charts_v1alpha1_kong_cr.yaml

apiVersion: charts.konghq.com/v1alpha1
kind: Kong
metadata:
  name: example-kong
spec:
  # Default values for Kong's Helm Chart.
  # Declare variables to be passed into your templates.
  #
  # Sections:
  # - Deployment parameters
  # - Kong parameters
  # - Ingress Controller parameters
  # - Postgres sub-chart parameters
  # - Miscellaneous parameters
  # - Kong Enterprise parameters
  
  # -----------------------------------------------------------------------------
  # Deployment parameters
  # -----------------------------------------------------------------------------
  
  deployment:
    kong:
      # Enable or disable Kong itself
      # Setting this to false with ingressController.enabled=true will create a
      # controller-only release.
      enabled: true
    ## Specify the service account to create and to be assigned to the deployment / daemonset and for th migrations
    serviceAccount:
      create: true
    ## Optionally specify the name of the service account to create and the annotations to add.
    #  name:
    #  annotations: {}
  
    ## Optionally specify any extra sidecar containers to be included in the deployment
    ## See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#container-v1-core
    # sidecarContainers:
    #   - name: sidecar
    #     image: sidecar:latest
    # initContainers:
    # - name: initcon
    #   image: initcon:latest
    # hostAliases:
    # - ip: "127.0.0.1"
    #   hostnames:
    #   - "foo.local"
    #   - "bar.local"
    # userDefinedVolumes:
    # - name: "volumeName"
    #   emptyDir: {}
    # userDefinedVolumeMounts:
    # - name: "volumeName"
    #   mountPath: "/opt/user/dir/mount"
    test:
      # Enable creation of test resources for use with "helm test"
      enabled: false
    # Use a DaemonSet controller instead of a Deployment controller
    daemonset: false
  
  # Override namepsace for Kong chart resources. By default, the chart creates resources in the release namespace.
  # This may not be desirable when using this chart as a dependency.
  # namespace: "example"
  
  # -----------------------------------------------------------------------------
  # Kong parameters
  # -----------------------------------------------------------------------------
  
  # Specify Kong configuration
  # This chart takes all entries defined under `.env` and transforms them into into `KONG_*`
  # environment variables for Kong containers.
  # Their names here should match the names used in https://github.com/Kong/kong/blob/master/kong.conf.default
  # See https://docs.konghq.com/latest/configuration also for additional details
  # Values here take precedence over values from other sections of values.yaml,
  # e.g. setting pg_user here will override the value normally set when postgresql.enabled
  # is set below. In general, you should not set values here if they are set elsewhere.
  env:
    database: "off"
    nginx_worker_processes: "2"
    proxy_access_log: /dev/stdout
    admin_access_log: /dev/stdout
    admin_gui_access_log: /dev/stdout
    portal_api_access_log: /dev/stdout
    proxy_error_log: /dev/stderr
    admin_error_log: /dev/stderr
    admin_gui_error_log: /dev/stderr
    portal_api_error_log: /dev/stderr
    prefix: /kong_prefix/
  
  # This section can be used to configure some extra labels that will be added to each Kubernetes object generated.
  extraLabels: {}
  
  # Specify Kong's Docker image and repository details here
  image:
    repository: kong
    tag: "2.5"
    # Kong Enterprise
    # repository: kong/kong-gateway
    # tag: "2.5.0.0-alpine"
  
    pullPolicy: IfNotPresent
    ## Optionally specify an array of imagePullSecrets.
    ## Secrets must be manually created in the namespace.
    ## If using the official Kong Enterprise registry above, you MUST provide a secret.
    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
    ##
    # pullSecrets:
    #   - myRegistrKeySecretName
  
  # Specify Kong admin API service and listener configuration
  admin:
    # Enable creating a Kubernetes service for the admin API
    # Disabling this is recommended for most ingress controller configurations
    # Enterprise users that wish to use Kong Manager with the controller should enable this
    enabled: false
    type: NodePort
    # To specify annotations or labels for the admin service, add them to the respective
    # "annotations" or "labels" dictionaries below.
    annotations: {}
    #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
    labels: {}
  
    http:
      # Enable plaintext HTTP listen for the admin API
      # Disabling this and using a TLS listen only is recommended for most configuration
      enabled: false
      servicePort: 8001
      containerPort: 8001
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32080
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters: []
  
    tls:
      # Enable HTTPS listen for the admin API
      enabled: true
      servicePort: 8444
      containerPort: 8444
      # Set a target port for the TLS port in the admin API service, useful when using TLS
      # termination on an ELB.
      # overrideServiceTargetPort: 8000
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32443
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters:
      - http2
  
    # Kong admin ingress settings. Useful if you want to expose the Admin
    # API of Kong outside the k8s cluster.
    ingress:
      # Enable/disable exposure using ingress.
      enabled: false
      ingressClassName:
      # TLS secret name.
      # tls: kong-admin.example.com-tls
      # Ingress hostname
      hostname:
      # Map of ingress annotations.
      annotations: {}
      # Ingress path.
      path: /
  
  # Specify Kong status listener configuration
  # This listen is internal-only. It cannot be exposed through a service or ingress.
  status:
    enabled: true
    http:
      # Enable plaintext HTTP listen for the status listen
      enabled: true
      containerPort: 8100
      parameters: []
  
    tls:
      # Enable HTTPS listen for the status listen
      # Kong versions prior to 2.1 do not support TLS status listens.
      # This setting must remain false on those versions
      enabled: false
      containerPort: 8543
      parameters: []
  
  # Specify Kong cluster service and listener configuration
  #
  # The cluster service *must* use TLS. It does not support the "http" block
  # available on other services.
  #
  # The cluster service cannot be exposed through an Ingress, as it must perform
  # TLS client validation directly and is not compatible with TLS-terminating
  # proxies. If you need to expose it externally, you must use "type:
  # LoadBalancer" and use a TCP-only load balancer (check your Kubernetes
  # provider's documentation, as the configuration required for this varies).
  cluster:
    enabled: false
    # To specify annotations or labels for the cluster service, add them to the respective
    # "annotations" or "labels" dictionaries below.
    annotations: {}
    #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
    labels: {}
  
    tls:
      enabled: false
      servicePort: 8005
      containerPort: 8005
      parameters: []
  
    type: ClusterIP
  
  # Specify Kong proxy service configuration
  proxy:
    # Enable creating a Kubernetes service for the proxy
    enabled: true
    type: LoadBalancer
    # To specify annotations or labels for the proxy service, add them to the respective
    # "annotations" or "labels" dictionaries below.
    annotations: {}
    # If terminating TLS at the ELB, the following annotations can be used
    # "service.beta.kubernetes.io/aws-load-balancer-backend-protocol": "*",
    # "service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled": "true",
    # "service.beta.kubernetes.io/aws-load-balancer-ssl-cert": "arn:aws:acm:REGION:ACCOUNT:certificate/XXXXXX-XXXXXXX-XXXXXXX-XXXXXXXX",
    # "service.beta.kubernetes.io/aws-load-balancer-ssl-ports": "kong-proxy-tls",
    # "service.beta.kubernetes.io/aws-load-balancer-type": "elb"
    labels:
      enable-metrics: "true"
  
    http:
      # Enable plaintext HTTP listen for the proxy
      enabled: true
      servicePort: 80
      containerPort: 8000
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32080
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters: []
  
    tls:
      # Enable HTTPS listen for the proxy
      enabled: true
      servicePort: 443
      containerPort: 8443
      # Set a target port for the TLS port in proxy service
      # overrideServiceTargetPort: 8000
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32443
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters:
      - http2
  
    # Define stream (TCP) listen
    # To enable, remove "{}", uncomment the section below, and select your desired
    # ports and parameters. Listens are dynamically named after their servicePort,
    # e.g. "stream-9000" for the below.
    # Note: although you can select the protocol here, you cannot set UDP if you
    # use a LoadBalancer Service due to limitations in current Kubernetes versions.
    # To proxy both TCP and UDP with LoadBalancers, you must enable the udpProxy Service
    # in the next section and place all UDP stream listen configuration under it.
    stream: {}
      #   # Set the container (internal) and service (external) ports for this listen.
      #   # These values should normally be the same. If your environment requires they
      #   # differ, note that Kong will match routes based on the containerPort only.
      # - containerPort: 9000
      #   servicePort: 9000
      #   protocol: TCP
      #   # Optionally set a static nodePort if the service type is NodePort
      #   # nodePort: 32080
      #   # Additional listen parameters, e.g. "ssl", "reuseport", "backlog=16384"
      #   # "ssl" is required for SNI-based routes. It is not supported on versions <2.0
      #   parameters: []
  
    # Kong proxy ingress settings.
    # Note: You need this only if you are using another Ingress Controller
    # to expose Kong outside the k8s cluster.
    ingress:
      # Enable/disable exposure using ingress.
      enabled: false
      ingressClassName:
      # Ingress hostname
      # TLS secret name.
      # tls: kong-admin.example.com-tls
      hostname:
      # Map of ingress annotations.
      annotations: {}
      # Ingress path.
      path: /
  
    # Optionally specify a static load balancer IP.
    # loadBalancerIP:
  
  # Specify Kong UDP proxy service configuration
  # Currently, LoadBalancer type Services are generally limited to a single transport protocol
  # Multi-protocol Services are an alpha feature as of Kubernetes 1.20:
  # https://kubernetes.io/docs/concepts/services-networking/service/#load-balancers-with-mixed-protocol-types
  # You should enable this Service if you proxy UDP traffic, and configure UDP stream listens under it
  udpProxy:
    # Enable creating a Kubernetes service for UDP proxying
    enabled: false
    type: LoadBalancer
    # To specify annotations or labels for the proxy service, add them to the respective
    # "annotations" or "labels" dictionaries below.
    annotations: {}
    #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
    labels: {}
    # Optionally specify a static load balancer IP.
    # loadBalancerIP:
  
    # Define stream (UDP) listen
    # To enable, remove "{}", uncomment the section below, and select your desired
    # ports and parameters. Listens are dynamically named after their servicePort,
    # e.g. "stream-9000" for the below.
    stream: {}
      #   # Set the container (internal) and service (external) ports for this listen.
      #   # These values should normally be the same. If your environment requires they
      #   # differ, note that Kong will match routes based on the containerPort only.
      # - containerPort: 9000
      #   servicePort: 9000
      #   protocol: UDP
      #   # Optionally set a static nodePort if the service type is NodePort
      #   # nodePort: 32080
      #   # Additional listen parameters, e.g. "ssl", "reuseport", "backlog=16384"
      #   # "ssl" is required for SNI-based routes. It is not supported on versions <2.0
      #   parameters: []
  
  # Custom Kong plugins can be loaded into Kong by mounting the plugin code
  # into the file-system of Kong container.
  # The plugin code should be present in ConfigMap or Secret inside the same
  # namespace as Kong is being installed.
  # The `name` property refers to the name of the ConfigMap or Secret
  # itself, while the pluginName refers to the name of the plugin as it appears
  # in Kong.
  # Subdirectories (which are optional) require separate ConfigMaps/Secrets.
  # "path" indicates their directory under the main plugin directory: the example
  # below will mount the contents of kong-plugin-rewriter-migrations at "/opt/kong/rewriter/migrations".
  plugins: {}
    # configMaps:
    # - pluginName: rewriter
    #   name: kong-plugin-rewriter
    #   subdirectories:
    #   - name: kong-plugin-rewriter-migrations
    #     path: migrations
    # secrets:
    # - pluginName: rewriter
    #   name: kong-plugin-rewriter
  # Inject specified secrets as a volume in Kong Container at path /etc/secrets/{secret-name}/
  # This can be used to override default SSL certificates.
  # Be aware that the secret name will be used verbatim, and that certain types
  # of punctuation (e.g. `.`) can cause issues.
  # Example configuration
  # secretVolumes:
  # - kong-proxy-tls
  # - kong-admin-tls
  secretVolumes: []
  
  # Enable/disable migration jobs, and set annotations for them
  migrations:
    # Enable pre-upgrade migrations (run "kong migrations up")
    preUpgrade: true
    # Enable post-upgrade migrations (run "kong migrations finish")
    postUpgrade: true
    # Annotations to apply to migrations job pods
    # By default, these disable service mesh sidecar injection for Istio and Kuma,
    # as the sidecar containers do not terminate and prevent the jobs from completing
    annotations:
      sidecar.istio.io/inject: false
    # Additional annotations to apply to migration jobs
    # This is helpful in certain non-Helm installation situations such as GitOps
    # where additional control is required around this job creation.
    jobAnnotations: {}
    # Optionally set a backoffLimit. If none is set, Jobs will use the cluster default
    backoffLimit:
    resources: {}
    # Example reasonable setting for "resources":
    # resources:
    #   limits:
    #     cpu: 100m
    #     memory: 256Mi
    #   requests:
    #     cpu: 50m
    #     memory: 128Mi
  
  # Kong's configuration for DB-less mode
  # Note: Use this section only if you are deploying Kong in DB-less mode
  # and not as an Ingress Controller.
  dblessConfig:
    # Either Kong's configuration is managed from an existing ConfigMap (with Key: kong.yml)
    configMap: ""
    # Or the configuration is passed in full-text below
    config: |
      _format_version: "1.1"
      services:
        # Example configuration
        # - name: example.com
        #   url: http://example.com
        #   routes:
        #   - name: example
        #     paths:
        #     - "/example"
  
  # -----------------------------------------------------------------------------
  # Ingress Controller parameters
  # -----------------------------------------------------------------------------
  
  # Kong Ingress Controller's primary purpose is to satisfy Ingress resources
  # created in k8s.  It uses CRDs for more fine grained control over routing and
  # for Kong specific configuration.
  ingressController:
    enabled: true
    image:
      repository: kong/kubernetes-ingress-controller
      tag: "2.0"
      # Optionally set a semantic version for version-gated features. This can normally
      # be left unset. You only need to set this if your tag is not a semver string,
      # such as when you are using a "next" tag. Set this to the effective semantic
      # version of your tag: for example if using a "next" image for an unreleased 3.1.0
      # version, set this to "3.1.0".
      effectiveSemver:
    args: []
  
    # Specify individual namespaces to watch for ingress configuration. By default,
    # when no namespaces are set, the controller watches all namespaces and uses a
    # ClusterRole to grant access to Kubernetes resources. When you list specific
    # namespaces, the controller will watch those namespaces only and will create
    # namespaced-scoped Roles for each of them. Note that watching specific namespaces
    # disables KongClusterPlugin usage, as KongClusterPlugins only exist as cluster resources.
    # Requires controller 2.0.0 or newer.
    watchNamespaces: []
  
    # Specify Kong Ingress Controller configuration via environment variables
    env:
      # The controller disables TLS verification by default because Kong
      # generates self-signed certificates by default. Set this to false once you
      # have installed CA-signed certificates.
      kong_admin_tls_skip_verify: true
      # If using Kong Enterprise with RBAC enabled, uncomment the section below
      # and specify the secret/key containing your admin token.
      # kong_admin_token:
      #   valueFrom:
      #     secretKeyRef:
      #        name: CHANGEME-admin-token-secret
      #        key: CHANGEME-admin-token-key
  
    admissionWebhook:
      enabled: false
      failurePolicy: Fail
      port: 8080
      certificate:
        provided: false
      # Specifiy the secretName when the certificate is provided via a TLS secret
      # secretName: ""
      # Specifiy the CA bundle of the provided certificate.
      # This is a PEM encoded CA bundle which will be used to validate the webhook certificate. If unspecified, system trust roots on the apiserver are used.
      # caBundle:
      #   | Add the CA bundle content here.
  
    ingressClass: kong
    # annotations for IngressClass resource (Kubernetes 1.18+)
    ingressClassAnnotations: {}
  
    rbac:
      # Specifies whether RBAC resources should be created
      create: true
  
    # general properties
    livenessProbe:
      httpGet:
        path: "/healthz"
        port: 10254
        scheme: HTTP
      initialDelaySeconds: 5
      timeoutSeconds: 5
      periodSeconds: 10
      successThreshold: 1
      failureThreshold: 3
    readinessProbe:
      httpGet:
        path: "/healthz"
        port: 10254
        scheme: HTTP
      initialDelaySeconds: 5
      timeoutSeconds: 5
      periodSeconds: 10
      successThreshold: 1
      failureThreshold: 3
    resources: {}
    # Example reasonable setting for "resources":
    # resources:
    #   limits:
    #     cpu: 100m
    #     memory: 256Mi
    #   requests:
    #     cpu: 50m
    #     memory: 128Mi
  
  # -----------------------------------------------------------------------------
  # Postgres sub-chart parameters
  # -----------------------------------------------------------------------------
  
  # Kong can run without a database or use either Postgres or Cassandra
  # as a backend datatstore for it's configuration.
  # By default, this chart installs Kong without a database.
  
  # If you would like to use a database, there are two options:
  # - (recommended) Deploy and maintain a database and pass the connection
  #   details to Kong via the `env` section.
  # - You can use the below `postgresql` sub-chart to deploy a database
  #   along-with Kong as part of a single Helm release.
  
  # PostgreSQL chart documentation:
  # https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md
  
  postgresql:
    enabled: false
    # postgresqlUsername: kong
    # postgresqlDatabase: kong
    # service:
    #   port: 5432
  
  # -----------------------------------------------------------------------------
  # Miscellaneous parameters
  # -----------------------------------------------------------------------------
  
  waitImage:
    # Wait for the database to come online before starting Kong or running migrations
    # If Kong is to access the database through a service mesh that injects a sidecar to
    # Kong's container, this must be disabled. Otherwise there'll be a deadlock:
    # InitContainer waiting for DB access that requires the sidecar, and the sidecar
    # waiting for InitContainers to finish.
    enabled: true
    # Optionally specify an image that provides bash for pre-migration database
    # checks. If none is specified, the chart uses the Kong image. The official
    # Kong images provide bash
    # repository: bash
    # tag: 5
    pullPolicy: IfNotPresent
  
  # update strategy
  updateStrategy: {}
    # type: RollingUpdate
    # rollingUpdate:
    #   maxSurge: "100%"
    #   maxUnavailable: "0%"
  
  # If you want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  resources: {}
    # limits:
    #  cpu: 100m
    #  memory: 256Mi
    # requests:
    #  cpu: 100m
    #  memory: 256Mi
  
  # readinessProbe for Kong pods
  readinessProbe:
    httpGet:
      path: "/status"
      port: status
      scheme: HTTP
    initialDelaySeconds: 5
    timeoutSeconds: 5
    periodSeconds: 10
    successThreshold: 1
    failureThreshold: 3
  
  # livenessProbe for Kong pods
  livenessProbe:
    httpGet:
      path: "/status"
      port: status
      scheme: HTTP
    initialDelaySeconds: 5
    timeoutSeconds: 5
    periodSeconds: 10
    successThreshold: 1
    failureThreshold: 3
  
  # Proxy container lifecycle hooks
  # Ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
  lifecycle:
    preStop:
      exec:
        # Note kong quit has a default timeout of 10 seconds
        command: ["/bin/sh", "-c", "/bin/sleep 15 && kong quit"]
  
  # Sets the termination grace period for pods spawned by the Kubernetes Deployment.
  # Ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#hook-handler-execution
  terminationGracePeriodSeconds: 30
  
  # Affinity for pod assignment
  # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  # affinity: {}
  
  # Topology spread constraints for pod assignment (requires Kubernetes >= 1.19)
  # Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
  # topologySpreadConstraints: []
  
  # Tolerations for pod assignment
  # Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  tolerations: []
  
  # Node labels for pod assignment
  # Ref: https://kubernetes.io/docs/user-guide/node-selection/
  nodeSelector: {}
  
  # Annotation to be added to Kong pods
  podAnnotations: {}
  
  # Labels to be added to Kong pods
  podLabels: {}
  
  # Kong pod count.
  # It has no effect when autoscaling.enabled is set to true
  replicaCount: 1
  
  # Annotations to be added to Kong deployment
  deploymentAnnotations:
    kuma.io/gateway: enabled
    traffic.sidecar.istio.io/includeInboundPorts: ""
  
  # Enable autoscaling using HorizontalPodAutoscaler
  # When configuring an HPA, you must set resource requests on all containers via
  # "resources" and, if using the controller, "ingressController.resources" in values.yaml
  autoscaling:
    enabled: false
    minReplicas: 2
    maxReplicas: 5
    ## targetCPUUtilizationPercentage only used if the cluster doesn't support autoscaling/v2beta
    targetCPUUtilizationPercentage:
    ## Otherwise for clusters that do support autoscaling/v2beta, use metrics
    metrics:
      - type: Resource
        resource:
          name: cpu
          target:
            type: Utilization
            averageUtilization: 80
  
  # Kong Pod Disruption Budget
  podDisruptionBudget:
    enabled: false
    # Uncomment only one of the following when enabled is set to true
    # maxUnavailable: "50%"
    # minUnavailable: "50%"
  
  podSecurityPolicy:
    enabled: false
    spec:
      privileged: false
      fsGroup:
        rule: RunAsAny
      runAsUser:
        rule: RunAsAny
      runAsGroup:
        rule: RunAsAny
      seLinux:
        rule: RunAsAny
      supplementalGroups:
        rule: RunAsAny
      volumes:
        - 'configMap'
        - 'secret'
        - 'emptyDir'
      allowPrivilegeEscalation: false
      hostNetwork: false
      hostIPC: false
      hostPID: false
      # Make the root filesystem read-only. This is not compatible with Kong Enterprise <1.5.
      # If you use Kong Enterprise <1.5, this must be set to false.
      readOnlyRootFilesystem: true
  
  
  priorityClassName: ""
  
  # securityContext for Kong pods.
  securityContext: {}
  
  # securityContext for containers.
  containerSecurityContext: {}
  
  ## Optional DNS configuration for Kong pods
  # dnsPolicy: ClusterFirst
  # dnsConfig:
  #   nameservers:
  #   - "10.100.0.10"
  #   options:
  #   - name: ndots
  #     value: "5"
  #   searches:
  #   - default.svc.cluster.local
  #   - svc.cluster.local
  #   - cluster.local
  #   - us-east-1.compute.internal
  
  serviceMonitor:
    # Specifies whether ServiceMonitor for Prometheus operator should be created
    # If you wish to gather metrics from a Kong instance with the proxy disabled (such as a hybrid control plane), see:
    # https://github.com/Kong/charts/blob/main/charts/kong/README.md#prometheus-operator-integration
    enabled: false
    # interval: 10s
    # Specifies namespace, where ServiceMonitor should be installed
    # namespace: monitoring
    # labels:
    #   foo: bar
    # targetLabels:
    #   - foo
  
    # honorLabels: false
    # metricRelabelings: []
  
  # -----------------------------------------------------------------------------
  # Kong Enterprise parameters
  # -----------------------------------------------------------------------------
  
  # Toggle Kong Enterprise features on or off
  # RBAC and SMTP configuration have additional options that must all be set together
  # Other settings should be added to the "env" settings below
  enterprise:
    enabled: false
    # Kong Enterprise license secret name
    # This secret must contain a single 'license' key, containing your base64-encoded license data
    # The license secret is required to unlock all Enterprise features. If you omit it,
    # Kong will run in free mode, with some Enterprise features disabled.
    # license_secret: kong-enterprise-license
    vitals:
      enabled: true
    portal:
      enabled: false
    rbac:
      enabled: false
      admin_gui_auth: basic-auth
      # If RBAC is enabled, this Secret must contain an admin_gui_session_conf key
      # The key value must be a secret configuration, following the example at
      # https://docs.konghq.com/enterprise/latest/kong-manager/authentication/sessions
      session_conf_secret: kong-session-config
      # If admin_gui_auth is not set to basic-auth, provide a secret name which
      # has an admin_gui_auth_conf key containing the plugin config JSON
      admin_gui_auth_conf_secret: CHANGEME-admin-gui-auth-conf-secret
    # For configuring emails and SMTP, please read through:
    # https://docs.konghq.com/enterprise/latest/developer-portal/configuration/smtp
    # https://docs.konghq.com/enterprise/latest/kong-manager/networking/email
    smtp:
      enabled: false
      portal_emails_from: none@example.com
      portal_emails_reply_to: none@example.com
      admin_emails_from: none@example.com
      admin_emails_reply_to: none@example.com
      smtp_admin_emails: none@example.com
      smtp_host: smtp.example.com
      smtp_port: 587
      smtp_auth_type: ''
      smtp_ssl: nil
      smtp_starttls: true
      auth:
        # If your SMTP server does not require authentication, this section can
        # be left as-is. If smtp_username is set to anything other than an empty
        # string, you must create a Secret with an smtp_password key containing
        # your SMTP password and specify its name here.
        smtp_username: ''  # e.g. postmaster@example.com
        smtp_password_secret: CHANGEME-smtp-password
  
  manager:
    # Enable creating a Kubernetes service for Kong Manager
    enabled: true
    type: NodePort
    # To specify annotations or labels for the Manager service, add them to the respective
    # "annotations" or "labels" dictionaries below.
    annotations: {}
    #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
    labels: {}
  
    http:
      # Enable plaintext HTTP listen for Kong Manager
      enabled: true
      servicePort: 8002
      containerPort: 8002
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32080
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters: []
  
    tls:
      # Enable HTTPS listen for Kong Manager
      enabled: true
      servicePort: 8445
      containerPort: 8445
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32443
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters:
      - http2
  
    ingress:
      # Enable/disable exposure using ingress.
      enabled: false
      ingressClassName:
      # TLS secret name.
      # tls: kong-proxy.example.com-tls
      # Ingress hostname
      hostname:
      # Map of ingress annotations.
      annotations: {}
      # Ingress path.
      path: /
  
  portal:
    # Enable creating a Kubernetes service for the Developer Portal
    enabled: true
    type: NodePort
    # To specify annotations or labels for the Portal service, add them to the respective
    # "annotations" or "labels" dictionaries below.
    annotations: {}
    #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
    labels: {}
  
    http:
      # Enable plaintext HTTP listen for the Developer Portal
      enabled: true
      servicePort: 8003
      containerPort: 8003
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32080
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters: []
  
    tls:
      # Enable HTTPS listen for the Developer Portal
      enabled: true
      servicePort: 8446
      containerPort: 8446
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32443
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters:
      - http2
  
    ingress:
      # Enable/disable exposure using ingress.
      enabled: false
      ingressClassName:
      # TLS secret name.
      # tls: kong-proxy.example.com-tls
      # Ingress hostname
      hostname:
      # Map of ingress annotations.
      annotations: {}
      # Ingress path.
      path: /
  
  portalapi:
    # Enable creating a Kubernetes service for the Developer Portal API
    enabled: true
    type: NodePort
    # To specify annotations or labels for the Portal API service, add them to the respective
    # "annotations" or "labels" dictionaries below.
    annotations: {}
    #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
    labels: {}
  
    http:
      # Enable plaintext HTTP listen for the Developer Portal API
      enabled: true
      servicePort: 8004
      containerPort: 8004
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32080
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters: []
  
    tls:
      # Enable HTTPS listen for the Developer Portal API
      enabled: true
      servicePort: 8447
      containerPort: 8447
      # Set a nodePort which is available if service type is NodePort
      # nodePort: 32443
      # Additional listen parameters, e.g. "reuseport", "backlog=16384"
      parameters:
      - http2
  
    ingress:
      # Enable/disable exposure using ingress.
      enabled: false
      ingressClassName:
      # TLS secret name.
      # tls: kong-proxy.example.com-tls
      # Ingress hostname
      hostname:
      # Map of ingress annotations.
      annotations: {}
      # Ingress path.
      path: /
  
  clustertelemetry:
    enabled: false
    # To specify annotations or labels for the cluster telemetry service, add them to the respective
    # "annotations" or "labels" dictionaries below.
    annotations: {}
    #  service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
    labels: {}
  
    tls:
      enabled: false
      servicePort: 8006
      containerPort: 8006
      parameters: []
  
    type: ClusterIP
  
  extraConfigMaps: []
  # extraConfigMaps:
  # - name: my-config-map
  #   mountPath: /mount/to/my/location
  #   subPath: my-subpath # Optional, if you wish to mount a single key and not the entire ConfigMap
  
  extraSecrets: []
  # extraSecrets:
  # - name: my-secret
  #   mountPath: /mount/to/my/location
  #   subPath: my-subpath # Optional, if you wish to mount a single key and not the entire ConfigMap