Project: Kapitan (Provisioning / Automation & Configuration)
File: README.md

is an Ingress controller that uses ConfigMap to store the nginx configuration. To use, add the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. ```console $ helm install stable/nginx-ingress ``` This chart bootstraps an nginx-ingress deployment on a cluster using the package manager. Kubernetes 1.6+ To install the chart with the release name `my-release`: ```console $ helm install --name my-release stable/nginx-ingress ``` The command deploys nginx-ingress on the Kubernetes cluster in the default configuration. The section lists the parameters that can be configured during installation. Tip: List all releases using `helm list` To uninstall/delete the `my-release` deployment: ```console $ helm delete my-release ``` The command removes all the Kubernetes components associated with the chart and deletes the release. The following table lists the configurable parameters of the nginx-ingress chart and their default values. Parameter | Description | Default | | `controller.name` | name of the controller component | `controller` `controller.image.repository` | controller container image repository | `quay.io/kubernetes-ingress-controller/nginx-ingress-controller` `controller.image.tag` | controller container image tag | `0.24.1` `controller.image.pullPolicy` | controller container image pull policy | `IfNotPresent` `controller.image.runAsUser` | User ID of the controller process. Value depends on the Linux distribution used inside of the container image. By default uses debian one. | `33` `controller.containerPort.http` | The port that the controller container listens on for http connections. | `80` `controller.containerPort.https` | The port that the controller container listens on for https connections. | `443` `controller.config` | nginx entries | none `controller.hostNetwork` | If the nginx deployment / daemonset should run on the host's network namespace. Do not set this when `controller.service.externalIPs` is set and `kube-proxy` is used as there will be a port-conflict for port `80` | false `controller.defaultBackendService` | default 404 backend service; required only if `defaultBackend.enabled = false` | `""` `controller.dnsPolicy` | If using `hostNetwork=true`, change to `ClusterFirstWithHostNet`. See for details | `ClusterFirst` `controller.reportNodeInternalIp` | If using `hostNetwork=true`, setting `reportNodeInternalIp=true`, will pass the flag `report-node-internal-ip-address` to nginx-ingress. This sets the status of all Ingress objects to the internal IP address of all nodes running the NGINX Ingress controller. `controller.electionID` | election ID to use for the status update | `ingress-controller-leader` `controller.extraEnvs` | any additional environment variables to set in the pods | `{}` `controller.extraContainers` | Sidecar containers to add to the controller pod. See as example | `{}` `controller.extraVolumeMounts` | Additional volumeMounts to the controller main container | `{}` `controller.extraVolumes` | Additional volumes to the controller pod | `{}` `controller.extraInitContainers` | Containers, which are run before the app containers are started | `[]` `controller.ingressClass` | name of the ingress class to route through this controller | `nginx` `controller.scope.enabled` | limit the scope of the ingress controller | `false` (watch all namespaces) `controller.scope.namespace` | namespace to watch for ingress | `""` (use the release namespace) `controller.extraArgs` | Additional controller container arguments | `{}` `controller.kind` | install as Deployment or DaemonSet | `Deployment` `controller.daemonset.useHostPort` | If `controller.kind` is `DaemonSet`, this will enable `hostPort` for TCP/80 and TCP/443 | false `controller.daemonset.hostPorts.http` | If `controller.daemonset.useHostPort` is `true` and this is non-empty, it sets the hostPort | `"80"` `controller.daemonset.hostPorts.https` | If `controller.daemonset.useHostPort` is `true` and this is non-empty, it sets the hostPort | `"443"` `controller.daemonset.hostPorts.stats` | If `controller.daemonset.useHostPort` is `true` and this is non-empty, it sets the hostPort | `"18080"`

| node taints to tolerate (requires Kubernetes >=1.6) | `[]` `controller.affinity` | node/pod affinities (requires Kubernetes >=1.6) | `{}` `controller.minReadySeconds` | how many seconds a pod needs to be ready before killing the next, during update | `0` `controller.nodeSelector` | node labels for pod assignment | `{}` `controller.podAnnotations` | annotations to be added to pods | `{}` `controller.podLabels` | labels to add to the pod container metadata | `{}` `controller.podSecurityContext` | Security context policies to add to the controller pod | `{}` `controller.replicaCount` | desired number of controller pods | `1` `controller.minAvailable` | minimum number of available controller pods for PodDisruptionBudget | `1` `controller.resources` | controller pod resource requests & limits | `{}` `controller.priorityClassName` | controller priorityClassName | `nil` `controller.lifecycle` | controller pod lifecycle hooks | `{}` `controller.service.annotations` | annotations for controller service | `{}` `controller.service.labels` | labels for controller service | `{}` `controller.publishService.enabled` | if true, the controller will set the endpoint records on the ingress objects to reflect those on the service | `false` `controller.publishService.pathOverride` | override of the default publish-service name | `""` `controller.service.clusterIP` | internal controller cluster service IP | `""` `controller.service.omitClusterIP` | To omit the `clusterIP` from the controller service | `false` `controller.service.externalIPs` | controller service external IP addresses. Do not set this when `controller.hostNetwork` is set to `true` and `kube-proxy` is used as there will be a port-conflict for port `80` | `[]` `controller.service.externalTrafficPolicy` | If `controller.service.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable | `"Cluster"` `controller.service.healthCheckNodePort` | If `controller.service.type` is `NodePort` or `LoadBalancer` and `controller.service.externalTrafficPolicy` is set to `Local`, set this to . If blank, a random port in the `NodePort` range will be assigned | `""` `controller.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` `controller.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `controller.service.enableHttp` | if port 80 should be opened for service | `true` `controller.service.enableHttps` | if port 443 should be opened for service | `true` `controller.service.targetPorts.http` | Sets the targetPort that maps to the Ingress' port 80 | `80` `controller.service.targetPorts.https` | Sets the targetPort that maps to the Ingress' port 443 | `443` `controller.service.type` | type of controller service to create | `LoadBalancer` `controller.service.nodePorts.http` | If `controller.service.type` is either `NodePort` or `LoadBalancer` and this is non-empty, it sets the nodePort that maps to the Ingress' port 80 | `""` `controller.service.nodePorts.https` | If `controller.service.type` is either `NodePort` or `LoadBalancer` and this is non-empty, it sets the nodePort that maps to the Ingress' port 443 | `""` `controller.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 10 `controller.livenessProbe.periodSeconds` | How often to perform the probe | 10 `controller.livenessProbe.timeoutSeconds` | When the probe times out | 5 `controller.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 `controller.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 3 `controller.livenessProbe.port` | The port number that the liveness probe will listen on. | 10254 `controller.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | 10 `controller.readinessProbe.periodSeconds` | How often to perform the probe | 10 `controller.readinessProbe.timeoutSeconds` | When the probe times out | 1

| Minimum consecutive successes for the probe to be considered successful after having failed. | 1 `controller.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 3 `controller.readinessProbe.port` | The port number that the readiness probe will listen on. | 10254 `controller.stats.enabled` | if `true`, enable status page | `false` `controller.stats.service.annotations` | annotations for controller stats service | `{}` `controller.stats.service.clusterIP` | internal controller stats cluster service IP | `""` `controller.stats.service.omitClusterIP` | To omit the `clusterIP` from the stats service | `false` `controller.stats.service.externalIPs` | controller service stats external IP addresses | `[]` `controller.stats.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` `controller.stats.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `controller.stats.service.type` | type of controller stats service to create | `ClusterIP` `controller.metrics.enabled` | if `true`, enable Prometheus metrics | `false` `controller.metrics.service.annotations` | annotations for Prometheus metrics service | `{}` `controller.metrics.service.clusterIP` | cluster IP address to assign to service | `""` `controller.metrics.service.omitClusterIP` | To omit the `clusterIP` from the metrics service | `false` `controller.metrics.service.externalIPs` | Prometheus metrics service external IP addresses | `[]` `controller.metrics.service.labels` | labels for metrics service | `{}` `controller.metrics.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` `controller.metrics.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `controller.metrics.service.servicePort` | Prometheus metrics service port | `9913` `controller.metrics.service.type` | type of Prometheus metrics service to create | `ClusterIP` `controller.metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` `controller.metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` `controller.metrics.serviceMonitor.namespace` | namespace where servicemonitor resource should be created | `the same namespace as nginx ingress` `controller.metrics.serviceMonitor.honorLabels` | honorLabels chooses the metric's labels on collisions with target labels. | `false` `controller.customTemplate.configMapName` | configMap containing a custom nginx template | `""` `controller.customTemplate.configMapKey` | configMap key containing the nginx template | `""` `controller.headers` | configMap key:value pairs containing the for Nginx | `{}` `controller.updateStrategy` | allows setting of RollingUpdate strategy | `{}` `defaultBackend.enabled` | If false, controller.defaultBackendService must be provided | `true` `defaultBackend.name` | name of the default backend component | `default-backend` `defaultBackend.image.repository` | default backend container image repository | `k8s.gcr.io/defaultbackend-amd64` `defaultBackend.image.tag` | default backend container image tag | `1.5` `defaultBackend.image.pullPolicy` | default backend container image pull policy | `IfNotPresent` `defaultBackend.image.runAsUser` | User ID of the controller process. Value depends on the Linux distribution used inside of the container image. By default uses nobody user. | `65534` `defaultBackend.extraArgs` | Additional default backend container arguments | `{}` `defaultBackend.port` | Http port number | `8080` `defaultBackend.tolerations` | node taints to tolerate (requires Kubernetes >=1.6) | `[]` `defaultBackend.affinity` | node/pod affinities (requires Kubernetes >=1.6) | `{}` `defaultBackend.nodeSelector` | node labels for pod assignment | `{}` `defaultBackend.podAnnotations` | annotations to be added to pods | `{}` `defaultBackend.podLabels` | labels to add to the pod container metadata | `{}` `defaultBackend.replicaCount` | desired number of default backend pods | `1` `defaultBackend.minAvailable` | minimum number of available default backend pods for PodDisruptionBudget | `1` `defaultBackend.resources` | default backend pod resource requests & limits | `{}` `defaultBackend.priorityClassName` | default backend priorityClassName | `nil` `defaultBackend.podSecurityContext` | Security context policies to add to the default backend | `{}`

| annotations for default backend service | `{}` `defaultBackend.service.clusterIP` | internal default backend cluster service IP | `""` `defaultBackend.service.omitClusterIP` | To omit the `clusterIP` from the default backend service | `false` `defaultBackend.service.externalIPs` | default backend service external IP addresses | `[]` `defaultBackend.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` `defaultBackend.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `defaultBackend.service.type` | type of default backend service to create | `ClusterIP` `imagePullSecrets` | name of Secret resource containing private registry credentials | `nil` `rbac.create` | if `true`, create & use RBAC resources | `true` `podSecurityPolicy.enabled` | if `true`, create & use Pod Security Policy resources | `false` `serviceAccount.create` | if `true`, create a service account | `` `serviceAccount.name` | The name of the service account to use. If not set and `create` is `true`, a name is generated using the fullname template. | `` `revisionHistoryLimit` | The number of old history to retain to allow rollback. | `10` `tcp` | TCP service key:value pairs. The value is evaluated as a template. | `{}` `udp` | UDP service key:value pairs The value is evaluated as a template. | `{}` ```console $ helm install stable/nginx-ingress --name my-release \ --set controller.stats.enabled=true ``` Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, ```console $ helm install stable/nginx-ingress --name my-release -f values.yaml ``` A useful trick to debug issues with ingress is to increase the logLevel as described ```console $ helm install stable/nginx-ingress --set controller.extraArgs.v=2 ``` Tip: You can use the default Note that the PodDisruptionBudget resource will only be defined if the replicaCount is greater than one, else it would make it impossible to evacuate a node. See for more info. The Nginx ingress controller can export Prometheus metrics. ```console $ helm install stable/nginx-ingress --name my-release \ --set controller.metrics.enabled=true ``` You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`. Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. Add an annotation to the LoadBalancer service: ```yaml controller: service: annotations: external-dns.alpha.kubernetes.io/hostname: kubernetes-example.com. ``` Annotate the controller as shown in the : ```yaml controller: service: targetPorts: http: http https: http annotations: service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:XX-XXXX-X:XXXXXXXXX:certificate/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http" service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600' ``` To configure the LoadBalancer service with the , add the `domainName` annotation and `dns` label: ```yaml controller: service: labels: dns: "route53" annotations: domainName: "kubernetes-example.com" ``` If you are upgrading this chart from a version between 0.31.0 and 1.2.2 then you may get an error like this: ``` Error: UPGRADE FAILED: Service "?????-controller" is invalid: spec.clusterIP: Invalid value: "": field is immutable ``` Detail of how and why are in but to resolve this you can set `xxxx.service.omitClusterIP` to `true` where `xxxx` is the service referenced in the error. ume.size` | Prometheus pushgateway data Persistent Volume size | `2Gi` `pushgateway.persistentVolume.storageClass` | Prometheus pushgateway data Persistent Volume Storage Class | `unset` `pushgateway.persistentVolume.volumeBindingMode` | Prometheus pushgateway data Persistent Volume Binding Mode | `unset` `pushgateway.persistentVolume.subPath` | Subdirectory of Prometheus server data Persistent Volume to mount | `""` `pushgateway.priorityClassName` | pushgateway priorityClassName | `nil` `pushgateway.resources` | pushgateway pod resource requests & limits | `{}` `pushgateway.service.annotations` | annotations for pushgateway service | `{}`

| internal pushgateway cluster service IP | `""` `pushgateway.service.externalIPs` | pushgateway service external IP addresses | `[]` `pushgateway.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` `pushgateway.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `pushgateway.service.servicePort` | pushgateway service port | `9091` `pushgateway.service.type` | type of pushgateway service to create | `ClusterIP` `pushgateway.strategy` | Deployment strategy | `{ "type": "RollingUpdate" }` `rbac.create` | If true, create & use RBAC resources | `true` `server.enabled` | If false, Prometheus server will not be created | `true` `server.name` | Prometheus server container name | `server` `server.image.repository` | Prometheus server container image repository | `prom/prometheus` `server.image.tag` | Prometheus server container image tag | `v2.18.1` `server.image.pullPolicy` | Prometheus server container image pull policy | `IfNotPresent` `server.configPath` | Path to a prometheus server config file on the container FS | `/etc/config/prometheus.yml` `server.global.scrape_interval` | How frequently to scrape targets by default | `1m` `server.global.scrape_timeout` | How long until a scrape request times out | `10s` `server.global.evaluation_interval` | How frequently to evaluate rules | `1m` `server.remoteWrite` | The remote write feature of Prometheus allow transparently sending samples. | `[]` `server.remoteRead` | The remote read feature of Prometheus allow transparently receiving samples. | `[]` `server.extraArgs` | Additional Prometheus server container arguments | `{}` `server.extraFlags` | Additional Prometheus server container flags | `["web.enable-lifecycle"]` `server.extraInitContainers` | Init containers to launch alongside the server | `[]` `server.prefixURL` | The prefix slug at which the server can be accessed | `` `server.baseURL` | The external url at which the server can be accessed | `` `server.env` | Prometheus server environment variables | `[]` `server.extraHostPathMounts` | Additional Prometheus server hostPath mounts | `[]` `server.extraConfigmapMounts` | Additional Prometheus server configMap mounts | `[]` `server.extraSecretMounts` | Additional Prometheus server Secret mounts | `[]` `server.extraVolumeMounts` | Additional Prometheus server Volume mounts | `[]` `server.extraVolumes` | Additional Prometheus server Volumes | `[]` `server.configMapOverrideName` | Prometheus server ConfigMap override where full-name is `{{.Release.Name}}-{{.Values.server.configMapOverrideName}}` and setting this value will prevent the default server ConfigMap from being generated | `""` `server.ingress.enabled` | If true, Prometheus server Ingress will be created | `false` `server.ingress.annotations` | Prometheus server Ingress annotations | `[]` `server.ingress.extraLabels` | Prometheus server Ingress additional labels | `{}` `server.ingress.hosts` | Prometheus server Ingress hostnames | `[]` `server.ingress.extraPaths` | Ingress extra paths to prepend to every Prometheus server host configuration. Useful when configuring | `[]` `server.ingress.tls` | Prometheus server Ingress TLS configuration (YAML) | `[]` `server.nodeSelector` | node labels for Prometheus server pod assignment | `{}` `server.tolerations` | node taints to tolerate (requires Kubernetes >=1.6) | `[]` `server.affinity` | pod affinity | `{}` `server.podDisruptionBudget.enabled` | If true, create a PodDisruptionBudget | `false` `server.podDisruptionBudget.maxUnavailable` | Maximum unavailable instances in PDB | `1` `server.priorityClassName` | Prometheus server priorityClassName | `nil` `server.schedulerName` | Prometheus server alternate scheduler name | `nil` `server.persistentVolume.enabled` | If true, Prometheus server will create a Persistent Volume Claim | `true` `server.persistentVolume.accessModes` | Prometheus server data Persistent Volume access modes | `[ReadWriteOnce]` `server.persistentVolume.annotations` | Prometheus server data Persistent Volume annotations | `{}` `server.persistentVolume.existingClaim` | Prometheus server data Persistent Volume existing claim name | `""` `server.persistentVolume.mountPath` | Prometheus server data Persistent Volume mount root path | `/data` `server.persistentVolume.size` | Prometheus server data Persistent Volume size | `8Gi`

| Prometheus server data Persistent Volume Storage Class | `unset` `server.persistentVolume.volumeBindingMode` | Prometheus server data Persistent Volume Binding Mode | `unset` `server.persistentVolume.subPath` | Subdirectory of Prometheus server data Persistent Volume to mount | `""` `server.emptyDir.sizeLimit` | emptyDir sizeLimit if a Persistent Volume is not used | `""` `server.podAnnotations` | annotations to be added to Prometheus server pods | `{}` `server.podLabels` | labels to be added to Prometheus server pods | `{}` `server.alertmanagers` | Prometheus AlertManager configuration for the Prometheus server | `{}` `server.deploymentAnnotations` | annotations to be added to Prometheus server deployment | `{}` `server.podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | `{}` | `server.replicaCount` | desired number of Prometheus server pods | `1` `server.statefulSet.enabled` | If true, use a statefulset instead of a deployment for pod management | `false` `server.statefulSet.annotations` | annotations to be added to Prometheus server stateful set | `{}` `server.statefulSet.labels` | labels to be added to Prometheus server stateful set | `{}` `server.statefulSet.podManagementPolicy` | podManagementPolicy of server pods | `OrderedReady` `server.statefulSet.headless.annotations` | annotations for Prometheus server headless service | `{}` `server.statefulSet.headless.labels` | labels for Prometheus server headless service | `{}` `server.statefulSet.headless.servicePort` | Prometheus server headless service port | `80` `server.resources` | Prometheus server resource requests and limits | `{}` `server.verticalAutoscaler.enabled` | If true a VPA object will be created for the controller (either StatefulSet or Deployemnt, based on above configs) | `false` `server.securityContext` | Custom for server containers | `{}` `server.service.annotations` | annotations for Prometheus server service | `{}` `server.service.clusterIP` | internal Prometheus server cluster service IP | `""` `server.service.externalIPs` | Prometheus server service external IP addresses | `[]` `server.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` `server.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `server.service.nodePort` | Port to be used as the service NodePort (ignored if `server.service.type` is not `NodePort`) | `0` `server.service.servicePort` | Prometheus server service port | `80` `server.service.sessionAffinity` | Session Affinity for server service, can be `None` or `ClientIP` | `None` `server.service.type` | type of Prometheus server service to create | `ClusterIP` `server.service.gRPC.enabled` | If true, open a second port on the service for gRPC | `false` `server.service.gRPC.servicePort` | Prometheus service gRPC port, (ignored if `server.service.gRPC.enabled` is not `true`) | `10901` `server.service.gRPC.nodePort` | Port to be used as gRPC nodePort in the prometheus service | `0` `server.service.statefulsetReplica.enabled` | If true, send the traffic from the service to only one replica of the replicaset | `false` `server.service.statefulsetReplica.replica` | Which replica to send the traffice to | `0` `server.hostAliases` | /etc/hosts-entries in container(s) | [] `server.sidecarContainers` | array of snippets with your sidecar containers for prometheus server | `""` `server.strategy` | Deployment strategy | `{ "type": "RollingUpdate" }` `serviceAccounts.alertmanager.create` | If true, create the alertmanager service account | `true` `serviceAccounts.alertmanager.name` | name of the alertmanager service account to use or create | `{{ prometheus.alertmanager.fullname }}` `serviceAccounts.alertmanager.annotations` | annotations for the alertmanager service account | `{}` `serviceAccounts.nodeExporter.create` | If true, create the nodeExporter service account | `true` `serviceAccounts.nodeExporter.name` | name of the nodeExporter service account to use or create | `{{ prometheus.nodeExporter.fullname }}` `serviceAccounts.nodeExporter.annotations` | annotations for the nodeExporter service account | `{}` `serviceAccounts.pushgateway.create` | If true, create the pushgateway service account | `true`

| name of the pushgateway service account to use or create | `{{ prometheus.pushgateway.fullname }}` `serviceAccounts.pushgateway.annotations` | annotations for the pushgateway service account | `{}` `serviceAccounts.server.create` | If true, create the server service account | `true` `serviceAccounts.server.name` | name of the server service account to use or create | `{{ prometheus.server.fullname }}` `serviceAccounts.server.annotations` | annotations for the server service account | `{}` `server.terminationGracePeriodSeconds` | Prometheus server Pod termination grace period | `300` `server.retention` | (optional) Prometheus data retention | `"15d"` `serverFiles.alerts` | (Deprecated) Prometheus server alerts configuration | `{}` `serverFiles.rules` | (Deprecated) Prometheus server rules configuration | `{}` `serverFiles.alerting_rules.yml` | Prometheus server alerts configuration | `{}` `serverFiles.recording_rules.yml` | Prometheus server rules configuration | `{}` `serverFiles.prometheus.yml` | Prometheus server scrape configuration | example configuration `extraScrapeConfigs` | Prometheus server additional scrape configuration | "" `alertRelabelConfigs` | Prometheus server for H/A prometheus | "" `networkPolicy.enabled` | Enable NetworkPolicy | `false` `forceNamespace` | Force resources to be namespaced | `null` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, ```console $ helm install stable/prometheus --name my-release \ --set server.terminationGracePeriodSeconds=360 ``` Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, ```console $ helm install stable/prometheus --name my-release -f values.yaml ``` Tip: You can use the default Note that you have multiple yaml files. This is particularly useful when you have alerts belonging to multiple services in the cluster. For example, ```yaml serverFiles: alerts: service1: alert: anAlert serverFiles: alerts: service2: alert: anAlert ``` ```console $ helm install stable/prometheus --name my-release -f values.yaml -f service1-alert.yaml -f service2-alert.yaml ``` Roles and RoleBindings resources will be created automatically for `server` service. To manually setup RBAC you need to set the parameter `rbac.create=false` and specify the service account to be used for each service by setting the parameters: `serviceAccounts.{{ component }}.create` to `false` and `serviceAccounts.{{ component }}.name` to the name of a pre-existing service account. Tip: You can refer to the default `-clusterrole.yaml` and `-clusterrolebinding.yaml` files in to customize your own. AlertManager is configured through . This file (and any others listed in `alertmanagerFiles`) will be mounted into the `alertmanager` pod. Prometheus is configured through . This file (and any others listed in `serverFiles`) will be mounted into the `server` pod. If your cluster allows automatic creation/retrieval of TLS certificates (e.g. ), please refer to the documentation for that mechanism. To manually configure TLS, first create/retrieve a key & certificate pair for the address(es) you wish to protect. Then create a TLS secret in the namespace: ```console kubectl create secret tls prometheus-server-tls --cert=path/to/tls.cert --key=path/to/tls.key ``` Include the secret's name, along with the desired hostnames, in the alertmanager/server Ingress TLS section of your custom `values.yaml` file: ```yaml server: ingress: enabled: true hosts: prometheus.domain.com tls: secretName: prometheus-server-tls hosts: prometheus.domain.com ``` Enabling Network Policy for Prometheus will secure connections to Alert Manager and Kube State Metrics by only accepting connections from Prometheus Server. All inbound connections to Prometheus Server are still allowed. To enable network policy for Prometheus, install a networking plugin that implements the Kubernetes NetworkPolicy spec, and set `networkPolicy.enabled` to true. If NetworkPolicy is enabled for Prometheus' scrape targets, you may also need to manually create a networkpolicy which allows it.