Skip to content

Latest commit

 

History

History
94 lines (77 loc) · 5.81 KB

helm-values-documenation.md

File metadata and controls

94 lines (77 loc) · 5.81 KB
Raw

Helm Values Configuration Options

NOTE: Application Gateway for Containers has been released, which introduces numerous performance, resilience, and feature changes. Please consider leveraging Application Gateway for Containers for your next deployment.

Available options

Field Default Description
verbosityLevel 3 Sets the verbosity level of the AGIC logging infrastructure. See Logging Levels for possible values.
reconcilePeriodSeconds Enable periodic reconciliation to checks if the latest gateway configuration is different from what it cached. Range: 30 - 300 seconds. Disabled by default.
appgw.applicationGatewayID Resource Id of the Application Gateway. Example: applicationgatewayd0f0
appgw.subscriptionId Default is agent node pool's subscriptionId derived from CloudProvider config The Azure Subscription ID in which App Gateway resides. Example: a123b234-a3b4-557d-b2df-a0bc12de1234
appgw.resourceGroup Default is agent node pool's resource group derived from CloudProvider config Name of the Azure Resource Group in which App Gateway was created. Example: app-gw-resource-group
appgw.name Name of the Application Gateway. Example: applicationgatewayd0f0
appgw.environment AZUREPUBLICCLOUD Specify which cloud environment. Possbile values: AZURECHINACLOUD, AZUREGERMANCLOUD, AZUREPUBLICCLOUD, AZUREUSGOVERNMENTCLOUD
appgw.shared false This boolean flag should be defaulted to false. Set to true should you need a Shared App Gateway.
appgw.subResourceNamePrefix No prefix if empty Prefix that should be used in the naming of the Application Gateway's sub-resources
kubernetes.watchNamespace Watches all if empty Specify the name space, which AGIC should watch. This could be a single string value, or a comma-separated list of namespaces.
kubernetes.securityContext runAsUser: 0 Specify the pod security context to use with AGIC deployment. By default, AGIC will assume root permission. Jump to Run without root for more information.
kubernetes.containerSecurityContext {} Specify the container security context to use with AGIC deployment.
kubernetes.podAnnotations {} Specify custom annotations for AGIC pod
kubernetes.resources {} Specify resource quota for AGIC pod
kubernetes.nodeSelector {} Scheduling node selector
kubernetes.tolerations [] Scheduling tolerations
kubernetes.affinity {} Scheduling affinity
kubernetes.volumes.extraVolumes {} Specify additional volumes for the AGIC pod. This can be useful when running on a readOnlyRootFilesystem, as AGIC requires a writeable /tmp directory.
kubernetes.volumes.extraVolumeMounts {} Specify additional volume mounts for the AGIC pod. This can be useful when running on a readOnlyRootFilesystem, as AGIC requires a writeable /tmp directory.
kubernetes.ingressClass azure/application-gateway Specify a custom ingress class which will be used to match kubernetes.io/ingress.class in ingress manifest
rbac.enabled false Specify true if kubernetes cluster is rbac enabled
armAuth.type could be aadPodIdentity or servicePrincipal
armAuth.identityResourceID Resource ID of the Azure Managed Identity
armAuth.identityClientId The Client ID of the Identity. See below for more information on Identity
armAuth.secretJSON Only needed when Service Principal Secret type is chosen (when armAuth.type has been set to servicePrincipal)
nodeSelector {} (Legacy: use kubernetes.nodeSelector instead) Scheduling node selector

Example

appgw:
    applicationGatewayID: <application-gateway-resource-id>
    environment: "AZUREUSGOVERNMENTCLOUD" # default: AZUREPUBLICCLOUD

armAuth:
    type: aadPodIdentity
    identityResourceID: <identityResourceId>
    identityClientID:  <identityClientId>

kubernetes:
  nodeSelector: {}
  tolerations: []
  affinity: {}

rbac:
    enabled: false

Run without root

By default, AGIC will assume root permission which allows it to read cloud-provider config and get meta-data information about the cluster. If you want AGIC to run without root access, then make sure that AGIC is installed with at least the following information to run successfully:

appgw:
    applicationGatewayID: <application-gateway-resource-id>
    # OR
    subscriptionId: <subscription-id>
    resourceGroup: <resource-group-name>
    name: <application-gateway-name>

kubernetes:
    securityContext:
        runAsUser: 1000 # appgw-ingress-user

Note: AGIC also uses cloud-provider config to get Node's Virtual Network Name / Subscription and Route table name. If AGIC is not able to reach this information, It will skip assigning the Node's route table to Application Gateway's subnet which is required when using kubenet network plugin. To workaround, this assignment can be performed manually.

Run with read-only root filesystem

To run AGIC with readOnlyRootFilesystem, the following additional configuration items are required:

kubernetes:
    containerSecurityContext:
        readOnlyRootFilesystem: true
    volumes:
        extraVolumes:
        - name: tmp
          emptyDir: {}
        extraVolumeMounts:
        - name: tmp
          mountPath: /tmp

Note: AGIC needs to be able to write to the /tmp directory.