Skip to main content

Helm Values Reference

Configuration reference for zen-lock Helm charts. The main zen-lock chart deploys the webhook and controller; the zen-lock-csi-provider chart deploys the CSI driver.

Adding the Chart Repository​

helm repo add zenmesh https://zenmesh.github.io/helm-charts
helm repo update

Main zen-lock Chart​

Deploys the mutating webhook and controller.

helm install zen-lock zenmesh/zen-lock \
  --namespace zen-lock-system \
  --create-namespace

Values​

ValueDefaultDescription
namespacezen-lock-systemTarget namespace
image.repositoryzenmesh/zen-lockContainer image repository
image.tag0.1.0-betaImage tag
image.pullPolicyIfNotPresentImage pull policy

Webhook Configuration​

ValueDefaultDescription
webhook.replicas2Number of webhook replicas
webhook.failurePolicyFailFail or Ignore on webhook unavailable
webhook.timeoutSeconds10Admission timeout
webhook.resources.requests.cpu100mCPU request
webhook.resources.requests.memory128MiMemory request
webhook.resources.limits.cpu500mCPU limit
webhook.resources.limits.memory512MiMemory limit

Controller Configuration​

ValueDefaultDescription
controller.replicas1Controller replicas (leader-elected)
controller.resources.requests.cpu100mCPU request
controller.resources.requests.memory128MiMemory request
controller.resources.limits.cpu500mCPU limit
controller.resources.limits.memory512MiMemory limit

Private Key Configuration​

ValueDefaultDescription
privateKey.createPlaceholdertrueCreate placeholder secret if missing
privateKey.existingSecretzen-lock-master-keySecret name containing the key
privateKey.activeKeykey.txtKey in the Secret for active identity
privateKey.previousKeyage-previousKey in the Secret for previous identity (rotation)

Network Policy​

ValueDefaultDescription
networkPolicy.enabledfalseEnable egress lockdown
networkPolicy.apiServerCIDRs[]Allowed API server CIDRs
networkPolicy.dnsServers[]Allowed DNS servers

RBAC​

ValueDefaultDescription
rbac.createtrueCreate RBAC resources
serviceAccount.createtrueCreate service account
serviceAccount.namezen-lockService account name

Metrics​

ValueDefaultDescription
metrics.enabledtrueEnable Prometheus metrics
metrics.serviceMonitor.enabledfalseCreate ServiceMonitor

Probes​

ValueDefaultDescription
probes.startup.periodSeconds5Startup probe period
probes.startup.failureThreshold30Startup probe failure threshold
probes.liveness.periodSeconds10Liveness probe period
probes.liveness.failureThreshold3Liveness probe failure threshold
probes.readiness.periodSeconds5Readiness probe period
probes.readiness.failureThreshold3Readiness probe failure threshold

Full Example​

image:
  repository: zenmesh/zen-lock
  tag: "0.1.0-beta"
  pullPolicy: IfNotPresent

webhook:
  replicas: 3
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi

controller:
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi

privateKey:
  createPlaceholder: false
  existingSecret: zen-lock-master-key
  activeKey: key.txt
  previousKey: age-previous

rbac:
  create: true

metrics:
  enabled: true
  serviceMonitor:
    enabled: true

zen-lock-csi-provider Chart​

Deploys the CSI provider for Secrets Store integration.

helm install zen-lock-csi-provider zenmesh/zen-lock-csi-provider \
  --namespace zen-lock-system

Values​

ValueDefaultDescription
image.repositoryzenmesh/zen-lock-csi-providerImage repository
image.digest""Image digest (recommended over tag)

Age Identity​

ValueDefaultDescription
ageIdentity.secretNamezen-lock-master-keySecret containing age keys
ageIdentity.activeKeykey.txtActive key within Secret
ageIdentity.previousKey""Previous key for rotation
ageIdentity.rotationRevision1Rotation revision number

Provider​

ValueDefaultDescription
provider.socketPath/var/run/secrets-store-csi-providers/zen-lock.sockCSI socket path
provider.metricsBindAddress:8080Metrics endpoint
provider.healthProbeBindAddress:8081Health endpoint
provider.audiencezen-lockToken audience for TokenReview

Trusted Node Configuration​

ValueDefaultDescription
trustedNodeLabel.keyzen-lock.security.zen-mesh.io/csi-trustedNode label key
trustedNodeLabel.valuetrueNode label value
scheduleOnControlPlanefalseRun on control plane nodes

Service Account​

ValueDefaultDescription
serviceAccount.createtrueCreate service account
serviceAccount.namezen-lock-csi-providerService account name
serviceAccount.automountServiceAccountTokenfalseAuto-mount token

RBAC​

ValueDefaultDescription
rbac.createtrueCreate RBAC resources

Probes​

ValueDefaultDescription
probes.startup.periodSeconds5Startup probe period
probes.startup.failureThreshold12Startup probe failures
probes.liveness.periodSeconds10Liveness probe period
probes.liveness.failureThreshold3Liveness probe failures
probes.readiness.periodSeconds5Readiness probe period
probes.readiness.failureThreshold3Readiness probe failures

Resources​

ValueDefaultDescription
resources.requests.cpu50mCPU request
resources.requests.memory64MiMemory request
resources.limits.cpu500mCPU limit
resources.limits.memory512MiMemory limit

Metrics​

ValueDefaultDescription
metrics.service.enabledfalseCreate metrics service
metrics.serviceMonitor.enabledfalseCreate ServiceMonitor

Network Policy​

ValueDefaultDescription
networkPolicy.enabledfalseEnable egress lockdown
networkPolicy.apiServerCIDRs[]Allowed API server CIDRs
networkPolicy.apiServerNamespaceSelector{}Alternative to CIDRs
networkPolicy.dnsServers[]Allowed DNS servers
networkPolicy.metricsNamespaceSelector{}Namespaces for metrics

Update Strategy​

ValueDefaultDescription
updateStrategy.typeRollingUpdateUpdate strategy
updateStrategy.rollingUpdate.maxUnavailable1Max unavailable pods

Full Example​

image:
  repository: zenmesh/zen-lock-csi-provider
  digest: "sha256:..."

ageIdentity:
  secretName: zen-lock-master-key
  activeKey: key.txt
  previousKey: age-previous

provider:
  socketPath: /var/run/secrets-store-csi-providers/zen-lock.sock
  metricsBindAddress: ":8080"
  healthProbeBindAddress: ":8081"
  audience: "zen-lock"

trustedNodeLabel:
  key: zen-lock.security.zen-mesh.io/csi-trusted
  value: "true"

scheduleOnControlPlane: false

resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    cpu: 500m
    memory: 512Mi

networkPolicy:
  enabled: true
  apiServerCIDRs:
    - ipBlock:
        cidr: 10.96.0.1/32

updateStrategy:
  type: RollingUpdate
  rollingUpdate:
    maxUnavailable: 1