values.yaml

# An API key is required to connect to the Speedscale cloud.
# If you need a key email support@speedscale.com.
apiKey: ""

# A secret name can be referenced instead of the api key itself.
# The secret must be of the format:
#
# type: Opaque
# data:
#   SPEEDSCALE_API_KEY: <key>
#   SPEEDSCALE_APP_URL: <appUrl>
apiKeySecret: ""

# Speedscale domain to use.
appUrl: "app.speedscale.com"

# The name of your cluster.
clusterName: "my-cluster"

# Cloud provider hint for platform-specific chart behavior. Leave empty for
# generic Kubernetes (vanilla, kind, on-prem, etc.) and set explicitly when
# the chart needs to emit provider-specific scheduling rules or annotations.
#
# Accepted values: "" (default), "aws", "gcp", "azure".
#
# Current effects:
# - "aws":  adds an EKS Fargate exclusion to the nettap DaemonSet's node affinity
#           (eks.amazonaws.com/compute-type NotIn [fargate]). EKS users running
#           mixed Fargate + EC2 node groups should set this; pure EC2 clusters
#           don't strictly need it. GKE Autopilot's warden rejects any node
#           affinity key it doesn't allowlist, which is why this is opt-in
#           rather than always on.
cloudProvider: ""

# Speedscale default component image settings
image:
  registry: gcr.io/speedscale
  tag: v2.5.789
  pullPolicy: Always

# Individual tags to be used by specific components. If specified here, the operator will use the given tag
# when creating resources with that component. If not specified, the above default is used.
imageTags:
  nettap: v0.1.47

# Log level for Speedscale components.
logLevel: "info"

# Namespaces to be watched by Speedscale Operator as a list of names.
namespaceSelector: []

# Filter Rule to apply to the Speedscale Forwarder
filterRule: "standard"

# Data Loss Prevention settings.
dlp:
  # Instructs operator to enable data loss prevention features
  enabled: false

  # Configuration for data loss prevention
  config: "standard"

# If the operator pod/webhooks need to be on the host network.
# This is only needed if the control plane cannot connect directly to a pod
# for eg. if Calico is used as EKS's default networking
# https://docs.tigera.io/calico/3.25/getting-started/kubernetes/managed-public-cloud/eks#install-eks-with-calico-networking
hostNetwork: false

# A set of annotations to be applied to all Speedscale related deployments,
# services, jobs, pods, etc.
#
# Example:
# annotation.first: value
# annotation.second: value
globalAnnotations: {}

# Annotations to be applied to the MutatingWebhookConfiguration and ValidatingWebhookConfiguration resources.
#
# Example (inject CA from an existing secret via cert-manager):
# cert-manager.io/inject-ca-from-secret: speedscale-webhook-certs
webhookAnnotations: {}


# controls whether Speedscale creates the TLS cert secrets (speedscale-certs and speedscale-webhook-certs).
# Disable if you are managing these secrets externally (e.g. cert-manager).
# When disabled, the secrets must exist with those exact names before installing the chart.
createTLSCerts: true

# A set of labels to be applied to all Speedscale related deployments,
# services, jobs, pods, etc.
#
# Example:
# label1: value
# label2: value
globalLabels: {}

# A global pod security context to be applied to all Speedscale related deployments.
# Certain environments such as OpenShift may require specific settings.
globalPodSecurityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  privileged: false
  readOnlyRootFilesystem: true
  runAsUser: 2100
  runAsGroup: 2100
  seccompProfile:
    type: RuntimeDefault
  capabilities:
    drop:
      - ALL

globalSecurityContext:
  runAsNonRoot: true
  fsGroup: 2100
  supplementalGroups: [2100]

# A full affinity object as detailed: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity
affinity: {}

# The list of tolerations as detailed: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
tolerations:
- key: kubernetes.io/arch
  operator: Equal
  value: amd64
  effect: NoSchedule
- key: kubernetes.io/arch
  operator: Equal
  value: arm64
  effect: NoSchedule

# A nodeselector object as detailed: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/
nodeSelector: {}

# Deploy a demo app at startup. Set this to an empty string to not deploy.
# Valid values: ["java", ""]
deployDemo: "java"

# Proxy connection settings if required by your network. These translate to standard proxy environment
# variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY
http_proxy: ""
https_proxy: ""
no_proxy: ""

# control if sidecar init containers should run with privileged set
privilegedSidecars: false

# controls a pre-install job that will create a JKS with standard certs and the Speedscale cert.
# This job requires a root container user, disable if not needed or security policies forbid `runAsNonRoot: true`
createJKS: true

# Settings for the pre-install hook jobs. These run once at the start of a helm install to
# validate credentials and (when createJKS is enabled) build the Java keystore.
preInstall:
  # Bump the memory limit if either job is OOMKilled.
  resources:
    limits:
      cpu: "1"
      memory: 256M
    requests:
      cpu: 100m
      memory: 64M
  # In-pod retry for `speedctl init` to absorb transient errors during install:
  # NetworkPolicy convergence races, DNS warm-up, brief 5xx from the Speedscale API.
  # Default budget: 30 * 2s = ~60 seconds, comfortably under helm's default 5m timeout.
  # Set maxAttempts to 1 to disable in-pod retry.
  maxAttempts: 30
  retryDelaySeconds: 2
  # Job-level retry for pod-level failures the in-pod loop cannot see
  # (eviction, image-pull blip, OOMKill). Kubernetes applies its own exponential
  # backoff between Job retries.
  backoffLimit: 2

# control if the sidecar should enable/disable use of the smart dns lookup feature (requires NET_ADMIN)
disableSidecarSmartReverseDNS: false

# Operator settings. These limits are recommended unless you have a cluster
# with a very large number of workloads (for eg. 10k+ deployments, replicasets, etc.).
operator:
  resources:
    limits:
      cpu: 500m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 128Mi
  # how long to wait for the SUT to become ready
  test_prep_timeout: 10m
  # timeout for deploying & upgrading control plane components
  control_plane_timeout: 5m

# Default sidecar settings. Example:
# sidecar:
#   resources:
#     limits:
#       cpu: 500m
#       memory: 512Mi
#       ephemeral-storage: 100Mi
#     requests:
#       cpu: 10m
#       memory: 32Mi
#       ephemeral-storage: 100Mi
#   ignore_src_hosts: example.com, example.org
#   ignore_src_ips: 8.8.8.8, 1.1.1.1
#   ignore_dst_hosts: example.com, example.org
#   ignore_dst_ips: 8.8.8.8, 1.1.1.1
#   insert_init_first: false
#   tls_out: false
#   reinitialize_iptables: false
sidecar: {}

# Forwarder settings
forwarder:
  replicas: 1
  resources:
    limits:
      cpu: "2"
      memory: 512M
    requests:
      cpu: 300m
      memory: 250M
  # exporters configures additional destinations for captured traffic, keyed by name.
  # Each entry specifies an OTel endpoint to ship traffic to, with optional per-exporter
  # filter rule and DLP config overrides.
  # exporters:
  #   my-exporter:
  #     otel_endpoint: http://otelcol.example.com:4317
  #     filter_rule: standard
  #     dlp_config_id: ""

# Instructs operator to deploy resources necessary to interact with your cluster from the Speedscale dashboard.
dashboardAccess: true
# Provides access WITHIN the cluster for Speedscale to mount secrets for use as variables during tests. These secrets never leave the cluster.
# An empty list means access to all secrets.
secretAccessList: []

# Inspector settings
inspector:
  resources:
    limits:
      cpu: 400m
      memory: 500M
    requests:
      cpu: 200m
      memory: 128M
  # Access labels gate Speedscale operations on this cluster. The inspector
  # reports them to the Speedscale dashboard at registration; an operation
  # is allowed only when the caller's user or API key carries matching labels
  # (set in the Speedscale dashboard). An empty map means no restriction.
  accessLabels: {}

collector:
  resources:
    limits:
      cpu: "1"
      memory: 500M
    requests:
      cpu: 300m
      memory: 250M

replayComponents:
  generator:
    resources:
      limits:
        cpu: "8"
        memory: 8G
      requests:
        cpu: 200m
        memory: 256M
  redis:
    resources:
      limits:
        cpu: 500m
        memory: 2G
      requests:
        cpu: 100m
        memory: 100M
  responder:
    resources:
      limits:
        cpu: "1.5"
        memory: 500M
      requests:
        cpu: 500m
        memory: 250M

# BETA: enable ebpf-based, proxyless traffic capture. To configure, change the capture targets list below to
# the desired namespace and pod selector
ebpf:
  enabled: false
  # nettap must run as root in order to inspect the host file system for
  # other running processes (/proc)
  nettap:
    capture:
      podSecurityContext:
        capabilities:
          add:
          - BPF
          - PERFMON
          - NET_ADMIN
          - SYS_ADMIN
          - SYS_PTRACE
          - SYS_RESOURCE
          drop:
          - ALL
        privileged: false
        runAsGroup: 0
        runAsUser: 0
    ingest:
      podSecurityContext:
        capabilities:
          add:
          - NET_RAW
          drop:
          - ALL
        privileged: false
        runAsGroup: 0
        runAsUser: 0
    securityContext:
      runAsNonRoot: false
    resources:
      limits:
        cpu: 500m
        memory: 1G
      requests:
        cpu: 100m
        memory: 256M
  configuration:
    system:
      cgroupv2Path: /host/sys/fs/cgroup
      procfsPath: /host/proc
      vmlinuxPath: /host/sys/kernel/btf/vmlinux
    logging:
      level: info
      format: json
    telemetry:
      enabled: true
      # OTLP/gRPC endpoint nettap exports its observability data (node/pod
      # snapshots, connection events, metrics) to. Empty falls back to the
      # in-cluster forwarder at speedscale-forwarder.<release-namespace>.svc:4317;
      # required for the Topology and Nodes views in proxymock-web and any
      # other consumer of the forwarder's Topology gRPC service. Override to
      # point at an off-cluster or shared OTLP receiver.
      endpoint: "speedscale-forwarder.speedscale.svc:4317"
      # In-cluster traffic to the forwarder is plaintext (no TLS); the default
      # matches that. Flip to false when targeting an external OTLP receiver
      # that requires TLS.
      insecure: true
    capture:
      # targets to be monitored and captured by the ebpf capture process
      targets: []
        # - name: example
        #   namespaceSelector:
        #     matchLabels:
        #       kubernetes.io/metadata.name: example-namespace
        #   podSelector:
        #     matchLabels:
        #       app: example-app
        #   filters:
        #     - port: 9090
        #     - port: 8443