cozystack/packages/apps/openbao/values.schema.json

{
  "title": "Chart Values",
  "type": "object",
  "properties": {
    "replicas": {
      "description": "Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas \u003e 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.",
      "type": "integer",
      "default": 1
    },
    "resources": {
      "description": "Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.",
      "type": "object",
      "default": {},
      "properties": {
        "cpu": {
          "description": "CPU available to each replica.",
          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "x-kubernetes-int-or-string": true
        },
        "memory": {
          "description": "Memory (RAM) available to each replica.",
          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "x-kubernetes-int-or-string": true
        }
      }
    },
    "resourcesPreset": {
      "description": "Default sizing preset used when `resources` is omitted.",
      "type": "string",
      "default": "t1.small",
      "enum": [
        "t1.nano",
        "t1.micro",
        "t1.small",
        "t1.medium",
        "t1.large",
        "t1.xlarge",
        "t1.2xlarge",
        "t1.4xlarge",
        "c1.nano",
        "c1.micro",
        "c1.small",
        "c1.medium",
        "c1.large",
        "c1.xlarge",
        "c1.2xlarge",
        "c1.4xlarge",
        "s1.nano",
        "s1.micro",
        "s1.small",
        "s1.medium",
        "s1.large",
        "s1.xlarge",
        "s1.2xlarge",
        "s1.4xlarge",
        "u1.nano",
        "u1.micro",
        "u1.small",
        "u1.medium",
        "u1.large",
        "u1.xlarge",
        "u1.2xlarge",
        "u1.4xlarge",
        "m1.nano",
        "m1.micro",
        "m1.small",
        "m1.medium",
        "m1.large",
        "m1.xlarge",
        "m1.2xlarge",
        "m1.4xlarge",
        "nano",
        "micro",
        "small",
        "medium",
        "large",
        "xlarge",
        "2xlarge"
      ]
    },
    "size": {
      "description": "Persistent Volume Claim size for data storage.",
      "default": "10Gi",
      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        }
      ],
      "x-kubernetes-int-or-string": true
    },
    "storageClass": {
      "description": "StorageClass used to store the data.",
      "type": "string",
      "default": "",
      "x-kubernetes-validations": [
        {
          "rule": "self == oldSelf",
          "message": "storageClass is immutable"
        }
      ],
      "x-cozystack-options": {
        "source": "storageclass"
      }
    },
    "external": {
      "description": "Enable external access from outside the cluster.",
      "type": "boolean",
      "default": false
    },
    "ui": {
      "description": "Enable the OpenBAO web UI.",
      "type": "boolean",
      "default": true
    },
    "seal": {
      "description": "Seal configuration. The default is Shamir key shares. Set `type: static` for auto-unseal.",
      "type": "object",
      "default": {},
      "required": [
        "keyId",
        "secretName",
        "type"
      ],
      "properties": {
        "allowMigration": {
          "description": "Acknowledge a seal migration. The chart refuses to change `type` on an existing instance unless this is `true`. Set it only while running `bao operator unseal -migrate`, then remove it.",
          "type": "boolean",
          "default": false
        },
        "keyId": {
          "description": "Permanent identifier of the current key. OpenBAO stores it with the data the key wraps and picks the key by it, so change it whenever the key material changes. Lowercase alphanumerics, `-`, `.` and `_`, starting and ending with an alphanumeric, because the upstream chart evaluates the server config as a template and rewrites upper case placeholders such as `HOSTNAME` in it. Required when `type` is `static`.",
          "type": "string",
          "default": "",
          "pattern": "^([a-z0-9]([-a-z0-9._]*[a-z0-9])?)?$"
        },
        "previousKeyId": {
          "description": "Identifier of the previous key, with the same character constraints as `keyId`. Required when `previousSecretName` is set.",
          "type": "string",
          "default": "",
          "pattern": "^([a-z0-9]([-a-z0-9._]*[a-z0-9])?)?$"
        },
        "previousSecretName": {
          "description": "Secret holding the previous key during an n-1 key rotation, with the same name constraints as `secretName`. Keep it until the pods have been replaced and the active node has logged `upgrading stored keys`, see the README.",
          "type": "string",
          "default": "",
          "maxLength": 52,
          "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?)?$"
        },
        "secretName": {
          "description": "Existing Secret in the tenant namespace whose key `key` holds the base64 text of 32 random bytes (for example `openssl rand -base64 32`). A cluster administrator creates it, because tenant roles cannot create Secrets. Lowercase alphanumerics and hyphens, at most 52 characters, because the pod volume is named `userconfig-\u003cname\u003e` and a volume name is a DNS label. Required when `type` is `static`.",
          "type": "string",
          "default": "",
          "maxLength": 52,
          "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?)?$"
        },
        "type": {
          "description": "Seal type. `shamir` keeps the current behaviour, `static` enables auto-unseal from `secretName`.",
          "type": "string",
          "default": "shamir",
          "enum": [
            "shamir",
            "static"
          ]
        }
      }
    }
  }
}