feat(routing): Add routing chart and deployment

argocd/app-of-apps/test/values.yaml

@@ -69,13 +69,13 @@ applications:
     createNamespace: false
     repoURL: https://github.com/2martens/cloud-configuration.git
     syncWave: 2
-#  - name: timetable
+  - name: routing
-#    project: default
+    project: default
-#    targetRevision: main
+    targetRevision: main
-#    namespace: timetable
+    namespace: routing
-#    createNamespace: false
+    createNamespace: false
-#    repoURL: https://github.com/2martens/cloud-configuration.git
+    repoURL: https://github.com/2martens/cloud-configuration.git
-#    syncWave: 5
+    syncWave: 5
 
 overall:
   destinationServer: https://kubernetes.default.svc

argocd/routing/test/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: template
+  repository: https://repo.2martens.de/charts
+  version: 0.5.0
+digest: sha256:2fd9fd60065d7d514af8ac541437a5052b00eba2c4708ee6d7c2ee2898399652
+generated: "2024-09-02T16:13:01.749432+02:00"

argocd/routing/test/Chart.yaml

@@ -0,0 +1,8 @@
+apiVersion: v2
+name: routing
+version: 0.1.0
+type: application
+dependencies:
+  - name: template
+    version: 0.5.0
+    repository: https://repo.2martens.de/charts

argocd/routing/test/default_values.yaml

@@ -0,0 +1 @@
+../../../helm/routing/values.yaml

argocd/routing/test/overwrite_values.yaml

@@ -0,0 +1,47 @@
+image:
+  tag: "0.1.0-SNAPSHOT"
+  pullPolicy: Always
+revisionHistoryLimit: 3
+ingress:
+  enabled: true
+  className: public
+  hosts:
+    - host: api.2martens.de
+      paths:
+        - path: /doc/v1/routing/
+          pathType: Prefix
+        - path: /api-docs/v1/routing
+          pathType: Prefix
+  tls:
+    - secretName: routing-tls
+      hosts:
+        - api.2martens.de
+resources:
+  requests:
+    cpu: 200m
+    memory: 512Mi
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+application:
+  configserver:
+    scheme: http
+    host: configserver.spring-support
+    port: 8888
+    prefix: /config
+
+vault:
+  enabled: true
+  applicationName: routing
+
+readinessProbe:
+  initialDelaySeconds: 70
+
+livenessProbe:
+  initialDelaySeconds: 70
+
+prometheus:
+  useCRDs: true
+
+leaderElection:
+  enabled: false

argocd/routing/test/templates

@@ -0,0 +1 @@
+../../../helm/routing/templates

argocd/routing/test/values.yaml

@@ -0,0 +1,192 @@
+# Copy these values to your application chart completely and then modify those bits where
+# the default for your application differs. The image.repository is a prime candidate for that.
+
+replicaCount: 1
+# revisionHistoryLimit: can be configured to reduce/increase amount of stored replica sets for rollback
+revisionHistoryLimit: 3
+image:
+  repository: hbt/routing
+  pullPolicy: Always
+  # Overrides the image tag whose default is latest
+  tag: "0.1.0-SNAPSHOT"
+# If image is not accessible for Kubernetes without authentication, configure required secrets here
+# will be added verbatim to imagePullSecrets in deployment pod template
+imagePullSecrets: []
+# Overrides the name being used in, for example, annotations
+# by default it is the chart name
+nameOverride: ""
+# Overrides the name being used for the name of Kubernetes resources
+# by default release name if it contains the chart name, otherwise releaseName-chartName
+fullnameOverride: ""
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+# Configure annotations for the pod, will be added verbatim to key annotations in pod metadata
+podAnnotations: {}
+# Configure the security context of the application pod
+podSecurityContext: {}
+# fsGroup: 2000
+
+# Configure security context of the application container
+securityContext:
+  seccompProfile:
+    type: RuntimeDefault
+  capabilities:
+    drop: ['ALL']
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+#   capabilities:
+#     drop:
+#     - ALL
+#   readOnlyRootFilesystem: true
+#   runAsNonRoot: true
+#   runAsUser: 1000
+
+application:
+  port: 8080
+  actuatorPort: 8081
+  namespace: template # update to match the desired namespace
+  profile: prod
+  isSpring: true
+  keycloak:
+    url: https://id.2martens.de
+    realm: 2martens
+  configserver:
+    scheme: http
+    host: configserver.spring-support
+    port: 8888
+    prefix: /config
+prometheus:
+  enabled: true
+  # only enable if you have the Prometheus operator installed, otherwise it will fail due to missing CRDs
+  useCRDs: true
+  # namespace: the namespace of the Prometheus installation
+  # the value is templated
+  namespace:
+  # name of helm release or argo cd application
+  releaseName:
+# Overwrite with application specific environment variables
+# Each item has key and value, where the value is parsed as a template
+environment:
+  - name: PORT
+    value: "{{ .Values.application.port }}"
+  - name: ACTUATOR_PORT
+    value: "{{ .Values.application.actuatorPort }}"
+  - name: KEYCLOAK_URL
+    value: "{{ .Values.application.keycloak.url }}"
+  - name: KEYCLOAK_REALM
+    value: "{{ .Values.application.keycloak.realm }}"
+  - name: CONFIGSERVER_SCHEME
+    value: "{{ .Values.application.configserver.scheme }}"
+  - name: CONFIGSERVER_HOST
+    value: "{{ .Values.application.configserver.host }}"
+  - name: CONFIGSERVER_PORT
+    value: "{{ .Values.application.configserver.port }}"
+  - name: CONFIGSERVER_PREFIX
+    value: "{{ .Values.application.configserver.prefix }}"
+enableServiceLinks: false
+# Contents of this object will be added to a Kubernetes secret data section and Base64 encoded
+# External secrets are not supported by this template
+secrets:
+  # Needs to be overwritten. Will be ignored if vault is enabled.
+  MONGODB_CONNECTION_STRING: ""
+  # Needs to be overwritten. Will be ignored if vault is enabled.
+  CLIENT_SECRET: ""
+# Configure the service
+service:
+  type: ClusterIP
+  # port is targeting the containerPort http, described by application.port
+  port: 8080
+  # actuatorPort is targeting the containerPort http-actuator, described by application.actuatorPort
+  # only used if application.isSpring=true
+  actuatorPort: 8081
+# Configure the liveness probe
+# Defaults fitting for Spring Boot application that has livenessProbe enabled
+livenessProbe:
+  enabled: true
+  path: /actuator/health/liveness
+  port: http-actuator
+  initialDelaySeconds: 70
+  periodSeconds: 120
+# Configure the readiness probe
+# Defaults fitting for Spring Boot application that has readinessProbe enabled
+readinessProbe:
+  enabled: true
+  path: /actuator/health/readiness
+  port: http-actuator
+  initialDelaySeconds: 70
+  periodSeconds: 10
+  # Allows you to specify the number of seconds the application can take to answer readinessProbe
+  # before failure is assumed by Kubernetes
+  timeoutSeconds: 1
+# Configure ingress if desired (exposing app beyond the boundaries of the cluster)
+ingress:
+  enabled: true
+  className: "public"
+  annotations:
+    cert-manager.io/cluster-issuer: lets-encrypt
+  # kubernetes.io/tls-acme: "true"
+  hosts:
+    - host: api.2martens.de
+      paths:
+        - path: /doc/v1/routing/
+          pathType: Prefix
+        - path: /api-docs/v1/routing
+          pathType: Prefix
+  tls:
+    - secretName: routing-tls
+      hosts:
+        - api.2martens.de
+resources:
+  requests:
+    cpu: 200m
+    memory: 512Mi
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
+#   memory: 128Mi
+
+# Configure autoscaling
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+leaderElection:
+  enabled: false
+vault:
+  # If enabled, no ordinary secret resource will be created, even if secrets value is populated.
+  enabled: true
+  # name of the Vault secrets applications
+  applicationName: "routing"
+  # id of the organization in Vault secrets
+  organizationId: ""
+  # id of the project in Vault secrets
+  projectId: ""
+  # if not provided, vault-secrets-operator-system will be used
+  operatorNamespace: ""
+# Configure nodeSelector, contents will be added verbatim to key nodeSelector in deployment pod template
+nodeSelector: {}
+# Configure tolerations, contents will be added verbatim to key tolerations in deployment pod template
+tolerations: []
+# Configure affinity, contents will be added verbatim to key affinity in deployment pod template
+affinity: {}
+# volumes: configure volumes
+volumes: []
+# volumeMounts: will be mounted in container
+volumeMounts: []
+# podSpec: will be added at the bottom of the pod template in the deployment
+podSpec: {}
+# containerSpec: will be added at the bottom of the container specification in the pod template
+containerSpec: {}

argocd/vault-secrets-operator/test/argocd_values.yaml

@@ -4,3 +4,4 @@ allowedNamespaces:
   - name: wahlrecht
   - name: hcloud
   - name: timetable
+  - name: routing

helm/routing/.helmignore

@@ -0,0 +1,27 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# environment values
+environments/
+default_values.yaml
+overwrite_values.yaml

helm/routing/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: template
+  repository: file://../template
+  version: 0.5.0
+digest: sha256:8a4a8940fd8f437f817f52a806e451ca53fab1179f2cacf11359050db14cef32
+generated: "2024-09-02T16:10:12.458141+02:00"

helm/routing/Chart.yaml

@@ -0,0 +1,28 @@
+apiVersion: v2
+name: routing
+description: Installs the Routing backend into the Kubernetes cluster
+type: application
+version: 0.1.0
+maintainers:
+  - name: Jim Martens
+    url: https://2martens.de
+sources:
+  - https://github.com/HBTGmbH/hackathon-2024-kotlin
+dependencies:
+  - name: template
+    version: 0.5.0
+    repository: file://../template
+annotations:
+  artifacthub.io/images: |
+    - name: hbt/routing:latest
+      image: hbt/routing:latest
+      platforms:
+        - linux/amd64
+        - linux/arm64
+  artifacthub.io/changes: |
+    - kind: added
+      description: Added Routing Assistant chart
+  artifacthub.io/signKey: |
+    fingerprint: F0F153B65BAD467201D7544E47393ABD1F96B7C8
+    url: https://mafiasi.de/pks/key/47393ABD1F96B7C8.asc
+  artifacthub.io/prerelease: true

helm/routing/README.md

@@ -0,0 +1,33 @@
+# Routing Assistant API
+
+This chart installs the Routing Assistant API
+into the Kubernetes cluster.
+
+## Configuration
+
+* by default, it expects a Spring Boot config server running inside the cluster, available under
+  http://configserver:8888/config
+  ```yaml
+  application:
+    configserver:
+      host: configserver
+      port: 8888
+      prefix: /config
+      scheme: http
+  ```
+* configure Keycloak
+  ```yaml
+  application:
+    keycloak:
+      url: https://yourKeycloak
+      realm: yourRealm
+  ```
+* configure secrets (the application expects these values to be set)
+  ```yaml
+  secrets:
+    MONGODB_CONNECTION_STRING: mongoDBConnectionString
+    CLIENT_SECRET: keycloakClientSecret
+  ```
+  Should you want to use, for example, an external secret provider,
+  then you are currently out of luck. The chart does not support that,
+  yet.

helm/routing/default_values.yaml

@@ -0,0 +1,178 @@
+# Copy these values to your application chart completely and then modify those bits where
+# the default for your application differs. The image.repository is a prime candidate for that.
+
+replicaCount: 1
+# revisionHistoryLimit: can be configured to reduce/increase amount of stored replica sets for rollback
+revisionHistoryLimit: 10
+
+image:
+  repository: 2martens/template
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is latest
+  tag: ""
+
+# If image is not accessible for Kubernetes without authentication, configure required secrets here
+# will be added verbatim to imagePullSecrets in deployment pod template
+imagePullSecrets: []
+
+# Overrides the name being used in, for example, annotations
+# by default it is the chart name
+nameOverride: ""
+# Overrides the name being used for the name of Kubernetes resources
+# by default release name if it contains the chart name, otherwise releaseName-chartName
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+# Configure annotations for the pod, will be added verbatim to key annotations in pod metadata
+podAnnotations: {}
+
+# Configure the security context of the application pod
+podSecurityContext: {}
+  # fsGroup: 2000
+
+# Configure security context of the application container
+securityContext:
+  seccompProfile:
+    type: RuntimeDefault
+  capabilities:
+    drop: ['ALL']
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+#   capabilities:
+#     drop:
+#     - ALL
+#   readOnlyRootFilesystem: true
+#   runAsNonRoot: true
+#   runAsUser: 1000
+
+application:
+  port: 8080
+  actuatorPort: 8081
+  namespace: template # update to match the desired namespace
+  profile: prod
+  isSpring: true
+
+prometheus:
+  enabled: true
+  # only enable if you have the Prometheus operator installed, otherwise it will fail due to missing CRDs
+  useCRDs: false
+  # namespace: the namespace of the Prometheus installation
+  # the value is templated
+  namespace:
+  # name of helm release or argo cd application
+  releaseName:
+
+# Overwrite with application specific environment variables
+# Each item has key and value, where the value is parsed as a template
+environment: []
+
+enableServiceLinks: false
+
+# Contents of this object will be added to a Kubernetes secret data section and Base64 encoded
+# External secrets are not supported by this template
+secrets: {}
+
+# Configure the service
+service:
+  type: ClusterIP
+  # port is targeting the containerPort http, described by application.port
+  port: 8080
+  # actuatorPort is targeting the containerPort http-actuator, described by application.actuatorPort
+  # only used if application.isSpring=true
+  actuatorPort: 8081
+
+# Configure the liveness probe
+# Defaults fitting for Spring Boot application that has livenessProbe enabled
+livenessProbe:
+  enabled: true
+  path: /actuator/health/liveness
+  port: http-actuator
+  initialDelaySeconds: 30
+  periodSeconds: 120
+
+# Configure the readiness probe
+# Defaults fitting for Spring Boot application that has readinessProbe enabled
+readinessProbe:
+  enabled: true
+  path: /actuator/health/readiness
+  port: http-actuator
+  initialDelaySeconds: 30
+  periodSeconds: 10
+  # Allows you to specify the number of seconds the application can take to answer readinessProbe
+  # before failure is assumed by Kubernetes
+  timeoutSeconds: 1
+
+# Configure ingress if desired (exposing app beyond the boundaries of the cluster)
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+    # kubernetes.io/tls-acme: "true"
+  hosts:
+    - host: chart-example.local
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - secretName: chart-example-tls
+      hosts:
+        - chart-example.local
+
+resources: {}
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+# Configure autoscaling
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+
+leaderElection:
+  enabled: false
+
+vault:
+  # If enabled, no ordinary secret resource will be created, even if secrets value is populated.
+  enabled: false
+  # name of the Vault secrets applications
+  applicationName: ""
+  # id of the organization in Vault secrets
+  organizationId: ""
+  # id of the project in Vault secrets
+  projectId: ""
+  # if not provided, vault-secrets-operator-system will be used
+  operatorNamespace: ""
+
+# Configure nodeSelector, contents will be added verbatim to key nodeSelector in deployment pod template
+nodeSelector: {}
+
+# Configure tolerations, contents will be added verbatim to key tolerations in deployment pod template
+tolerations: []
+
+# Configure affinity, contents will be added verbatim to key affinity in deployment pod template
+affinity: {}
+
+# volumes: configure volumes
+volumes: []
+
+# volumeMounts: will be mounted in container
+volumeMounts: []
+
+# podSpec: will be added at the bottom of the pod template in the deployment
+podSpec: {}
+# containerSpec: will be added at the bottom of the container specification in the pod template
+containerSpec: {}

helm/routing/overwrite_values.yaml

@@ -0,0 +1,50 @@
+image:
+  repository: hbt/routing
+
+ingress:
+  annotations:
+    cert-manager.io/cluster-issuer: lets-encrypt
+  tls:
+    - secretName: chart-example-tls
+      hosts:
+        - chart-example.local
+
+application:
+  port: 8080
+  actuatorPort: 8081
+  keycloak:
+    url: https://id.2martens.de
+    realm: 2martens
+  configserver:
+    scheme: http
+    host: configserver
+    port: 8888
+    prefix: /config
+
+service:
+  port: 8080
+  actuatorPort: 8081
+
+secrets:
+  # Needs to be overwritten. Will be ignored if vault is enabled.
+  MONGODB_CONNECTION_STRING: ""
+  # Needs to be overwritten. Will be ignored if vault is enabled.
+  CLIENT_SECRET: ""
+
+environment:
+  - name: PORT
+    value: "{{ .Values.application.port }}"
+  - name: ACTUATOR_PORT
+    value: "{{ .Values.application.actuatorPort }}"
+  - name: KEYCLOAK_URL
+    value: "{{ .Values.application.keycloak.url }}"
+  - name: KEYCLOAK_REALM
+    value: "{{ .Values.application.keycloak.realm }}"
+  - name: CONFIGSERVER_SCHEME
+    value: "{{ .Values.application.configserver.scheme }}"
+  - name: CONFIGSERVER_HOST
+    value: "{{ .Values.application.configserver.host }}"
+  - name: CONFIGSERVER_PORT
+    value: "{{ .Values.application.configserver.port }}"
+  - name: CONFIGSERVER_PREFIX
+    value: "{{ .Values.application.configserver.prefix }}"

helm/routing/templates

@@ -0,0 +1 @@
+../template/_templates

helm/routing/values.yaml

@@ -0,0 +1,184 @@
+# Copy these values to your application chart completely and then modify those bits where
+# the default for your application differs. The image.repository is a prime candidate for that.
+
+replicaCount: 1
+# revisionHistoryLimit: can be configured to reduce/increase amount of stored replica sets for rollback
+revisionHistoryLimit: 10
+image:
+  repository: hbt/routing
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is latest
+  tag: ""
+# If image is not accessible for Kubernetes without authentication, configure required secrets here
+# will be added verbatim to imagePullSecrets in deployment pod template
+imagePullSecrets: []
+# Overrides the name being used in, for example, annotations
+# by default it is the chart name
+nameOverride: ""
+# Overrides the name being used for the name of Kubernetes resources
+# by default release name if it contains the chart name, otherwise releaseName-chartName
+fullnameOverride: ""
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+# Configure annotations for the pod, will be added verbatim to key annotations in pod metadata
+podAnnotations: {}
+# Configure the security context of the application pod
+podSecurityContext: {}
+# fsGroup: 2000
+
+# Configure security context of the application container
+securityContext:
+  seccompProfile:
+    type: RuntimeDefault
+  capabilities:
+    drop: ['ALL']
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+#   capabilities:
+#     drop:
+#     - ALL
+#   readOnlyRootFilesystem: true
+#   runAsNonRoot: true
+#   runAsUser: 1000
+
+application:
+  port: 8080
+  actuatorPort: 8081
+  namespace: template # update to match the desired namespace
+  profile: prod
+  isSpring: true
+  keycloak:
+    url: https://id.2martens.de
+    realm: 2martens
+  configserver:
+    scheme: http
+    host: configserver
+    port: 8888
+    prefix: /config
+prometheus:
+  enabled: true
+  # only enable if you have the Prometheus operator installed, otherwise it will fail due to missing CRDs
+  useCRDs: false
+  # namespace: the namespace of the Prometheus installation
+  # the value is templated
+  namespace:
+  # name of helm release or argo cd application
+  releaseName:
+# Overwrite with application specific environment variables
+# Each item has key and value, where the value is parsed as a template
+environment:
+  - name: PORT
+    value: "{{ .Values.application.port }}"
+  - name: ACTUATOR_PORT
+    value: "{{ .Values.application.actuatorPort }}"
+  - name: KEYCLOAK_URL
+    value: "{{ .Values.application.keycloak.url }}"
+  - name: KEYCLOAK_REALM
+    value: "{{ .Values.application.keycloak.realm }}"
+  - name: CONFIGSERVER_SCHEME
+    value: "{{ .Values.application.configserver.scheme }}"
+  - name: CONFIGSERVER_HOST
+    value: "{{ .Values.application.configserver.host }}"
+  - name: CONFIGSERVER_PORT
+    value: "{{ .Values.application.configserver.port }}"
+  - name: CONFIGSERVER_PREFIX
+    value: "{{ .Values.application.configserver.prefix }}"
+enableServiceLinks: false
+# Contents of this object will be added to a Kubernetes secret data section and Base64 encoded
+# External secrets are not supported by this template
+secrets:
+  # Needs to be overwritten. Will be ignored if vault is enabled.
+  MONGODB_CONNECTION_STRING: ""
+  # Needs to be overwritten. Will be ignored if vault is enabled.
+  CLIENT_SECRET: ""
+# Configure the service
+service:
+  type: ClusterIP
+  # port is targeting the containerPort http, described by application.port
+  port: 8080
+  # actuatorPort is targeting the containerPort http-actuator, described by application.actuatorPort
+  # only used if application.isSpring=true
+  actuatorPort: 8081
+# Configure the liveness probe
+# Defaults fitting for Spring Boot application that has livenessProbe enabled
+livenessProbe:
+  enabled: true
+  path: /actuator/health/liveness
+  port: http-actuator
+  initialDelaySeconds: 30
+  periodSeconds: 120
+# Configure the readiness probe
+# Defaults fitting for Spring Boot application that has readinessProbe enabled
+readinessProbe:
+  enabled: true
+  path: /actuator/health/readiness
+  port: http-actuator
+  initialDelaySeconds: 30
+  periodSeconds: 10
+  # Allows you to specify the number of seconds the application can take to answer readinessProbe
+  # before failure is assumed by Kubernetes
+  timeoutSeconds: 1
+# Configure ingress if desired (exposing app beyond the boundaries of the cluster)
+ingress:
+  enabled: false
+  className: ""
+  annotations:
+    cert-manager.io/cluster-issuer: lets-encrypt
+  # kubernetes.io/tls-acme: "true"
+  hosts:
+    - host: chart-example.local
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - secretName: chart-example-tls
+      hosts:
+        - chart-example.local
+resources: {}
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
+#   memory: 128Mi
+
+# Configure autoscaling
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+leaderElection:
+  enabled: false
+vault:
+  # If enabled, no ordinary secret resource will be created, even if secrets value is populated.
+  enabled: false
+  # name of the Vault secrets applications
+  applicationName: ""
+  # id of the organization in Vault secrets
+  organizationId: ""
+  # id of the project in Vault secrets
+  projectId: ""
+  # if not provided, vault-secrets-operator-system will be used
+  operatorNamespace: ""
+# Configure nodeSelector, contents will be added verbatim to key nodeSelector in deployment pod template
+nodeSelector: {}
+# Configure tolerations, contents will be added verbatim to key tolerations in deployment pod template
+tolerations: []
+# Configure affinity, contents will be added verbatim to key affinity in deployment pod template
+affinity: {}
+# volumes: configure volumes
+volumes: []
+# volumeMounts: will be mounted in container
+volumeMounts: []
+# podSpec: will be added at the bottom of the pod template in the deployment
+podSpec: {}
+# containerSpec: will be added at the bottom of the container specification in the pod template
+containerSpec: {}