Helm chart configuration

The Anjuna Kubernetes Toolset is installed to your cluster using a Helm chart. The chart is configured through a values.yaml file, which you supply at install time. This page describes the values that the chart accepts.

Values are supplied when running helm install, either through a values file or with individual --set overrides. For example:

$ helm install anjuna-cc ${ANJ_K8S_TOOLSET_DIR}/iac/k8s/chart \
  --values values.yaml --wait

For a step-by-step installation walkthrough, see Installing the Anjuna Kubernetes Toolset Helm Chart.

Top-level values

cloud — mandatory

This value specifies the cloud service provider where the target Kubernetes cluster runs. Accepted values are azure and gcp. This value selects which provider-specific block (azure or gcp) is required.

cloud: gcp

image — mandatory

This value specifies the Anjuna Cloud Adaptor container image to deploy. Provide the full image URI.

image: registry.connect.redhat.com/anjuna/anjuna-k8s-sev-tools:2.1.0008

proxyTimeout — optional

This value specifies the timeout for creating Anjuna Confidential Pods, which includes creating and configuring the underlying confidential VMs. Defaults to 10m.

proxyTimeout: "15m"

installOperator — optional

This value specifies whether to install the Anjuna Seaglass Operator as part of the chart. Defaults to true. Set it to false when the Operator is installed separately, such as through the OpenShift OperatorHub.

installOperator: false

maxConfidentialPodVMs — optional

This value specifies the maximum number of Anjuna Confidential Pods that can run simultaneously in the cluster. Defaults to 20. Because each Anjuna Confidential Pod runs in its own confidential VM, this value caps the number of confidential VMs deployed at once.

maxConfidentialPodVMs: 30

nodeSelector

This value selects which Nodes the Anjuna Kubernetes Toolset components are installed to.

nodeSelector.key — mandatory

This value specifies the Node label key used to select target Nodes.

nodeSelector.value — optional

This value specifies the Node label value used to select target Nodes.

nodeSelector:
  key: node-role.kubernetes.io/worker
  value: ""

imagePullSecret — optional

This value configures an image pull secret used when pulling the Anjuna Kubernetes Toolset images from a private container registry. The pull secret is created with the name anjuna-kubernetes-toolset.

There are two mutually exclusive ways to provide the credentials:

  • Set dockerconfigjson to an existing Docker config JSON value.

  • Set registry, username, and password together to have a new pull secret created.

For Google Cloud, only dockerconfigjson is supported.

 
imagePullSecret:
  dockerconfigjson: "<base64-encoded-docker-config-json>"
imagePullSecret:
  registry: "<registry-hostname>"
  username: "<username>"
  password: "<password>"

azure

This section covers provider-specific values for Azure. This block is required when cloud is set to azure.

azure.instanceSize — mandatory (Azure)

This value specifies the default confidential VM size used for any Anjuna Confidential Pod that does not request a specific size through the cvm.anjuna.io/machine_type annotation (see Kubernetes Pod specification).

azure.instanceSizes — optional (Azure)

This value specifies the set of VM sizes that Anjuna Confidential Pods are allowed to request through the cvm.anjuna.io/machine_type annotation (see Kubernetes Pod specification). Provide the sizes as a single comma-separated string — for example, "Standard_DC2as_v5,Standard_DC4as_v5".

An Anjuna Confidential Pod that requests a machine_type outside this set is rejected. If this value is not set, only the default azure.instanceSize is available.

azure.location — mandatory (Azure)

This value specifies the location where the cluster is defined and where Anjuna Confidential Pods run.

azure.resourceGroup — mandatory (Azure)

This value specifies the resource group used to organize the resources created by Anjuna.

azure.subnetId — mandatory (Azure)

This value specifies the subnet ID where the cluster’s Nodes run.

azure.subscriptionId — mandatory (Azure)

This value specifies the ID of the Azure subscription to use.

azure.storageAccount — mandatory (Azure)

This value specifies the name of the Azure storage account to use.

azure.securityGroupId — optional (Azure)

This value specifies the Network Security Group ID to use when creating new NICs for Anjuna Confidential Pods.

azure.credentials — mandatory (Azure)

This value specifies the service principal credentials assigned to the Anjuna Kubernetes Toolset:

  • azure.credentials.clientId: The ID of the service principal.

  • azure.credentials.clientSecret: The authentication secret of the service principal.

  • azure.credentials.tenantId: The ID of the Active Directory tenant that owns the service principal.

azure:
  instanceSize: "<default-vm-size>"
  instanceSizes: "<allowed-vm-sizes>"
  location: "<region>"
  resourceGroup: "<resource-group>"
  subnetId: "<subnet-id>"
  subscriptionId: "<subscription-id>"
  storageAccount: "<storage-account>"
  securityGroupId: "<network-security-group-id>"
  credentials:
    clientId: "<service-principal-client-id>"
    clientSecret: "<client-secret>"
    tenantId: "<tenant-id>"

gcp

This section covers provider-specific values for Google Cloud. This block is required when cloud is set to gcp.

gcp.project — mandatory (GCP)

This value specifies the name of the Google Cloud project where new Anjuna Confidential Pods are placed.

gcp.region — mandatory (GCP)

This value specifies the Google Cloud region where Anjuna Confidential Pods run.

gcp.zone — mandatory (GCP)

This value specifies the Google Cloud zone where Anjuna Confidential Pods run.

gcp.network — mandatory (GCP)

This value specifies the identifier of the private network from which Anjuna Confidential Pods run.

gcp.subnet — mandatory (GCP)

This value specifies the identifier of the subnet used by Anjuna Confidential Pods.

gcp.machine — mandatory (GCP)

This value specifies the machine type for the Anjuna Confidential Pod.

gcp.instanceServiceAccount — optional (GCP)

This value specifies the service account to attach to the created instances, used for tasks such as logging.

gcp.serviceAccountJsonB64 — optional (GCP)

This value specifies the base64-encoded service_account.json file with Google Cloud credentials for managing remote CVMs. This value is required only when the target cluster does not have a running Cloud Credentials Operator.

gcp:
  project: "<project-name>"
  region: "<region>"
  zone: "<zone>"
  network: "<network>"
  subnet: "<subnet-id>"
  machine: "<machine-type>"
  instanceServiceAccount: "<service-account>"
  serviceAccountJsonB64: "<base64-encoded-service-account-json>"

Complete example

The following example configures the chart for a Google Cloud cluster:

cloud: gcp
image: registry.connect.redhat.com/anjuna/anjuna-k8s-sev-tools:2.1.0008
maxConfidentialPodVMs: 20
installOperator: false
nodeSelector:
  key: node-role.kubernetes.io/worker
  value: ""
gcp:
  project: my-project
  region: us-central1
  zone: us-central1-a
  network: my-vpc
  subnet: my-vpc
  machine: n2d-standard-2