nicktrn
8f9db53350
## Summary
Self-hosted Kubernetes deployments can now add tolerations to run pods,
so runs
can schedule onto tainted nodes. Previously the only way to do this was
to patch
the supervisor.
`KUBERNETES_RUNNER_TOLERATIONS` takes a comma separated list of
`key=value:effect`, or `key:effect` to tolerate any value. It applies to
every
run pod, and for runs from a schedule tree it merges with the existing
`KUBERNETES_SCHEDULED_RUN_TOLERATIONS`. Left unset, nothing changes: no
tolerations are added and the pod spec leaves the field off entirely.
The Helm chart takes it as a list:
```yaml
supervisor:
config:
kubernetes:
runnerTolerations:
- dedicated=runs:NoSchedule
- spot:NoExecute
```
## Naming
The issue proposed `KUBERNETES_WORKER_TOLERATIONS`. This ships as
`KUBERNETES_RUNNER_TOLERATIONS` instead, because `RUNNER_*` is already
the prefix
for run pod settings (`RUNNER_HEARTBEAT_INTERVAL_SECONDS`,
`RUNNER_ADDITIONAL_ENV_VARS`, and `DOCKER_RUNNER_NETWORKS` for the
Docker
equivalent), whereas "worker" refers to the supervisor itself throughout
this app.
## Validation
Keys and values are checked against the Kubernetes naming rules when the
supervisor starts, so `dedicated=prod runs:NoSchedule` fails immediately
with a
message naming the offending entry. Without that check a bad value is
accepted at
startup and then rejected by the API server on every pod create, which
stops all
runs with the cause buried in an API error.
`KUBERNETES_WORKER_NODETYPE_LABEL` is
trimmed and validated for the same reason: surrounding whitespace is not
valid in
a label value, so a padded value fails every pod create today.
## Node selector off switch
`KUBERNETES_WORKER_NODETYPE_LABEL` accepts an empty string to skip the
node
selector entirely, so runs schedule on any node. This already worked and
the Helm
chart has always shipped it empty, but it was not documented. It is now.
The issue also asked for general node affinity configuration. That is
not
included: the node selector off switch plus tolerations covers the
reported
problem, and a free form affinity setting is a much larger config
surface to
commit to.
Fixes #4458
1016 lines
30 KiB
YAML
1016 lines
30 KiB
YAML
global:
|
||
imageRegistry: ""
|
||
imagePullSecrets: []
|
||
storageClass: ""
|
||
security:
|
||
# Required when using bitnami legacy images
|
||
allowInsecureImages: true
|
||
|
||
nameOverride: ""
|
||
fullnameOverride: ""
|
||
|
||
# Secrets configuration
|
||
# No working defaults are shipped. Leave a secret empty and the chart generates a
|
||
# strong random value on first install, retained across upgrades (so sessions and
|
||
# encrypted data survive). Set a value explicitly to control it yourself, or use
|
||
# secrets.existingSecret / external secret management. Explicit values win.
|
||
secrets:
|
||
# Enable/disable creation of secrets
|
||
# Set to false to use external secret management (Vault, Infisical, External Secrets, etc.)
|
||
# When disabled, you can also use extraEnvVars and podAnnotations for secret injection
|
||
enabled: true
|
||
|
||
# Name of existing secret to use instead of creating one
|
||
# If empty, a secret will be created with the values below
|
||
# The secret must contain the following keys:
|
||
# - SESSION_SECRET
|
||
# - MAGIC_LINK_SECRET
|
||
# - ENCRYPTION_KEY
|
||
# - PROVIDER_SECRET
|
||
# - COORDINATOR_SECRET
|
||
# - MANAGED_WORKER_SECRET
|
||
existingSecret: ""
|
||
|
||
# Session secret for user authentication
|
||
sessionSecret: "" # Leave empty to auto-generate, or set a strong value.
|
||
# Magic link secret for passwordless login
|
||
magicLinkSecret: "" # Leave empty to auto-generate, or set a strong value.
|
||
# Encryption key for sensitive data
|
||
encryptionKey: "" # Leave empty to auto-generate, or set a strong value.
|
||
# Provider socket secret
|
||
providerSecret: "" # Leave empty to auto-generate, or set a strong value.
|
||
# Coordinator socket secret
|
||
coordinatorSecret: "" # Leave empty to auto-generate, or set a strong value.
|
||
# Worker secret for managed worker authentication
|
||
managedWorkerSecret: "" # Leave empty to auto-generate, or set a strong value.
|
||
# Object store credentials moved to s3.auth and s3.external section
|
||
|
||
# Webapp configuration
|
||
webapp:
|
||
image:
|
||
registry: ghcr.io
|
||
repository: triggerdotdev/trigger.dev
|
||
tag: "" # Defaults to Chart.appVersion when empty
|
||
pullPolicy: IfNotPresent
|
||
|
||
# Init container for shared directory setup
|
||
volumePermissions:
|
||
image:
|
||
registry: docker.io
|
||
repository: busybox
|
||
tag: "1.35"
|
||
pullPolicy: IfNotPresent
|
||
|
||
# Sidecar for token syncing
|
||
tokenSyncer:
|
||
image:
|
||
registry: docker.io
|
||
repository: bitnamilegacy/kubectl
|
||
tag: "1.28"
|
||
pullPolicy: IfNotPresent
|
||
|
||
# Origin configuration
|
||
appOrigin: "http://localhost:3040"
|
||
loginOrigin: "http://localhost:3040"
|
||
apiOrigin: "http://localhost:3040"
|
||
|
||
replicaCount: 1
|
||
|
||
service:
|
||
type: ClusterIP
|
||
port: 3030
|
||
targetPort: 3000
|
||
|
||
podAnnotations: {}
|
||
|
||
# podSecurityContext:
|
||
# fsGroup: 1000
|
||
|
||
# securityContext:
|
||
# runAsNonRoot: true
|
||
# runAsUser: 1000
|
||
|
||
nodeSelector: {}
|
||
tolerations: []
|
||
affinity: {}
|
||
# Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template
|
||
topologySpreadConstraints: []
|
||
|
||
logLevel: "info"
|
||
gracefulShutdownTimeout: 1000
|
||
|
||
# Bootstrap configuration
|
||
bootstrap:
|
||
enabled: true
|
||
workerGroupName: "bootstrap"
|
||
workerTokenPath: "/home/node/shared/worker_token"
|
||
|
||
# Limits
|
||
limits:
|
||
taskPayloadOffloadThreshold: 524288 # 512KB
|
||
taskPayloadMaximumSize: 3145728 # 3MB
|
||
batchTaskPayloadMaximumSize: 1000000 # 1MB
|
||
taskRunMetadataMaximumSize: 262144 # 256KB
|
||
defaultEnvExecutionConcurrencyLimit: 100
|
||
defaultOrgExecutionConcurrencyLimit: 300
|
||
|
||
# Resources
|
||
resources:
|
||
{}
|
||
# Example resource configuration:
|
||
# limits:
|
||
# cpu: 1000m
|
||
# memory: 2Gi
|
||
# requests:
|
||
# cpu: 500m
|
||
# memory: 1Gi
|
||
|
||
# Connectivity check configuration
|
||
connectivityCheck:
|
||
postgres: true # Set to false to disable DATABASE_HOST env var (overrides postgres.external.connectivityCheck)
|
||
|
||
# Extra environment variables for webapp
|
||
extraEnvVars:
|
||
[]
|
||
# - name: CUSTOM_VAR
|
||
# value: "custom-value"
|
||
# - name: SECRET_VAR
|
||
# valueFrom:
|
||
# secretKeyRef:
|
||
# name: my-secret
|
||
# key: secret-key
|
||
#
|
||
# Example: PostgreSQL SSL with custom CA certificate
|
||
# - name: NODE_EXTRA_CA_CERTS
|
||
# value: "/etc/ssl/certs/postgres-ca.crt"
|
||
|
||
# Extra volumes for the webapp pod
|
||
extraVolumes:
|
||
[]
|
||
# - name: config-volume
|
||
# configMap:
|
||
# name: my-config
|
||
# - name: secret-volume
|
||
# secret:
|
||
# secretName: my-secret
|
||
#
|
||
# Example: PostgreSQL SSL CA certificate volume
|
||
# - name: postgres-ca-cert
|
||
# secret:
|
||
# secretName: postgres-ca-secret
|
||
# items:
|
||
# - key: ca.crt
|
||
# path: postgres-ca.crt
|
||
|
||
# Extra volume mounts for the webapp container
|
||
extraVolumeMounts:
|
||
[]
|
||
# - name: config-volume
|
||
# mountPath: /etc/config
|
||
# readOnly: true
|
||
# - name: secret-volume
|
||
# mountPath: /etc/secrets
|
||
# readOnly: true
|
||
#
|
||
# Example: PostgreSQL SSL CA certificate mount
|
||
# - name: postgres-ca-cert
|
||
# mountPath: /etc/ssl/certs
|
||
# readOnly: true
|
||
|
||
# ServiceMonitor for Prometheus monitoring
|
||
serviceMonitor:
|
||
enabled: false
|
||
interval: "30s"
|
||
path: "/metrics"
|
||
labels: {}
|
||
basicAuth: {}
|
||
|
||
# Health probe configuration
|
||
livenessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 30
|
||
timeoutSeconds: 10
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
readinessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 30
|
||
timeoutSeconds: 10
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
startupProbe:
|
||
enabled: false
|
||
initialDelaySeconds: 0
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 60
|
||
successThreshold: 1
|
||
|
||
clickhouse:
|
||
logLevel: "info" # one of: log, error, warn, info, debug
|
||
runReplication:
|
||
logLevel: "info" # one of: log, error, warn, info, debug
|
||
|
||
# ServiceAccount configuration
|
||
serviceAccount:
|
||
create: true
|
||
# Name of the ServiceAccount to use. Required when create is false - otherwise
|
||
# the token-syncer RoleBinding would bind to the namespace's "default" SA.
|
||
name: ""
|
||
# Annotations to add to the ServiceAccount (e.g. eks.amazonaws.com/role-arn for IRSA)
|
||
annotations: {}
|
||
|
||
# Observability configuration (OTel)
|
||
observability:
|
||
tracing:
|
||
exporterUrl: ""
|
||
exporterAuthHeaders: ""
|
||
loggingEnabled: "0"
|
||
samplingRate: "20"
|
||
instrumentPrismaEnabled: "0"
|
||
disabled: "0"
|
||
logging:
|
||
exporterUrl: ""
|
||
# Log auth headers are currently set to tracing.exporterAuthHeaders
|
||
metrics:
|
||
exporterUrl: ""
|
||
exporterAuthHeaders: ""
|
||
exporterEnabled: "0"
|
||
exporterIntervalMs: 30000
|
||
|
||
# Webapp ingress configuration
|
||
ingress:
|
||
enabled: false
|
||
className: "traefik"
|
||
# Custom annotations for the ingress resource
|
||
# Note: The following annotation keys are reserved and will be automatically set:
|
||
# - cert-manager.io/cluster-issuer (when certManager.enabled is true)
|
||
# - external-dns.alpha.kubernetes.io/hostname (when externalDns.enabled is true)
|
||
# - external-dns.alpha.kubernetes.io/ttl (when externalDns.enabled is true)
|
||
annotations: {}
|
||
certManager:
|
||
enabled: false
|
||
clusterIssuer: "letsencrypt-prod"
|
||
externalDns:
|
||
enabled: false
|
||
hostname: ""
|
||
ttl: "300"
|
||
hosts:
|
||
- host: trigger.local
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
tls:
|
||
[]
|
||
# - secretName: trigger-tls
|
||
# hosts:
|
||
# - trigger.local
|
||
|
||
# Supervisor configuration
|
||
supervisor:
|
||
image:
|
||
registry: ghcr.io
|
||
repository: triggerdotdev/supervisor
|
||
tag: "" # Defaults to Chart.appVersion when empty
|
||
pullPolicy: IfNotPresent
|
||
|
||
podAnnotations: {}
|
||
|
||
# podSecurityContext:
|
||
# fsGroup: 1000
|
||
|
||
# securityContext:
|
||
# runAsNonRoot: true
|
||
# runAsUser: 1000
|
||
|
||
service:
|
||
type: ClusterIP
|
||
ports:
|
||
workload: 3000
|
||
metrics: 9088
|
||
resources: {}
|
||
config:
|
||
kubernetes:
|
||
forceEnabled: true
|
||
namespace: "" # Default: uses release namespace
|
||
workerNodetypeLabel: "" # When set, runs will only be scheduled on nodes with "nodetype=<label>"
|
||
runnerTolerations: [] # Run pod tolerations, e.g. ["dedicated=runs:NoSchedule"]
|
||
ephemeralStorageSizeLimit: "" # Default: 10Gi
|
||
ephemeralStorageSizeRequest: "" # Default: 2Gi´
|
||
podCleaner:
|
||
enabled: true
|
||
batchSize: 100
|
||
intervalMs: 10000 # 10 seconds´
|
||
failedPodHandler:
|
||
enabled: true
|
||
reconnectIntervalMs: 1000
|
||
workloadApi:
|
||
enabled: true
|
||
protocol: "http"
|
||
portExternal: 3000
|
||
portInternal: 3000
|
||
hostInternal: "0.0.0.0"
|
||
dequeue:
|
||
enabled: true
|
||
intervalMs: 250
|
||
maxRunCount: 100
|
||
idleIntervalMs: 500
|
||
runner:
|
||
heartbeatIntervalSeconds: 30
|
||
snapshotPollIntervalSeconds: 30
|
||
metrics:
|
||
enabled: true
|
||
collectDefaults: true
|
||
host: "0.0.0.0"
|
||
port: 9088
|
||
debug: false
|
||
# RBAC configuration
|
||
serviceAccount:
|
||
create: true
|
||
name: ""
|
||
annotations: {}
|
||
rbac:
|
||
create: true
|
||
# Namespace-scoped permissions for pod management
|
||
role:
|
||
name: ""
|
||
# Extra environment variables for Supervisor
|
||
extraEnvVars:
|
||
[]
|
||
# - name: CUSTOM_VAR
|
||
# value: "custom-value"
|
||
|
||
# ServiceMonitor for Prometheus monitoring
|
||
serviceMonitor:
|
||
enabled: false
|
||
interval: "30s"
|
||
path: "/metrics"
|
||
labels: {}
|
||
basicAuth: {}
|
||
|
||
# Health probe configuration
|
||
livenessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 3
|
||
successThreshold: 1
|
||
readinessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 15
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 3
|
||
successThreshold: 1
|
||
startupProbe:
|
||
enabled: false
|
||
initialDelaySeconds: 0
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 60
|
||
successThreshold: 1
|
||
|
||
# Bootstrap configuration
|
||
# When enabled: reads token from shared file, otherwise uses workerToken config
|
||
bootstrap:
|
||
enabled: true
|
||
workerTokenPath: "/home/node/shared/worker_token"
|
||
workerToken:
|
||
# Direct value (not recommended for production)
|
||
value: ""
|
||
# Secret reference
|
||
secret:
|
||
name: ""
|
||
key: ""
|
||
|
||
nodeSelector: {}
|
||
tolerations: [] # For the supervisor pod itself, not run pods
|
||
affinity: {}
|
||
|
||
# PostgreSQL configuration
|
||
# Subchart: https://github.com/bitnami/charts/tree/main/bitnami/postgresql
|
||
postgres:
|
||
deploy: true
|
||
|
||
image:
|
||
# Use bitnami legacy repo
|
||
repository: bitnamilegacy/postgresql
|
||
# image: docker.io/bitnamilegacy/postgresql:17.5.0-debian-12-r12
|
||
|
||
# Bitnami PostgreSQL chart configuration (when deploy: true)
|
||
auth:
|
||
enablePostgresUser: true
|
||
postgresPassword: "" # Leave empty to auto-generate into the datastore secret, or set to pin.
|
||
username: "postgres"
|
||
password: "" # Leave empty to auto-generate into the datastore secret, or set to pin.
|
||
database: "main"
|
||
# Read the auto-generated password from the chart-managed datastore secret
|
||
# (templates/datastore-secret.yaml). Must equal trigger-v4.datastore.secretName.
|
||
existingSecret: "trigger-datastore"
|
||
secretKeys:
|
||
adminPasswordKey: "postgres-password"
|
||
userPasswordKey: "password"
|
||
|
||
primary:
|
||
persistence:
|
||
enabled: true
|
||
size: 10Gi
|
||
resourcesPreset: "small"
|
||
resources: {}
|
||
configuration: |
|
||
listen_addresses = '*'
|
||
wal_level = logical
|
||
|
||
# Custom connection settings
|
||
connection:
|
||
schema: "public"
|
||
sslMode: "disable" # Use "require" or "verify-full" for production with custom CA
|
||
|
||
# External PostgreSQL connection (when deploy: false)
|
||
external:
|
||
# Database URL configuration - simplified approach using URLs instead of individual parameters
|
||
databaseUrl: "" # Full PostgreSQL connection URL (e.g., postgresql://user:pass@host:port/db?schema=public&sslmode=prefer)
|
||
directUrl: "" # Optional: Direct URL for migrations (if not set, databaseUrl will be used)
|
||
#
|
||
# Optional: Connectivity check configuration during webapp startup
|
||
connectivityCheck:
|
||
host: "" # Optional: hostname:port for wait-for-it script (e.g., "postgres.example.com:5432")
|
||
#
|
||
# Secure credential management
|
||
existingSecret: "" # Name of existing secret containing DATABASE_URL
|
||
secretKeys:
|
||
databaseUrlKey: "postgres-database-url" # Key in existing secret containing complete DATABASE_URL
|
||
directUrlKey: "postgres-direct-url" # Key in existing secret containing direct URL (optional)
|
||
#
|
||
# Example: For SSL connections with custom CA (e.g., AWS RDS):
|
||
# 1. Set connection.sslMode to "require" or "verify-full"
|
||
# 2. Create a secret with your CA certificate:
|
||
# kubectl create secret generic postgres-ca-secret --from-file=ca.crt=/path/to/rds-ca-cert.pem
|
||
# 3. Configure extraVolumes, extraVolumeMounts, and extraEnvVars (see webapp section above)
|
||
|
||
# Redis configuration
|
||
# Subchart: https://github.com/bitnami/charts/tree/main/bitnami/redis
|
||
redis:
|
||
deploy: true
|
||
|
||
image:
|
||
# Use bitnami legacy repo
|
||
repository: bitnamilegacy/redis
|
||
# image: docker.io/bitnamilegacy/redis:8.0.2-debian-12-r4
|
||
|
||
# Bitnami Redis chart configuration (when deploy: true)
|
||
auth:
|
||
enabled: false
|
||
|
||
# Single-node configuration (disable replica)
|
||
architecture: standalone
|
||
|
||
master:
|
||
persistence:
|
||
enabled: true
|
||
size: 5Gi
|
||
resources: {}
|
||
|
||
# External Redis connection (when deploy: false)
|
||
external:
|
||
host: ""
|
||
port: 6379
|
||
password: "" # Optional - ignored if existingSecret is set
|
||
tls:
|
||
enabled: false # Set to true for Redis instances requiring TLS (e.g., AWS ElastiCache)
|
||
#
|
||
# Secure credential management
|
||
existingSecret: "" # Name of existing secret containing password
|
||
existingSecretPasswordKey: "redis-password" # Key in existing secret containing password
|
||
|
||
# Electric configuration
|
||
electric:
|
||
deploy: true
|
||
image:
|
||
registry: docker.io
|
||
repository: electricsql/electric
|
||
tag: "1.2.4"
|
||
pullPolicy: IfNotPresent
|
||
config:
|
||
insecure: true
|
||
usageReporting: false
|
||
|
||
podAnnotations: {}
|
||
|
||
# podSecurityContext:
|
||
# fsGroup: 1000
|
||
|
||
# securityContext:
|
||
# runAsNonRoot: true
|
||
# runAsUser: 1000
|
||
|
||
service:
|
||
type: ClusterIP
|
||
port: 3000
|
||
targetPort: 3000
|
||
resources: {}
|
||
|
||
# Health probe configuration
|
||
livenessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
readinessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
startupProbe:
|
||
enabled: false
|
||
initialDelaySeconds: 0
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 60
|
||
successThreshold: 1
|
||
|
||
# External Electric connection (when deploy: false)
|
||
external:
|
||
url: "" # For example: "http://electric:3000"
|
||
|
||
# Extra environment variables for Electric
|
||
extraEnvVars:
|
||
[]
|
||
# - name: CUSTOM_VAR
|
||
# value: "custom-value"
|
||
|
||
# S2 (realtime streams v2)
|
||
# s2-lite is the open-source, self-hostable S2 server (https://s2.dev). It backs
|
||
# realtime streams v2, which power AI-agent token streaming and run streams. When
|
||
# enabled, the webapp defaults to v2; set `defaultStreamVersion: v1` to fall back
|
||
# to the Redis-backed v1 streams. Disable entirely with `deploy: false` and no
|
||
# external endpoint.
|
||
s2:
|
||
deploy: true
|
||
image:
|
||
registry: ghcr.io
|
||
repository: s2-streamstore/s2
|
||
tag: "latest"
|
||
# Pinning by digest is strongly recommended for reproducible deployments
|
||
digest: "sha256:d6ded5ca7dd619fa7c946f06e39a98f9c95c6883c8bb884e5eaa129f232c920c"
|
||
pullPolicy: IfNotPresent
|
||
|
||
# Which stream protocol version the webapp defaults to when a client doesn't pin one.
|
||
# Only takes effect while S2 is enabled (deploy: true or an external endpoint set);
|
||
# with S2 fully disabled the webapp always falls back to v1.
|
||
defaultStreamVersion: "v2"
|
||
|
||
# Basin that holds realtime streams. Created on startup from the init config.
|
||
# Must be at least 8 characters.
|
||
basin: "trigger-realtime"
|
||
|
||
# s2-lite needs no authentication; skip minting per-stream access tokens.
|
||
# Set to false when pointing at a hosted S2 that requires a token.
|
||
skipAccessTokens: true
|
||
|
||
podAnnotations: {}
|
||
|
||
# s2-lite is distroless and runs as uid 65532. fsGroup makes the persistent
|
||
# volume writable by that user without running the container as root.
|
||
podSecurityContext:
|
||
fsGroup: 65532
|
||
securityContext:
|
||
runAsNonRoot: true
|
||
runAsUser: 65532
|
||
runAsGroup: 65532
|
||
|
||
service:
|
||
type: ClusterIP
|
||
port: 80
|
||
# High container port so s2-lite can bind as the non-root image user (65532)
|
||
# without needing CAP_NET_BIND_SERVICE for a privileged port
|
||
targetPort: 8080
|
||
|
||
# Persistent storage for the SlateDB-backed stream data
|
||
persistence:
|
||
enabled: true
|
||
size: 5Gi
|
||
accessMode: ReadWriteOnce
|
||
storageClass: ""
|
||
retain: false
|
||
|
||
resources: {}
|
||
|
||
# Health probe configuration (distroless image → TCP probes, no shell/HTTP tooling)
|
||
livenessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
readinessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 5
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
|
||
# External S2 connection (when deploy: false). Point at a hosted S2 basin, e.g.
|
||
# "https://<basin>.b.aws.s2.dev/v1", set skipAccessTokens: false above, and
|
||
# supply an access token either inline or via an existing secret.
|
||
external:
|
||
endpoint: ""
|
||
accessToken: ""
|
||
existingSecret: ""
|
||
existingSecretAccessTokenKey: "access-token"
|
||
|
||
# ClickHouse configuration
|
||
# Deploys a single-node ClickHouse using the official image:
|
||
# https://hub.docker.com/r/clickhouse/clickhouse-server
|
||
# For clustered/replicated setups, use an external ClickHouse (deploy: false).
|
||
clickhouse:
|
||
deploy: true
|
||
|
||
image:
|
||
registry: docker.io
|
||
repository: clickhouse/clickhouse-server
|
||
# Trigger.dev requires ClickHouse >= 25.8
|
||
tag: "26.2"
|
||
# Pinning by digest is strongly recommended for reproducible deployments
|
||
digest: ""
|
||
pullPolicy: IfNotPresent
|
||
|
||
# TLS/Secure connection configuration
|
||
secure: false # Set to true to use HTTPS and secure connections
|
||
|
||
auth:
|
||
username: "default"
|
||
password: "" # Leave empty to auto-generate into the datastore secret, or set to pin.
|
||
# Read the auto-generated password from the chart-managed datastore secret.
|
||
existingSecret: "trigger-datastore"
|
||
existingSecretKey: "clickhouse-admin-password"
|
||
|
||
podAnnotations: {}
|
||
|
||
# The official image runs ClickHouse as uid 101. fsGroup makes the persistent
|
||
# volume writable by that user without running the container as root, and
|
||
# OnRootMismatch relabels volumes carried over from older chart versions
|
||
# (different uid) on first mount without rechecking every file on later mounts.
|
||
podSecurityContext:
|
||
fsGroup: 101
|
||
fsGroupChangePolicy: OnRootMismatch
|
||
securityContext:
|
||
runAsNonRoot: true
|
||
runAsUser: 101
|
||
runAsGroup: 101
|
||
|
||
# One-time root init container that chowns the data volume to the ClickHouse
|
||
# uid. Only needed on storage that doesn't support fsGroup ownership changes
|
||
# (e.g. NFS, hostPath); on such storage a data volume carried over from the
|
||
# Bitnami-based chart is otherwise unreadable by the non-root server.
|
||
volumePermissions:
|
||
enabled: false
|
||
image:
|
||
registry: docker.io
|
||
repository: busybox
|
||
tag: "1.35"
|
||
pullPolicy: IfNotPresent
|
||
|
||
nodeSelector: {}
|
||
tolerations: []
|
||
affinity: {}
|
||
|
||
service:
|
||
type: ClusterIP
|
||
ports:
|
||
http: 8123
|
||
native: 9000
|
||
|
||
persistence:
|
||
enabled: true
|
||
size: 10Gi
|
||
accessMode: ReadWriteOnce
|
||
storageClass: ""
|
||
retain: false
|
||
# Name of an existing PVC to use for ClickHouse data instead of creating
|
||
# one. Normally left empty: upgrades from chart versions that bundled the
|
||
# Bitnami ClickHouse subchart adopt the old data PVC automatically. Set
|
||
# this explicitly when rendering manifests without cluster access (e.g.
|
||
# GitOps tools that use `helm template`), where auto-detection can't run:
|
||
# the old PVC is named data-<release>-clickhouse-shard0-0.
|
||
existingClaim: ""
|
||
|
||
## ClickHouse resource requests and limits
|
||
## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||
## ClickHouse can be very resource intensive. The defaults below match the
|
||
## resource preset the chart previously applied; size them to your workload
|
||
## for production (see values-production-example.yaml).
|
||
resources:
|
||
requests:
|
||
cpu: 1000m
|
||
memory: 3Gi
|
||
limits:
|
||
cpu: 3000m
|
||
memory: 6Gi
|
||
|
||
livenessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
readinessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 5
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
# Generous startup window: first boot on a large adopted data volume can
|
||
# spend a while loading metadata before the HTTP listener answers.
|
||
startupProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 5
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 60
|
||
successThreshold: 1
|
||
|
||
# External ClickHouse connection (when deploy: false)
|
||
external:
|
||
host: ""
|
||
httpPort: 8123
|
||
nativePort: 9000
|
||
username: ""
|
||
password: "" # Optional - ignored if existingSecret is set
|
||
secure: false # Set to true for external secure connections
|
||
#
|
||
# Secure credential management
|
||
existingSecret: "" # Name of existing secret containing password
|
||
existingSecretKey: "clickhouse-password" # Key in existing secret containing password
|
||
|
||
# ClickHouse configuration override
|
||
# These defaults are based on official recommendations for systems with <16GB RAM:
|
||
# https://clickhouse.com/docs/operations/tips
|
||
configdFiles:
|
||
override.xml: |
|
||
<clickhouse>
|
||
<logger>
|
||
<level>warning</level>
|
||
</logger>
|
||
<!-- Official recommendations for systems with <16GB RAM -->
|
||
<mark_cache_size>524288000</mark_cache_size> <!-- 500MB -->
|
||
<concurrent_threads_soft_limit_num>1</concurrent_threads_soft_limit_num>
|
||
<profiles>
|
||
<default>
|
||
<max_block_size>8192</max_block_size>
|
||
<max_download_threads>1</max_download_threads>
|
||
<input_format_parallel_parsing>0</input_format_parallel_parsing>
|
||
<output_format_parallel_formatting>0</output_format_parallel_formatting>
|
||
</default>
|
||
</profiles>
|
||
</clickhouse>
|
||
|
||
# S3-compatible object storage configuration
|
||
# Subchart: https://github.com/bitnami/charts/tree/main/bitnami/minio
|
||
s3:
|
||
# Set to false to use external S3-compatible storage
|
||
# Set to true to deploy internal MinIO (default)
|
||
deploy: true
|
||
|
||
image:
|
||
# Use bitnami legacy repo
|
||
repository: bitnamilegacy/minio
|
||
# image: docker.io/bitnamilegacy/minio:2025.6.13-debian-12-r0
|
||
|
||
# MinIO Console (Browser UI) configuration
|
||
console:
|
||
image:
|
||
repository: bitnamilegacy/minio-object-browser
|
||
# image: docker.io/bitnamilegacy/minio-object-browser:2025.1.10-debian-12-r1
|
||
|
||
# Bitnami MinIO chart configuration (when deploy: true)
|
||
# MinIO provides S3-compatible storage when deployed internally
|
||
auth:
|
||
rootUser: "admin"
|
||
rootPassword: "" # Leave empty to auto-generate into the datastore secret, or set to pin.
|
||
# Webapp credentials for S3 access (defaults to root credentials if not specified)
|
||
accessKeyId: "" # Defaults to rootUser if empty
|
||
secretAccessKey: "" # Defaults to rootPassword if empty
|
||
# Read the auto-generated root credentials from the chart-managed datastore secret.
|
||
# The same keys serve the MinIO subchart (rootUser/rootPassword) and the webapp's
|
||
# S3 credentials, so both stay in sync. Must equal trigger-v4.datastore.secretName.
|
||
existingSecret: "trigger-datastore"
|
||
rootUserSecretKey: "minio-root-user"
|
||
rootPasswordSecretKey: "minio-root-password"
|
||
accessKeyIdSecretKey: "minio-root-user" # Key in existingSecret containing access key ID
|
||
secretAccessKeySecretKey: "minio-root-password" # Key in existingSecret containing secret access key
|
||
|
||
# The required "packets" bucket is created by default.
|
||
defaultBuckets: "packets"
|
||
|
||
persistence:
|
||
enabled: true
|
||
size: 10Gi
|
||
resources: {}
|
||
|
||
# External S3 connection (when deploy: false)
|
||
external:
|
||
endpoint: "" # e.g., "https://s3.amazonaws.com" or "https://your-minio.com:9000"
|
||
accessKeyId: "" # Required when s3.deploy=false — no default. Set explicitly or use existingSecret.
|
||
secretAccessKey: "" # Required when s3.deploy=false — no default. Set explicitly or use existingSecret.
|
||
#
|
||
# Secure credential management
|
||
existingSecret: "" # Name of existing secret containing S3 credentials
|
||
existingSecretAccessKeyIdKey: "access-key-id" # Key in existing secret containing access key ID
|
||
existingSecretSecretAccessKeyKey: "secret-access-key" # Key in existing secret containing secret access key
|
||
#
|
||
# Multi-provider support (optional)
|
||
# To use multiple S3-compatible providers (e.g., S3 + R2), set defaultProtocol and configure named providers
|
||
# via extraEnvVars. For example:
|
||
# - OBJECT_STORE_DEFAULT_PROTOCOL=s3 # Protocol to use for new uploads
|
||
# - OBJECT_STORE_S3_BASE_URL=https://s3.amazonaws.com
|
||
# - OBJECT_STORE_S3_ACCESS_KEY_ID=...
|
||
# - OBJECT_STORE_S3_SECRET_ACCESS_KEY=...
|
||
# - OBJECT_STORE_R2_BASE_URL=https://...r2.cloudflarestorage.com
|
||
# - OBJECT_STORE_R2_ACCESS_KEY_ID=...
|
||
# - OBJECT_STORE_R2_SECRET_ACCESS_KEY=...
|
||
# See documentation for migration guide: https://trigger.dev/docs/self-hosting/env/webapp
|
||
|
||
# Docker Registry configuration
|
||
registry:
|
||
# EXPERIMENTAL - requires ingress/TLS setup or additional cluster configuration. Configure `external` details instead.
|
||
deploy: false
|
||
|
||
# This will be used when deploy: true
|
||
host: "registry.example.com"
|
||
|
||
# Docker repository namespace for deployed images, will be part of the image ref
|
||
repositoryNamespace: "trigger"
|
||
|
||
image:
|
||
registry: docker.io
|
||
repository: registry
|
||
tag: "2"
|
||
pullPolicy: IfNotPresent
|
||
|
||
auth:
|
||
enabled: true
|
||
username: "registry-user"
|
||
password: "" # Required when registry.deploy=true and auth.enabled — no default. Set a strong value.
|
||
|
||
# External Registry connection (when deploy: false)
|
||
external:
|
||
host: "localhost:5001"
|
||
auth:
|
||
enabled: false
|
||
username: ""
|
||
password: ""
|
||
|
||
podAnnotations: {}
|
||
|
||
# podSecurityContext:
|
||
# fsGroup: 1000
|
||
|
||
# securityContext:
|
||
# runAsNonRoot: true
|
||
# runAsUser: 1000
|
||
|
||
# Persistence configuration (Bitnami-style)
|
||
persistence:
|
||
enabled: true
|
||
# Name to assign the volume
|
||
volumeName: "data"
|
||
# Name of an existing PVC to use
|
||
existingClaim: ""
|
||
# The path the volume will be mounted at
|
||
mountPath: "/var/lib/registry"
|
||
# The subdirectory of the volume to mount to
|
||
subPath: ""
|
||
# PVC Storage Class for Registry data volume
|
||
storageClass: ""
|
||
# PVC Access Mode for Registry volume
|
||
accessModes:
|
||
- "ReadWriteOnce"
|
||
# PVC Storage Request for Registry volume
|
||
size: 10Gi
|
||
# Annotations for the PVC
|
||
annotations: {}
|
||
# Labels for the PVC
|
||
labels: {}
|
||
# Selector to match an existing Persistent Volume
|
||
selector: {}
|
||
# Custom PVC data source
|
||
dataSource: {}
|
||
|
||
service:
|
||
type: ClusterIP
|
||
port: 5000
|
||
targetPort: 5000
|
||
resources: {}
|
||
|
||
# Health probe configuration
|
||
livenessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
readinessProbe:
|
||
enabled: true
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
startupProbe:
|
||
enabled: false
|
||
initialDelaySeconds: 0
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 60
|
||
successThreshold: 1
|
||
|
||
# Extra environment variables for Registry
|
||
extraEnvVars:
|
||
[]
|
||
# - name: CUSTOM_VAR
|
||
# value: "custom-value"
|
||
|
||
# Registry ingress configuration
|
||
ingress:
|
||
enabled: false
|
||
className: "traefik"
|
||
# Custom annotations for the ingress resource
|
||
# Note: The following annotation keys are reserved and will be automatically set:
|
||
# - cert-manager.io/cluster-issuer (when certManager.enabled is true)
|
||
# - external-dns.alpha.kubernetes.io/hostname (when externalDns.enabled is true)
|
||
# - external-dns.alpha.kubernetes.io/ttl (when externalDns.enabled is true)
|
||
annotations: {}
|
||
certManager:
|
||
enabled: false
|
||
clusterIssuer: "letsencrypt-prod"
|
||
externalDns:
|
||
enabled: false
|
||
hostname: ""
|
||
ttl: "300"
|
||
hosts:
|
||
- host: registry.local
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
tls:
|
||
[]
|
||
# - secretName: registry-tls
|
||
# hosts:
|
||
# - registry.local
|
||
|
||
# Shared persistent volumes
|
||
persistence:
|
||
# This is used for the worker token file
|
||
shared:
|
||
enabled: true
|
||
size: 5Mi
|
||
accessMode: ReadWriteOnce
|
||
# accessMode: ReadWriteMany # Use for cross-node deployment (requires compatible storage class)
|
||
storageClass: ""
|
||
retain: true # Prevents deletion on uninstall
|
||
|
||
# Telemetry configuration
|
||
telemetry:
|
||
enabled: true
|
||
|
||
# Extra Kubernetes manifests
|
||
# This allows you to add additional Kubernetes resources that will be deployed with the chart
|
||
extraManifests:
|
||
[]
|
||
# - apiVersion: v1
|
||
# kind: ConfigMap
|
||
# metadata:
|
||
# name: my-config
|
||
# data:
|
||
# key: value
|
||
# - apiVersion: apps/v1
|
||
# kind: Deployment
|
||
# metadata:
|
||
# name: my-app
|
||
# spec:
|
||
# replicas: 1
|
||
# selector:
|
||
# matchLabels:
|
||
# app: my-app
|
||
# template:
|
||
# metadata:
|
||
# labels:
|
||
# app: my-app
|
||
# spec:
|
||
# containers:
|
||
# - name: my-container
|
||
# image: nginx:latest
|