bjw-s-labs Helm Charts

The bjw-s-labs/helm-charts repository provides a collection of reusable Helm charts for deploying applications in Kubernetes. The primary charts available are:

• App Template: A specialized application chart built on top of the Common Library. It allows you to deploy any application by defining your Kubernetes resource requirements directly within a values.yaml file.
• Multus CNI: A chart used to deploy Multus CNI into a Kubernetes cluster, which enables pods to have multiple network interfaces.
• Common Library: A library chart that provides reusable template functions for standard Kubernetes resources such as Deployments, Services, ConfigMaps, and Ingress.

You can specify the UID and GID for the container's entrypoint process using runAsUser and runAsGroup.

• Precedence: These settings can also be defined in a PodSecurityContext. However, if a value is specified in the container-level securityContext, it takes precedence over the PodSecurityContext value.
• runAsNonRoot: Setting runAsNonRoot: true forces the Kubelet to validate at runtime that the container is not running as UID 0 (root). If it is, the container will fail to start.
• runAsUser Default: If runAsUser is not specified, it defaults to the user specified in the container image metadata.

You can control the name of the generated Kubernetes Ingress resource using three mutually exclusive methods:

1. forceRename: Provides a complete override of the default resource name.
2. prefix: Prepends a specific string to the default resource name.
3. suffix: Appends a specific string to the default resource name. If not provided, it defaults to the resource identifier if multiple items exist, or an empty string otherwise.

You can control the name of the generated ServiceMonitor resource using one of three mutually exclusive methods:

1. forceRename: Overrides the default resource name entirely.
2. prefix: Prepends a string to the default resource name.
3. suffix: Appends a string to the default resource name. Defaults to the resource identifier if multiple items exist, otherwise empty.

Note: You cannot use forceRename in combination with prefix or suffix.

The seLinuxOptions object defines the SELinux context applied to containers. If this is not specified, the container runtime allocates a random SELinux context for each container.

Precedence and Constraints:

• If seLinuxOptions is set in both SecurityContext (container-level) and PodSecurityContext (pod-level), the value in SecurityContext takes precedence for that specific container.
• This field cannot be used when spec.os.name is set to windows.

You can control the generated name of the RBAC resource using three mutually exclusive methods:

1. prefix: Prepends a string to the resource name.
2. suffix: Appends a string to the resource name. If multiple role instances exist, it defaults to the resource identifier; otherwise, it is empty.
3. forceRename: Completely overrides the default resource name.

Note: You cannot use forceRename in combination with prefix or suffix.

A postStart hook is executed immediately after a container is created. It is used to perform initialization tasks within the container.

Important Behaviors:

• Failure Handling: If the hook handler fails, the container is terminated and restarted according to its defined restart policy.
• Blocking: Other container management operations are blocked until the hook completes.

For more detailed Kubernetes lifecycle specifications, refer to the official Kubernetes documentation.

You can customize the name of the generated Service resource using one of the following methods. Note that these options are mutually exclusive:

1. forceRename: Use this to completely override the default resource name.
2. prefix: Prepend a string to the default resource name.
3. suffix: Append a string to the default resource name. If multiple services are defined, the suffix defaults to the service identifier; otherwise, it is empty.

You can control the name of the generated serviceAccount using three mutually exclusive methods. You cannot use more than one of these at a time:

1. forceRename: Provides a complete override of the default resource name.
2. prefix: Prepends a specific string to the default resource name.
3. suffix: Appends a specific string to the default resource name. If not provided, it defaults to the resource identifier (the key used in the serviceAccount map) if multiple items exist, otherwise it is empty.

The seccompProfile object defines the seccomp (secure computing mode) options for a container. If seccomp options are specified at both the Pod and Container levels, the Container-level settings override the Pod-level settings.

Note: This field cannot be used when spec.os.name is set to windows.

You can modify the generated resource name of a Route using one of three mutually exclusive methods:

1. forceRename: Provides a complete override of the default resource name.
2. prefix: Prepends a string to the default resource name.
3. suffix: Appends a string to the default resource name. If multiple route items exist, the default suffix is the resource identifier; otherwise, it is empty.

The preStop hook is executed immediately before a container is terminated due to an API request or management events (e.g., liveness/startup probe failures, preemption, or resource contention).

Key Behaviors:

• Termination Grace Period: The Pod's termination grace period countdown begins before the preStop hook starts. The container will eventually terminate once the grace period expires, regardless of whether the hook succeeds or fails.
• Blocking: Container management operations block until the hook completes or the grace period is reached.
• Exclusions: The handler is not called if the container crashes or exits on its own.

For more details on Kubernetes container lifecycle hooks, refer to the official Kubernetes documentation.