values.yaml

# Default values for studio.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# -- Secret containing Docker registry credentials
imagePullSecrets: []

global:
  # -- Studio: Hostname for accessing Studio (no http(s) scheme)
  host: "studio.example.com"
  # -- Studio: Base path (prefix)
  basePath: ""
  # -- Studio: Maximum number of views
  maxViews: "100"
  # -- Studio: Maximum number of teams
  maxTeams: "10"
  # -- Studio: Django SECRET_KEY to encrypt, DB, sign reaquests, etc
  # We recommend you set and manage this externally as other secrets (e.g. DB
  # password, user name, REDIS password, etc).
  # If left empty, a random key will be generated. If it's not saved and lost
  # it might be hard to recover the DB.
  secretKey: ""

  # -- (DEPRECATED) Studio: Custom CA certificate in PEM format
  # Deprecated in favor of `customCaCerts`
  # customCaCert: |-
  #   -----BEGIN CERTIFICATE-----
  #   ....
  #   -----END CERTIFICATE-----
  #
  customCaCert: ""

  # -- Studio: Custom CA certificate in PEM format
  # customCaCerts:
  # - |-
  #     -----BEGIN CERTIFICATE-----
  #     ....
  #     -----END CERTIFICATE-----
  #
  customCaCerts: []


  # -- Studio: Additional environment variables for all pods
  envVars: {}
  # Example:
  # envVars:
  #   DEBUG: "True"

  # -- Studio: The name of an existing Secret that contains sensitive environment variables
  # passed to all Studio pods.
  envFromSecret: ""

  blobvault:
    # -- Blobvault local backing store settings.
    # Not used when `global.blobvault.bucket` is set.
    persistentVolume:
      # -- Blobvault local backing store access mode.
      # @default -- ReadWriteOnce
      accessModes:
        - ReadWriteOnce

      # -- Blobvault local backing store storage class.
      # @default -- default storage class in the cluster.
      storageClassName: ""

      # -- Blobvault local backing store size.
      size: 30Gi

    # -- Blobvault S3 bucket name
    bucket: ""
    # -- Blobvault S3 endpoint URL
    endpointUrl: ""
    # -- Blobvault S3 access key ID
    accessKeyId: ""
    # -- Blobvault S3 secret access key ID
    secretAccessKeyId: ""
    # -- Blobvault S3 region
    regionName: ""

  celery:
    # -- Celery broker URL
    brokerUrl: ""
    # -- Celery result URL
    resultBackend: ""

  # -- Studio: Settings related to DataChain
  datachain: {}

  ingress:
    enabled: true
    # -- Configure ingress resource to match hostnames to the service
    hostnameEnabled: true
    # -- Ingress class to use
    className: ""
    # -- Additional Ingress annotations
    annotations: {}
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
    # -- Expose studio under HTTPS protocol
    tlsEnabled: false
    # -- TLS secret name to use for HTTPS on Ingress
    # For ALB Ingress Controller leave empty.
    tlsSecretName: chart-example-tls

  postgres:
    # -- (DEPRECATED) Postgres database URL
    databaseUrl: ""
    # -- (DEPRECATED) Postgres database user
    databaseUser: ""
    # -- (DEPRECATED) Postgres database password
    databasePassword: ""

    # -- Postgres hostname
    host: "studio-postgresql"
    # -- Postgres port
    port: "5432"
    # -- Postgres database name
    databaseName: "iterativeai"
    # -- Postgres user
    user: "postgres"
    # -- Postgres password
    password: "postgres"

  scmProviders:

    # -- Custom hostname for incoming webhook (if Studio runs on a private network and you use SaaS versions of GitHub, GitLab, or Bitbucket)
    # @default -- `$global.host` value.
    webhookHost: ""

    # -- Enable HTTPS protocol for incoming webhooks (this works only if `global.scmProviders.webhookHost` is set; otherwise is ignored).
    tlsEnabled: false

    # -- GitHub App integration with Studio.
    github:
      # -- GitHub enabled
      enabled: false

      # -- GitHub Enterprise URL
      # Set this if you're using the selfhosted version
      url: ""
      # -- GitHub Enterprise API URL
      # Set this if you're using the selfhosted version
      apiUrl: ""

      # -- GitHub OAuth App Name
      appName: ""
      # -- GitHub OAuth App ID
      appId: ""
      # -- GitHub OAuth App Client ID
      clientId: ""
      # -- GitHub OAuth App Secret
      clientSecret: ""
      # -- GitHub OAuth App Private Key
      privateKey: ""

    # -- GitLab App integration with Studio.
    gitlab:
      # -- GitLab enabled
      enabled: false

      # -- GitLab Enterprise Edition URL
      # Set this if you're using the selfhosted version
      url: ""

      # -- GitLab OAuth App Client ID
      clientId: ""
      # -- GitLab OAuth App Secret Key
      secretKey: ""

      # -- GitLab Webhook Secret
      webhookSecret: ""

    # -- BitBucket App integration with Studio.
    bitbucket:
      # -- Bitbucket enabled
      enabled: false

      # -- Bitbucket Server URL
      # Set this if you're using the selfhosted version
      url: ""
      # -- Bitbucket Server API URL
      # Set this if you're using the selfhosted version
      apiUrl: ""

      # -- Bitbucket OAuth App Client ID
      clientId: ""
      # -- Bitbucket OAuth App Secret Key
      secretKey: ""

redis:
  # -- Redis enabled
  enabled: true
  # -- Redis name override
  fullnameOverride: studio-redis

  # -- Redis master configuration
  master:
    ## Redis® master resource requests and limits
    ## ref: https://kubernetes.io/docs/user-guide/compute-resources/
    ## @param master.resources.limits The resources limits for the Redis® master containers
    ## @param master.resources.requests The requested resources for the Redis® master containers
    resources:
      requests:
        cpu: "200m"
        memory: "512Mi"
      limits:
        cpu: "1000m"
        memory: "2Gi"
    # -- Redis master persistence configuration
    persistence:
      # -- Redis master persistence is disabled
      enabled: false

  # -- Redis replica configuration
  replica:
    # -- Redis replica count. 0 for standalone deployment of 1 master and 0 replicas
    replicaCount: 0
    # -- Redis replica persistence configuration
    persistence:
      # -- Redis replica persistence is disabled
      enabled: false

  # -- Redis common configuration to be added into the ConfigMap
  commonConfiguration: |-
    timeout 20

  # -- Redis authentication settings
  auth:
    # -- Redis authentication disabled
    enabled: false

postgresql:
  # -- Postgres enabled
  enabled: true
  # -- Postgres name override
  fullnameOverride: studio-postgresql

  image:
    tag: 14.5.0-debian-11-r35
  # Change this before deploying
  global:
    postgresql:
      auth:
        # -- Postgres password
        postgresPassword: postgres
        # -- Postgres database
        database: iterativeai

clickhouse:
  # -- ClickHouse enabled
  enabled: false
  # -- ClickHouse name override
  fullnameOverride: studio-clickhouse

  # Shards / replicas configuration
  replicaCount: 1
  shards: 1

  # Change this before deploying
  auth:
    # -- ClickHouse password
    password: "clickhouse"

# -- PgBouncer settings group
pgBouncer:
  enabled: false

  # -- PgBouncer image settings
  image:
    # -- PgBouncer image repository
    repository: docker.io/bitnami/pgbouncer
    # -- PgBouncer image pull policy
    pullPolicy: IfNotPresent
    # -- PgBouncer image tag
    tag: "1.22.1"

  service:
    type: ClusterIP
    port: 6432

  # -- Additional environment variables for PgBouncer pods
  envVars: {}
  # Example:
  # envVars:
  #   DEBUG: "True"

  # -- The name of an existing Secret that contains sensitive environment variables.
  envFromSecret: ""

  replicaCount: 1

  # -- PgBouncer resources configuration
  resources:
    # -- PgBouncer requests configuration
    requests:
      cpu: 500m
      memory: 512Mi
    # -- PgBouncer limits configuration
    limits:
      memory: 1024Mi

  # -- PgBouncer autoscaling configuration
  autoscaling:
    # -- PgBouncer autoscaling enabled flag
    enabled: false
    # -- PgBouncer autoscaling min replicas
    minReplicas: 1
    # -- PgBouncer autoscaling max replicas
    maxReplicas: 5
    # -- PgBouncer autoscaling target CPU utilization percentage
    targetCPUUtilizationPercentage: 80
    # -- PgBouncer autoscaling target memory utilization percentage
    # targetMemoryUtilizationPercentage: 80

  # -- Additional PgBouncer pod annotations
  podAnnotations: {}

  # -- PgBouncer pod security context configuration
  podSecurityContext: {}
  # fsGroup: 2000

  # -- PgBouncer pod security context configuration
  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
  # runAsUser: 1000

  # -- PgBouncer service account name
  serviceAccountName: ""

  # -- PgBouncer pod node selector configuration
  nodeSelector: {}

  # -- PgBouncer pod tolerations configuration
  tolerations: []

  # -- PgBouncer pod affinity configuration
  affinity: {}

# -- Studio UI settings group
studioUi:
  # -- Additional environment variables for ui pods
  envVars: {}
  # Example:
  # envVars:
  #   DEBUG: "True"

  # -- The name of an existing Secret that contains sensitive environment variables
  # passed to UI pods.
  envFromSecret: ""

  replicaCount: 1

  image:
    repository: docker.iterative.ai/studio-frontend
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    # tag: "v1.34.0"

  service:
    type: ClusterIP
    port: 3000

  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      memory: 2Gi

  strategy:
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  podAnnotations: {}

  podSecurityContext: {}
  # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  nodeSelector: {}

  tolerations: []

  affinity: {}

# -- Studio Backend settings group
studioBackend:
  # -- Additional environment variables for backend pods
  envVars: {}
  # Example:
  # envVars:
  #   DEBUG: "True"

  # -- The name of an existing Secret that contains sensitive environment variables
  # passed to backend pods.
  envFromSecret: ""

  # -- Number of replicas of backend pods
  replicaCount: 1

  image:
    repository: docker.iterative.ai/studio-backend
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    # tag: "v1.34.0"

  service:
    type: ClusterIP
    port: 8000

  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      memory: 2Gi

  strategy:
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  podAnnotations: {}

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  nodeSelector: {}

  tolerations: []

  affinity: {}

# -- Studio Beat settings group
studioBeat:
  # -- Additional environment variables for beat pods
  envVars: {}
  # Example:
  # envVars:
  #   DEBUG: "True"

  # -- The name of an existing Secret that contains sensitive environment variables
  # passed to beat pods.
  envFromSecret: ""

  replicaCount: 1

  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      memory: 256Mi

  strategy:
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  podAnnotations: {}

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  nodeSelector: {}

  tolerations: []

  affinity: {}

# -- Studio worker settings group
studioWorker:
  # -- Studio worker image settings
  image:
    # -- Studio worker image repository
    repository: docker.iterative.ai/studio-backend
    # -- Studio worker image pull policy
    pullPolicy: IfNotPresent
    # -- Overrides the image tag whose default is the chart appVersion.
    # tag: "v1.34.0"

  # -- Additional environment variables for worker pods
  envVars: {}
  # Example:
  # envVars:
  #   DEBUG: "True"

  # -- The name of an existing Secret that contains sensitive environment variables
  # passed to worker pods.
  envFromSecret: ""

  replicaCount: 1

  # -- Worker log level
  logLevel: "info"

  # -- Worker resources configuration
  resources:
    # -- Worker resource requests configuration
    requests:
      cpu: 500m
      memory: 512Mi
    # -- Worker resource limits configuration
    limits:
      memory: 1Gi

  # -- Worker deployment strategy
  strategy:
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1

  # -- Worker termination grace period
  terminationGracePeriodSeconds: 150

  # -- Worker autoscaling configuration
  autoscaling:
    # -- Worker autoscaling enabled flag
    enabled: false
    # -- Worker autoscaling minimum replicas
    minReplicas: 1
    # -- Worker autoscaling maximum replicas
    maxReplicas: 5
    # -- Worker autoscaling target CPU utilization percentage
    # targetCPUUtilizationPercentage: 80
    # -- Worker autoscaling target memory utilization percentage
    # targetMemoryUtilizationPercentage: 80

    # -- Worker autoscaling annotation
    annotations: {}

    # -- Worker Custom or additional autoscaling metrics
    # Custom or additional autoscaling metrics
    # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
    template: []
    # - type: External
    #   external:
    #     metric:
    #       name: celery-queue-length
    #       selector:
    #         matchLabels:
    #           type: prometheus
    #     target:
    #       type: Value
    #       value: "1"

    # -- Worker autoscaling behavior
    behavior: {}
    # scaleUp:
    #   stabilizationWindowSeconds: 15
    #   policies:
    #     - type: Percent
    #       value: 100
    #       periodSeconds: 1
    #     - type: Pods
    #       value: 2
    #       periodSeconds: 1
    # scaleDown:
    #   stabilizationWindowSeconds: 120
    #   policies:
    #     - type: Pods
    #       value: 1
    #       periodSeconds: 60

  # -- Additional worker pod annotations
  podAnnotations: {}

  # -- Worker pod security context
  podSecurityContext: {}
    # fsGroup: 2000

  # -- Worker security context
  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  # -- Worker node selector
  nodeSelector: {}
  # -- Worker tolerations
  tolerations: []
  # -- Worker affinity
  affinity: {}

  serviceAccount:
    # Specifies whether a service account should be created
    create: false
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  # -- Ephemeral storage configuration
  ephemeralStorage:
    # -- Ephemeral Storage type. Possible values: `emptyDir`,  `ephemeral`, `pvc`, `pvcRWX`
    type: ephemeral
    # -- Ephemeral Storage size
    size: 1Gi
    # -- Persistent Volume Claim configuration for ephemeral storage (if type is set `pvc`)
    persistentVolumeClaim:
      # -- Persistent Volume Claim name, to mount externally managed PVC (`ephemeralStorage.type` has to be set to `pvc`)
      claimName: "worker"
      # -- Persistent Volume Claim `storageClass` name, by default it will use the default `storageClass`(not used when `pvc` is set as type)
      storageClass: ""


# -- Studio DataChain Worker settings group
studioDatachainWorker:

  # -- DataChain worker image settings
  image:
    # -- DataChain worker image repository
    repository: docker.iterative.ai/studio-datachain-worker
    # -- DataChain worker image pull policy
    pullPolicy: IfNotPresent
    # -- Overrides the image tag whose default is the chart appVersion.
    # tag: "v1.34.0"

  # -- Additional environment variables for DataChain worker pods
  envVars: {}
  # Example:
  # envVars:
  #   DEBUG: "True"

  # -- The name of an existing Secret that contains sensitive environment variables passed to
  # DataChain worker pods.
  envFromSecret: ""

  replicaCount: 1

  # -- DataChain worker log level
  logLevel: "info"

  # -- DataChain worker resources configuration
  resources:
    # -- DataChain worker requests configuration
    requests:
      cpu: 1000m
      memory: 3Gi
      ephemeral-storage: 10Gi
    # -- DataChain worker limits configuration
    limits:
      memory: 16Gi
      ephemeral-storage: 20Gi

  # -- DataChain worker deployment strategy
  strategy:
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 25%

#  livenessProbe:
#    # -- DataChain worker liveness probe `initialDelaySeconds`
#    initialDelaySeconds: 10
#    # -- DataChain worker liveness probe `periodSeconds`
#    periodSeconds: 10
#    # -- DataChain worker liveness probe `timeoutSeconds`
#    timeoutSeconds: 10

  # -- DataChain worker termination grace period
  terminationGracePeriodSeconds: 180

  # -- DataChain worker autoscaling configuration
  autoscaling:
    # -- DataChain worker autoscaling enabled flag
    enabled: false
    # -- DataChain worker autoscaling min replicas
    minReplicas: 1
    # -- DataChain worker autoscaling max replicas
    maxReplicas: 5
    # -- DataChain worker autoscaling target CPU utilization percentage
    targetCPUUtilizationPercentage: 80
    # -- DataChain worker autoscaling target memory utilization percentage
    # targetMemoryUtilizationPercentage: 80

    # -- Worker autoscaling annotation
    annotations: {}

    # -- DataChain worker Custom or additional autoscaling metrics
    # Custom or additional autoscaling metrics
    # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
    template: []
    # - type: External
    #   external:
    #     metric:
    #       name: celery-queue-length
    #       selector:
    #         matchLabels:
    #           type: prometheus
    #     target:
    #       type: Value
    #       value: "1"

    # -- DataChain worker autoscaling behavior
    behavior: {}
    # scaleUp:
    #   stabilizationWindowSeconds: 15
    #   policies:
    #     - type: Percent
    #       value: 100
    #       periodSeconds: 1
    #     - type: Pods
    #       value: 2
    #       periodSeconds: 1
    # scaleDown:
    #   stabilizationWindowSeconds: 120
    #   policies:
    #     - type: Pods
    #       value: 1
    #       periodSeconds: 60

  # -- Additional DataChain worker pod annotations
  podAnnotations: {}

  # -- DataChain worker pod security context configuration
  podSecurityContext: {}
    # fsGroup: 2000

  # -- DataChain worker pod security context configuration
  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  # -- DataChain worker pod node selector configuration
  nodeSelector: {}

  # -- DataChain worker pod tolerations configuration
  tolerations: []

  # -- DataChain worker pod affinity configuration
  affinity: {}

  serviceAccount:
    # Specifies whether a service account should be created
    create: true
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

# -- Studio DataChain Worker Job template settings group
studioDatachainWorkerJobTemplate:

  # -- DataChain worker Job image settings
  image:
    # -- DataChain worker Job image repository
    repository: docker.iterative.ai/studio-datachain-worker
    # -- DataChain worker Job image pull policy
    pullPolicy: IfNotPresent
    # -- Overrides the image tag whose default is the chart appVersion.
    # tag: "v1.34.0"

  # -- Additional environment variables for DataChain worker Job pods
  envVars: {}
  # Example:
  # envVars:
  #   DEBUG: "True"

  # -- DataChain worker idle timeout
  idleTimeout: 1800  # 30 minutes

  # -- DataChain worker Job log level
  logLevel: "info"

  # -- DataChain worker Job quota
  jobQuota: 10

  # -- DataChain worker Job resources configuration
  resources:
    # -- DataChain worker Job requests configuration
    requests:
      cpu: 1000m
      memory: 3Gi
      ephemeral-storage: 10Gi
    # -- DataChain worker Job limits configuration
    limits:
      memory: 16Gi
      ephemeral-storage: 20Gi

  # -- Ephemeral storage configuration
  ephemeralStorage:
    # -- Ephemeral Storage type. Possible values: `emptyDir`,  `ephemeral`, `pvc`, `pvcRWX`
    type: ephemeral
    # -- Ephemeral Storage size
    size: 20Gi
    # -- Persistent Volume Claim configuration for ephemeral storage (if type is set `pvc`)
    persistentVolumeClaim:
      # -- Persistent Volume Claim name, to mount externally managed PVC (`ephemeralStorage.type` has to be set to `pvc`)
      claimName: "datachain-worker"
      # -- Persistent Volume Claim `storageClass` name, by default it will use the default `storageClass`(not used when `pvc` is set as type)
      storageClass: ""

  # -- Local storage configuration (used for storing DataChain virtual environments)
  localStorage:
    # -- Local Storage type. Possible values: `emptyDir`,  `ephemeral`, `pvc`
    type: ephemeral
    # -- Local Storage size
    size: 50Gi
    # -- Persistent Volume Claim configuration for local storage
    persistentVolumeClaim:
      # -- Persistent Volume Claim name, to mount externally managed PVC (`localStorage.type` has to be set to `pvc`)
      claimName: "datachain-worker-local"
      # -- Persistent Volume Claim `storageClass` name, by default it will use the default `storageClass`(not used when `pvc` is set as type)
      storageClass: ""

#  livenessProbe:
#    # -- DataChain worker Job liveness probe `initialDelaySeconds`
#    initialDelaySeconds: 10
#    # -- DataChain worker Job liveness probe `periodSeconds`
#    periodSeconds: 10
#    # -- DataChain worker Job liveness probe `timeoutSeconds`
#    timeoutSeconds: 10

  # -- DataChain worker Job active deadline (seconds)
  activeDeadlineSeconds: 86400

  # -- DataChain worker Job TTL after finished (seconds)
  ttlSecondsAfterFinished: 5

  # -- DataChain worker Job backoff limit
  backoffLimit: 0

  # -- Additional DataChain worker Job pod annotations
  podAnnotations: {}

  # -- DataChain worker Job pod security context configuration
  podSecurityContext: {}
    # fsGroup: 2000

  # -- DataChain worker Job security context configuration
  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  # -- DataChain worker Job security context configuration
  runtimeClassName: null  # gvisor

  # -- DataChain worker Job pod node selector configuration
  nodeSelector: {}

  # -- DataChain worker Job pod tolerations configuration
  tolerations: []

  # -- DataChain worker Job pod affinity configuration
  affinity: {}

  serviceAccount:
    # Specifies whether a service account should be created
    create: false
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

# -- Studio: Additional service to expose the blobvault files generated by the worker
# It is enabled automatically if the worker is scaled to 1 replica and no bucket is configured
studioBlobvault:

  # -- Image to use for the blobvault service
  image:
    # -- Image repository
    repository: nginx
    # -- Image tag
    tag: 1.27.4-alpine

  service:
    port: 80

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

serviceAccount:
  # Specifies whether a service account should be created
  create: false
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""