values.yaml

global:
  convoy:
    # -- Docker image tags for all convoy components
    image: &image "getconvoy/convoy"
    # -- Docker image tags for all convoy components
    tag: &tag "v26.7.6"
    # -- docker-registry secrets used to pull global.convoy.image. Applied to server and agent pods.
    imagePullSecrets: []
    # -- Logger Level for all convoy components
    log_level: &logLevel "error"
    # -- Convoy Environment
    environment: &environment "oss"
    # -- JWT Secret key
    jwt_secret: &jwtSecret "convoy-secret"
    # -- JWT Refresh Secret key
    jwt_refresh_secret: &jwtRefreshSecret "convoy-refresh-secret"
    # -- Existing Kubernetes Secret name for JWT secrets. Recommended for production. When set, JWT secret values are ignored; the secret must contain 'jwt_secret' and 'jwt_refresh_secret' keys.
    jwt_secret_name: ""
    # -- Tracing config for all convoy services
    tracer_enabled: &tracerEnabled false
    # -- Tracing provider type
    tracer_type: &tracerType "otel"
    # -- Open Telemetry auth header name
    otel_auth_header_name: &otelHeaderName ""
    # -- Open Telemetry auth header value
    otel_auth_header_value: &otelHeaderValue ""
    # -- Open Telemetry sample rate
    otel_sample_rate: &otelSampleRate 1
    # -- Open Telemetry collector url
    otel_collector_url: &otelCollectorUrl ""
    # -- Open Telemetry insecure skip verify
    otel_insecure_skip_verify: &otelInsecureSkipVerify true
    # -- Sentry DSN
    sentry_dsn: &sentryDsn ""
    # -- Sentry debug mode
    sentry_debug: &sentryDebug false
    # -- Sentry environment
    sentry_environment: *environment

    # Licensed partition drop and keep window. Optional global defaults apply to
    # server and agent unless overridden under server.env / agent.env:
    #   retention_enabled (default true)
    #   retention_period (omit = app default 720h)
    #   webhook_archiving_enabled (omit = app default false)
    # Deprecated per-component aliases still work: retention_policy.policy / .enabled
    # When period / archiving are unset everywhere, chart omits those env vars so
    # extraEnvs CONVOY_RETENTION_POLICY(_ENABLED) still migrate.
    retention_enabled: &retentionEnabled true
    # -- Enable usage analytics
    enable_usage_analytics: &enabledUsageAnalytics true
    # -- API version
    api_version: &apiVersion "2024-01-01"
    # -- License Key
    license_key: &licenseKey ""
    # -- If this secret parameter is not empty, the inline license key value will be ignored.
    # The license key should be present in the 'license_key' key of the specified secret.
    license_key_secret_name: ""
    # -- Dispatcher CA Certificate configuration. If provided, it will use the content of the secret
    cacert_secret_name: ""
    # -- Dispatcher CA Certificate content. If provided, a secret will be created with this content
    cacert_content: ""
    # -- Enable Google OAuth SSO for user authentication
    google_oauth_enabled: &googleOAuthEnabled false
    # -- Google OAuth Client ID from Google Cloud Console
    google_oauth_client_id: &googleOAuthClientId ""
    # -- Google OAuth Redirect URL for callback handling
    google_oauth_redirect_url: &googleOAuthRedirectUrl ""
    # -- Enable Portal Realm authentication for enhanced security
    portal_realm_enabled: &portalRealmEnabled false
    # -- Sentry sample rate for error sampling (0.0 to 1.0)
    sentry_sample_rate: &sentrySampleRate 1.0
    # -- Database read replica DSN for improved performance
    read_replica_dsn: &readReplicaDsn ""
    # -- Connections each Convoy process may open to Postgres. This is Convoy's
    # own default, stated here because it needs sizing rather than accepting:
    # multiply it by the number of processes (server, agent, and any ingest or
    # worker) and keep the total comfortably below the database's max_connections,
    # or a rolling restart exhausts them. The Postgres queue makes this sharper,
    # since queue, cache, rate limiter, circuit breaker and lock traffic all move
    # onto this pool. Blank falls back to Convoy's default.
    db_max_open_conn: 100
    # -- Queue provider: redis (default) or postgres. Postgres is experimental and
    # needs a paid license plus "postgres-queue" in both server.env.enable_feature_flag
    # and agent.env.enable_feature_flag; rendering fails without it. When postgres, set
    # redis.enabled to false and size Postgres for queue, cache, rate limiter, circuit
    # breaker, and lock traffic in addition to application queries.
    queue_provider: redis
    postgresQueue:
      batchSize: 64
      batchWaitMs: 2
      writeConcurrency: 8
      leaseTimeoutSeconds: 90
      claimBatchSize: 64
      pollIdleMs: 5
      cacheLocalReadTtlMs: 1000
      cacheLocalReadSize: 10000

  externalDatabase:
    # -- Enable an external database; This will use postgresql chart, Change values if you use an external database
    enabled: true
    # -- Host for the external database
    host: "postgresql"
    # -- Password for the external database
    postgresPassword: &postgresPassword postgres
    # -- Database name for the external database
    database: &postgresDatabase convoy
    # -- Password for the external database, ignored in case of secret parameter with non-empty value
    password: &userPassword postgres
    # -- If this secret parameter is not empty, the password value will be ignored. The password in the secret should be in the 'password' key
    secret: ""
    # -- Username for the external database
    username: &username postgres
    # -- Query params for the external database
    options: "sslmode=disable&connect_timeout=30"
    # -- Port for the external database
    port: 5432
    # -- Read replicas for the external database, as a list of database objects.
    # Convoy decodes this as a JSON array, so a mapping here is rejected. Reading
    # from replicas also needs the "read-replicas" feature flag and a license.
    readReplicas: []
  #      - scheme: "postgres"
  #        host: ""
  #        username: ""
  #        password: ""
  #        database: "convoy"
  #        port: 5432
  #        options: "sslmode=disable&connect_timeout=30"

  nativeRedis:
    # -- Enable redis; This will use redis chart, Disable if you use an external redis
    enabled: &redisEnabled true
    # -- Host for the redis
    host: "redis-master"
    # -- password for the redis, ignored in case of secret parameter with non-empty value
    password: &redisPassword "convoy"
    # -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
    secret: ""
    # -- Port for the redis
    port: 6379

  externalRedis:
    # -- Enable external redis, Enable this if you use an external redis and disable Native redis
    enabled: false
    # -- redis cluster addresses, if set the other values won't be used
    addresses: ""
    # -- Host for the external redis
    host: "redis-master"
    # -- Scheme for the external redis. This can be redis, rediss, redis-socket or redis-sentinel
    scheme: "redis"
    # -- Redis Sentinel master name (required when scheme is redis-sentinel)
    sentinelMasterName: "mymaster"
    # -- Redis Sentinel auth username (optional)
    sentinelUsername: ""
    # -- Redis Sentinel auth password (optional)
    sentinelPassword: ""
    # -- Secret containing sentinel password; key: password. If set, sentinelPassword is ignored
    sentinelSecret: ""
    # -- username for the external redis.
    username: ""
    # -- password for the external redis, ignored in case of secret parameter with non-empty value
    password: "convoy"
    # -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
    secret: ""
    # -- Database name for the external redis.
    database: "0"
    # -- Port for the external redis
    port: "6379"

# @ignored, used in case of external chart
postgresql:
  # -- Set to false if you don't want to create a postgres instance
  enabled: true
  fullnameOverride: "postgresql"
  image:
    registry: docker.io
    repository: bitnamilegacy/postgresql
    tag: 17.6.0-debian-12-r4
    pullPolicy: IfNotPresent
  global:
    postgresql:
      auth:
        postgresPassword: *postgresPassword
        username: *username
        password: *userPassword
        database: *postgresDatabase

# @ignored, used in case of external chart
redis:
  # -- Set to false if you don't want to create a redis instance
  enabled: true
  image:
    registry: docker.io
    repository: bitnamilegacy/redis
    tag: &redisImageTag 8.2.1-debian-12-r0
    pullPolicy: IfNotPresent
  sentinel:
    image:
      registry: docker.io
      repository: bitnamilegacy/redis-sentinel
      tag: *redisImageTag
      pullPolicy: IfNotPresent
  architecture: standalone
  fullnameOverride: "redis"
  auth:
    enabled: *redisEnabled
    password: *redisPassword

agent:
  # -- Enable the agent component
  enabled: true
  image:
    # -- Repository to be used by the agent. The latest tag is used by default
    repository: *image
    # -- Pull policy for the agent image
    pullPolicy: IfNotPresent
    # @ignored
    tag: *tag

  env:
    environment: *environment
    proxy: ""
    sign_up_enabled: false
    log_level: *logLevel
    auth:
      jwt:
        enabled: true
        secret: *jwtSecret
        refresh_secret: *jwtRefreshSecret
    smtp:
      enabled: false
      from: ""
      # -- Ignored in case of secret parameter with non-empty value
      password: ""
      # -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
      secret: ""
      port: 0
      provider: ""
      url: ""
      username: ""
      ssl: false
      reply_to: ""
    # @ignored
    tracer:
      type: *tracerType
      enabled: *tracerEnabled
      otel:
        otel_auth:
          header_name: *otelHeaderName
          header_value: *otelHeaderValue
        sample_rate: *otelSampleRate
        collector_url: *otelCollectorUrl
        insecure_skip_verify: *otelInsecureSkipVerify
      sentry:
        dsn: *sentryDsn
        debug: *sentryDebug
        environment: *environment
    pyroscope:
      enabled: false
      url: ""
      username: ""
      password: ""
      profile_id: ""
    enable_feature_flag: []
    retention:
      enabled: *retentionEnabled
    webhook_archiving: {}
    analytics_enabled: *enabledUsageAnalytics
    storage:
      enabled: false
      type: ""
      on_prem:
        path: ""
      s3:
        bucket: ""
        prefix: ""
        accessKey: ""
        # -- Ignored in case of secret parameter with non-empty value
        secretKey: ""
        # -- If this secret parameter is not empty, secretKey value will be ignored. The password in the secret should be in the 'secretKey' key
        secret: ""
        region: ""
        session_token: ""
        endpoint: ""
      azure_blob:
        account_name: ""
        # -- Ignored in case of secret parameter with non-empty value
        account_key: ""
        # -- If this secret parameter is not empty, account_key value will be ignored. The account key should be in the 'accountKey' key
        secret: ""
        container_name: ""
        endpoint: ""
        prefix: ""
    consumer_pool_size: 100
    enable_profiling: false
    metrics:
      enabled: false
      metrics_backend: prometheus
      prometheus_metrics:
        sample_time: 5
    instance_ingest_rate: 100
    worker_execution_mode: default
    max_retry_seconds: 7200
    license_key: *licenseKey
    dispatcher:
      insecure_skip_verify: false
      allow_list: ["0.0.0.0/0"]
      deny_list: ["127.0.0.1/8", "169.254.169.254/32"]
  app:
    replicaCount: 1
    resources: {}
    # limits:
    #   cpu: 1000m
    #   memory: 2000Mi
    # requests:
    #   cpu: 1000m
    #   memory: 1000Mi

  service:
    # -- Type of service for the agent
    type: ClusterIP
    # -- Port for the agent service
    port: 80

  autoscaling:
    # -- Enable autoscaling for the agent
    enabled: false
    minReplicas: 2
    maxReplicas: 10
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80
    behavior:
      scaleDown:
        stabilizationWindowSeconds: 300
        policies:
          - type: Percent
            value: 50
            periodSeconds: 60
          - type: Pods
            value: 2
            periodSeconds: 60
        selectPolicy: Min
      scaleUp:
        stabilizationWindowSeconds: 0
        policies:
          - type: Percent
            value: 100
            periodSeconds: 60
          - type: Pods
            value: 2
            periodSeconds: 60
        selectPolicy: Max

  podDisruptionBudget: {}
    # -- Pod disruption budget
  #    maxUnavailable: 1
  #    minAvailable: 1

  securityContext: {}

server:
  # -- Enable the server component
  enabled: true
  image:
    # -- Repository to be used by the server. The latest tag is used by default
    repository: *image
    # -- Pull policy for the server image
    pullPolicy: IfNotPresent
    # @ignored
    tag: *tag

  env:
    environment: *environment
    log_level: *logLevel
    host: ""
    # -- Configure root patth for convoy server e.g. "/convoy"
    root_path: ""
    sign_up_enabled: false
    # -- Max response body when ingesting webhooks (might be renamed). Defaults to 50KB
    max_response_size: 50
    auth:
      jwt:
        enabled: true
        secret: *jwtSecret
        refresh_secret: *jwtRefreshSecret
      native:
        enabled: true
      file:
        basic: {}
        # -- If this secret parameter is not empty, basic auth inline value will be ignored. The basic auth config should be in the 'basic_auth_config' key
        secret: ""
    # @ignored
    tracer:
      type: *tracerType
      enabled: *tracerEnabled
      otel:
        otel_auth:
          header_name: *otelHeaderName
          header_value: *otelHeaderValue
        sample_rate: *otelSampleRate
        collector_url: *otelCollectorUrl
        insecure_skip_verify: *otelInsecureSkipVerify
      sentry:
        dsn: *sentryDsn
        debug: *sentryDebug
        environment: *environment
    pyroscope:
      enabled: false
      url: ""
      username: ""
      password: ""
      profile_id: ""
    enable_feature_flag: []
    retention:
      enabled: *retentionEnabled
    webhook_archiving: {}
    analytics_enabled: *enabledUsageAnalytics
    storage:
      enabled: false
      type: ""
      on_prem:
        path: ""
      s3:
        bucket: ""
        accessKey: ""
        # -- Ignored in case of secret parameter with non-empty value
        secretKey: ""
        # -- If this secret parameter is not empty, secretKey value will be ignored. The password in the secret should be in the 'secretKey' key
        secret: ""
        prefix: ""
        region: ""
        session_token: ""
        endpoint: ""
      azure_blob:
        account_name: ""
        # -- Ignored in case of secret parameter with non-empty value
        account_key: ""
        # -- If this secret parameter is not empty, account_key value will be ignored. The account key should be in the 'accountKey' key
        secret: ""
        container_name: ""
        endpoint: ""
        prefix: ""
    api_version: *apiVersion
    analytics:
      enabled: true
    enable_profiling: false
    metrics:
      enabled: false
      metrics_backend: prometheus
      prometheus_metrics:
        sample_time: 5
    instance_ingest_rate: 100
    max_retry_seconds: 7200
    license_key: *licenseKey
  app:
    replicaCount: 1
    resources: {}
    # limits:
    #   cpu: 1000m
    #   memory: 2000Mi
    # requests:
    #   cpu: 1000m
    #   memory: 1000Mi

  ingress:
    # -- Enable ingress for the server
    enabled: true
    annotations: {}
    ingressClassName: ""
    tls:
      - hosts:
          - test.com
        secretName: test-tls-secret
    hosts:
      - host: test.com
        http:
          paths:
            - path: /
              pathType: Prefix

  gateway:
    # -- Enable Gateway API for the server
    enabled: false
    # -- Whether to create a Gateway resource
    create: false
    # -- Annotations for the HTTPRoute
    annotations: {}
    # -- Hostnames for the HTTPRoute
    hostnames:
      - test.com
    # -- Parent refs for the HTTPRoute (e.g., the Gateway)
    parentRefs:
      - name: convoy-gateway
        namespace: gateway-system
    # -- Rules for the HTTPRoute
    rules:
      - matches:
          - path:
              type: PathPrefix
              value: /

  service:
    # -- Type of service for the server
    type: ClusterIP
    # -- Port for the server service
    port: 80

  autoscaling:
    # -- Enable autoscaling for the server
    enabled: false
    minReplicas: 2
    maxReplicas: 10
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80
    behavior:
      scaleDown:
        stabilizationWindowSeconds: 300
        policies:
          - type: Percent
            value: 50
            periodSeconds: 60
          - type: Pods
            value: 2
            periodSeconds: 60
        selectPolicy: Min
      scaleUp:
        stabilizationWindowSeconds: 0
        policies:
          - type: Percent
            value: 100
            periodSeconds: 60
          - type: Pods
            value: 2
            periodSeconds: 60
        selectPolicy: Max

  podDisruptionBudget: {}
    # -- Pod disruption budget
  #    maxUnavailable: 1
  #    minAvailable: 1
  securityContext: {}