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Deploy a Celery worker with the app's image; requires broker.existingSecret"
        },
        "command": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Command of the worker's container; required if enabled"
        },
        "replicas": {
          "type": "integer",
          "minimum": 1,
          "description": "Number of worker pods"
        },
        "readinessProbe": {
          "type": "object",
          "description": "Readiness probe of the worker's container; none if empty"
        },
        "livenessProbe": {
          "type": "object",
          "description": "Liveness probe of the worker's container; none if empty"
        },
        "terminationGracePeriodSeconds": {
          "type": "integer",
          "minimum": 0,
          "description": "Seconds that the worker gets to finish running tasks on shutdown"
        },
        "resources": {
          "type": "object",
          "description": "Resource requests and limits of the container"
        },
        "tmpSizeLimit": {
          "$ref": "#/$defs/tmpSizeLimit"
        }
      }
    },
    "broker": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Deploy RabbitMQ as the Celery broker (queued tasks are kept in a PersistentVolumeClaim, see persistence); requires existingSecret"
        },
        "existingSecret": {
          "type": "string",
          "description": "Secret with the broker URL (key broker-url), optionally the result backend (result-backend) and, for the bundled broker, its user's credentials (username and password); passed to the app and the worker"
        },
        "image": {
          "type": "string",
          "description": "RabbitMQ image, pinned to a patch version or digest"
        },
        "imagePullPolicy": {
          "enum": [
            "Always",
            "IfNotPresent",
            "Never"
          ],
          "description": "Pull policy of the RabbitMQ image; Always if not set"
        },
        "networkPolicy": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Create a NetworkPolicy allowing connections to the broker only from the app's and the worker's pods"
            }
          }
        },
        "podSecurityContext": {
          "type": "object",
          "description": "Security context of the pod (runAsUser, runAsGroup and fsGroup are omitted on OpenShift)"
        },
        "securityContext": {
          "type": "object",
          "description": "Security context of the container (runAsUser and runAsGroup are omitted on OpenShift)"
        },
        "resources": {
          "type": "object",
          "description": "Resource requests and limits of the container"
        },
        "persistence": {
          "allOf": [
            {
              "$ref": "#/$defs/persistence"
            },
            {
              "properties": {
                "enabled": {
                  "description": "Keep the broker's data (queued tasks) in a PersistentVolumeClaim; otherwise (also if not set) in an emptyDir, so that queued tasks are lost when its pod is replaced"
                },
                "resourcePolicy": {
                  "description": "keep: Helm keeps the broker's claim when the release is uninstalled; empty (also if not set): Helm deletes it, as queued tasks can be rebuilt"
                }
              }
            }
          ],
          "description": "Volume with the broker's data (queued tasks)"
        },
        "dataSizeLimit": {
          "allOf": [
            {
              "$ref": "#/$defs/tmpSizeLimit"
            }
          ],
          "description": "Size limit of the emptyDir with the broker's home and, without persistence, its data: a positive Kubernetes quantity (e.g., 1Gi) or number of bytes; none if null"
        },
        "tmpSizeLimit": {
          "$ref": "#/$defs/tmpSizeLimit"
        }
      }
    },
    "protes": {
      "allOf": [
        {
          "$ref": "#/$defs/app"
        },
        {
          "properties": {
            "extraEnv": {
              "type": "array",
              "items": {
                "type": "object",
                "required": [
                  "name"
                ],
                "properties": {
                  "name": {
                    "type": "string",
                    "minLength": 1
                  },
                  "value": {
                    "type": "string"
                  },
                  "valueFrom": {
                    "type": "object"
                  }
                }
              },
              "description": "Environment variables of the app's and the worker's containers (EnvVar), e.g., credentials from Secrets (valueFrom.secretKeyRef); not those set by the chart"
            }
          }
        }
      ]
    },
    "flower": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Deploy Flower, the monitoring UI of the Celery worker; requires existingSecret and broker.existingSecret"
        },
        "existingSecret": {
          "type": "string",
          "description": "Secret with the credentials of Flower's basic authentication (key basic-auth, <user>:<password>); required if enabled"
        },
        "image": {
          "type": "string",
          "minLength": 1,
          "description": "Flower image, pinned to a version or digest"
        },
        "imagePullPolicy": {
          "enum": [
            "Always",
            "IfNotPresent",
            "Never"
          ],
          "description": "Pull policy of the Flower image; Always if not set"
        },
        "networkPolicy": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Create a NetworkPolicy allowing connections to Flower only from ingressFrom"
            },
            "ingressFrom": {
              "type": "array",
              "items": {
                "type": "object",
                "minProperties": 1,
                "additionalProperties": false,
                "properties": {
                  "podSelector": {
                    "type": "object"
                  },
                  "namespaceSelector": {
                    "type": "object"
                  },
                  "ipBlock": {
                    "type": "object",
                    "required": [
                      "cidr"
                    ],
                    "additionalProperties": false,
                    "properties": {
                      "cidr": {
                        "type": "string",
                        "minLength": 1
                      },
                      "except": {
                        "type": "array",
                        "items": {
                          "type": "string",
                          "minLength": 1
                        }
                      }
                    }
                  }
                },
                "anyOf": [
                  {
                    "required": [
                      "ipBlock"
                    ],
                    "maxProperties": 1
                  },
                  {
                    "not": {
                      "required": [
                        "ipBlock"
                      ]
                    }
                  }
                ]
              },
              "description": "NetworkPolicy peers allowed to connect to Flower; none if empty (kubectl port-forward is not affected)"
            }
          }
        },
        "podSecurityContext": {
          "type": "object",
          "description": "Security context of the pod (runAsUser, runAsGroup and fsGroup are omitted on OpenShift)"
        },
        "securityContext": {
          "type": "object",
          "description": "Security context of the container (runAsUser and runAsGroup are omitted on OpenShift)"
        },
        "resources": {
          "type": "object",
          "description": "Resource requests and limits of the container"
        },
        "tmpSizeLimit": {
          "$ref": "#/$defs/tmpSizeLimit"
        }
      }
    }
  }
}