## Override the Silo name used for resource names and `app:` labels. Existing
## releases can set this to `minio` to retain their current resource identity.
##
nameOverride: ""

## Provide a name to substitute for the full names of resources
##
fullnameOverride: ""

## Set the Kubernetes cluster domain where Silo is running.
##
clusterDomain: cluster.local

## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
##
image:
  repository: pgsty/silo
  tag: RELEASE.2026-08-06T00-00-00Z
  pullPolicy: IfNotPresent

imagePullSecrets: []
# - name: "image-pull-secret"

## Image used by post-install jobs. The pgsty/silo image bundles mcli and
## provides /usr/bin/mc as a compatibility link.
##
mcImage:
  repository: pgsty/silo
  tag: RELEASE.2026-08-06T00-00-00Z
  pullPolicy: IfNotPresent

## Silo mode, i.e. standalone or distributed.
mode: distributed ## other supported values are "standalone"

## Additional labels to include with deployment or statefulset
additionalLabels: {}

## Additional annotations to include with deployment or statefulset
additionalAnnotations: {}

## Typically the deployment/statefulset includes checksums of secrets/config,
## So that when these change on a subsequent helm install, the deployment/statefulset
## is restarted. This can result in unnecessary restarts under GitOps tooling such as
## flux, so set to "true" to disable this behaviour.
ignoreChartChecksums: false

## Additional arguments to pass to the Silo binary.
extraArgs: []
# example for enabling FTP:
#   - --ftp=\"address=:8021\"
#   - --ftp=\"passive-port-range=10000-10010\"

## Additional volumes for the Silo container.
extraVolumes: []

## Additional volume mounts for the Silo container.
extraVolumeMounts: []

## Additional sidecar containers
extraContainers: []

## Internal port number for the Silo S3 API container.
## Change service.port to change external port number
minioAPIPort: "9000"

## Internal port number for the Silo Console container.
## Change consoleService.port to change external port number
minioConsolePort: "9001"

## Update strategy for Deployments
deploymentUpdate:
  type: RollingUpdate
  maxUnavailable: 0
  maxSurge: 100%

## Update strategy for StatefulSets
statefulSetUpdate:
  updateStrategy: RollingUpdate

## Pod priority settings
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
##
priorityClassName: ""

## Pod runtime class name
## ref https://kubernetes.io/docs/concepts/containers/runtime-class/
##
runtimeClassName: ""

## Set default rootUser, rootPassword
## rootUser and rootPassword is generated when not set
## Distributed Silo reference: https://silo.pgsty.com/operations/deployments/baremetal/
##
rootUser: ""
rootPassword: ""

## Use existing Secret that store following variables:
##
## | Chart var             | .data.<key> in Secret    |
## |:----------------------|:-------------------------|
## | rootUser              | rootUser                 |
## | rootPassword          | rootPassword             |
##
## All mentioned variables will be ignored in values file.
## .data.rootUser and .data.rootPassword are mandatory,
## others depend on enabled status of corresponding sections.
existingSecret: ""

## Certificate and mcli configuration paths inside the Silo pod.
certsPath: "/etc/silo/certs/"
configPathmc: "/etc/silo/mc/"

## Path where the PV is mounted on the Silo pod.
mountPath: "/export"
## Override the root directory which the Silo server should serve from.
## If left empty, it defaults to the value of {{ .Values.mountPath }}
## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }}
##
bucketRoot: ""

# Number of drives attached to a node
drivesPerNode: 1
# Number of Silo containers running
replicas: 16
# Number of expanded Silo clusters
pools: 1

## TLS settings for Silo.
tls:
  enabled: false
  ## Create a Secret with private.key and public.crt and pass its name here.
  certSecret: ""
  publicCrt: public.crt
  privateKey: private.key

## Trusted certificate settings for Silo. Ref: https://silo.pgsty.com/operations/network-encryption/#third-party-certificate-authorities
## Bundle multiple trusted certificates into one Secret and pass that here.
## With self-signed certificates, include Silo's own certificate under public.crt.
## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret.
trustedCertsSecret: ""

## Enable persistence using Persistent Volume Claims
## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
##
persistence:
  enabled: true
  annotations: {}

  ## A manually managed Persistent Volume and Claim
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
  existingClaim: ""

  ## Silo data PersistentVolume storage class.
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  ## Storage class of PV to bind. By default it looks for standard storage class.
  ## If the PV uses a different storage class, specify that here.
  storageClass: ""
  volumeName: ""
  accessMode: ReadWriteOnce
  size: 500Gi

  ## If subPath is set mount a sub folder of a volume instead of the root of the volume.
  ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs).
  ##
  subPath: ""

## Expose Silo outside the cluster with a LoadBalancer Service.
## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
## ref: http://kubernetes.io/docs/user-guide/services/
##
service:
  type: ClusterIP
  clusterIP: ~
  port: "9000"
  nodePort: 32000
  loadBalancerIP: ~
  externalIPs: []
  annotations: {}

  ## service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer
  ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
  ##
  #loadBalancerSourceRanges:
  #   - 10.10.10.0/24
  loadBalancerSourceRanges: []

  ## service.externalTrafficPolicy controls Silo Service traffic handling.
  ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
  ##
  externalTrafficPolicy: Cluster

## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/
##

ingress:
  enabled: false
  ingressClassName: ~
  labels:
    {}
    # node-role.kubernetes.io/ingress: platform
  annotations:
    {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # kubernetes.io/ingress.allow-http: "false"
    # kubernetes.io/ingress.global-static-ip-name: ""
    # nginx.ingress.kubernetes.io/secure-backends: "true"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
  path: /
  hosts:
    - silo-example.local
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

consoleService:
  type: ClusterIP
  clusterIP: ~
  port: "9001"
  nodePort: 32001
  loadBalancerIP: ~
  externalIPs: []
  annotations: {}
  ## consoleService.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer
  ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
  ##
  #loadBalancerSourceRanges:
  #   - 10.10.10.0/24
  loadBalancerSourceRanges: []

  ## consoleService.externalTrafficPolicy controls Console traffic handling.
  ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
  ##
  externalTrafficPolicy: Cluster

consoleIngress:
  enabled: false
  ingressClassName: ~
  labels:
    {}
    # node-role.kubernetes.io/ingress: platform
  annotations:
    {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # kubernetes.io/ingress.allow-http: "false"
    # kubernetes.io/ingress.global-static-ip-name: ""
    # nginx.ingress.kubernetes.io/secure-backends: "true"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
  path: /
  hosts:
    - console.silo-example.local
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

## Node labels for pod assignment
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []

## Configure the security context used by stateful Silo containers.
## user and group NOTE: securityContext is only enabled if persistence.enabled=true
securityContext:
  enabled: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
  fsGroupChangePolicy: "OnRootMismatch"

containerSecurityContext:
  readOnlyRootFilesystem: false

# Additational pod annotations
podAnnotations: {}

# Additional pod labels
podLabels: {}

## Configure resource requests and limits
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
resources:
  requests:
    memory: 16Gi

## Policies to create after installing Silo.
##
## In addition to default policies [readonly|readwrite|writeonly|consoleAdmin|diagnostics]
## you can define additional policies with custom supported actions and resources
policies: []
## writeexamplepolicy policy grants creation or deletion of buckets with name
## starting with example. In addition, grants objects write permissions on buckets starting with
## example.
# - name: writeexamplepolicy
#   statements:
#     - effect: Allow  # this is the default
#       resources:
#         - 'arn:aws:s3:::example*/*'
#       actions:
#         - "s3:AbortMultipartUpload"
#         - "s3:GetObject"
#         - "s3:DeleteObject"
#         - "s3:PutObject"
#         - "s3:ListMultipartUploadParts"
#     - resources:
#         - 'arn:aws:s3:::example*'
#       actions:
#         - "s3:CreateBucket"
#         - "s3:DeleteBucket"
#         - "s3:GetBucketLocation"
#         - "s3:ListBucket"
#         - "s3:ListBucketMultipartUploads"
## readonlyexamplepolicy policy grants access to buckets with name starting with example.
## In addition, grants objects read permissions on buckets starting with example.
# - name: readonlyexamplepolicy
#   statements:
#     - resources:
#         - 'arn:aws:s3:::example*/*'
#       actions:
#         - "s3:GetObject"
#     - resources:
#         - 'arn:aws:s3:::example*'
#       actions:
#         - "s3:GetBucketLocation"
#         - "s3:ListBucket"
#         - "s3:ListBucketMultipartUploads"
## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only
# - name: conditionsexample
#   statements:
#     - resources:
#       - 'arn:aws:s3:::example/*'
#       actions:
#       - 's3:*'
#       conditions:
#         - StringEquals: '"aws:username": "johndoe"'
#         - IpAddress: |
#             "aws:SourceIp": [
#               "10.0.0.0/8",
#               "192.168.0.0/24"
#             ]
#
## Additional Annotations for the Kubernetes Job makePolicyJob
makePolicyJob:
  securityContext:
    enabled: false
    runAsUser: 1000
    runAsGroup: 1000
  resources:
    requests:
      memory: 128Mi
  # Command to run after the main command on exit
  exitCommand: ""

## Users to create after installing Silo.
## Username, password and policy to be assigned to the user.
## Default policies are [readonly|readwrite|writeonly|consoleAdmin|diagnostics].
## Add new policies as explained here https://silo.pgsty.com/administration/identity-access-management/#access-management
## NOTE: this will fail if LDAP is enabled in the Silo deployment.
##
## Example:
## users:
##   - accessKey: console
##     secretKey: change-me
##     policy: consoleAdmin
## Or refer to a specific secret:
##   - accessKey: externalSecret
##     existingSecret: my-secret
##     existingSecretKey: password
##     policy: readonly
users: []

## Additional Annotations for the Kubernetes Job makeUserJob
makeUserJob:
  securityContext:
    enabled: false
    runAsUser: 1000
    runAsGroup: 1000
  resources:
    requests:
      memory: 128Mi
  # Command to run after the main command on exit
  exitCommand: ""

## Service accounts to create after installing Silo.
##
svcaccts:
  []
  ## accessKey, secretKey and parent user to be assigned to the service accounts
  ## Add new service accounts as explained here https://silo.pgsty.com/administration/identity-access-management/minio-user-management/#access-keys
  # - accessKey: console-svcacct
  #   secretKey: console123
  #   user: console
  ## Or you can refer to specific secret
  # - accessKey: externalSecret
  #   existingSecret: my-secret
  #   existingSecretKey: password
  #   user: console
  ## You also can pass custom policy
  # - accessKey: console-svcacct
  #   secretKey: console123
  #   user: console
  #   policy:
  #     statements:
  #       - resources:
  #           - 'arn:aws:s3:::example*/*'
  #         actions:
  #           - "s3:AbortMultipartUpload"
  #           - "s3:GetObject"
  #           - "s3:DeleteObject"
  #           - "s3:PutObject"
  #           - "s3:ListMultipartUploadParts"

makeServiceAccountJob:
  securityContext:
    enabled: false
    runAsUser: 1000
    runAsGroup: 1000
  resources:
    requests:
      memory: 128Mi
  # Command to run after the main command on exit
  exitCommand: ""

## Buckets to create after installing Silo.
##
buckets:
  []
  #   # Name of the bucket
  # - name: bucket1
  #   # Policy to be set on the
  #   # bucket [none|download|upload|public]
  #   policy: none
  #   # Purge if bucket exists already
  #   purge: false
  #   # set versioning for
  #   # bucket [true|false]
  #   versioning: false # remove this key if you do not want versioning feature
  #   # set objectlocking for
  #   # bucket [true|false] NOTE: versioning is enabled by default if you use locking
  #   objectlocking: false
  # - name: bucket2
  #   policy: none
  #   purge: false
  #   versioning: true
  #   # set objectlocking for
  #   # bucket [true|false] NOTE: versioning is enabled by default if you use locking
  #   objectlocking: false

## Additional Annotations for the Kubernetes Job makeBucketJob
makeBucketJob:
  securityContext:
    enabled: false
    runAsUser: 1000
    runAsGroup: 1000
  resources:
    requests:
      memory: 128Mi
  # Command to run after the main command on exit
  exitCommand: ""

## Commands to run after installing Silo.
## The preferred mc command TARGET is "mysilo". The legacy "myminio" target
## remains registered so existing customCommands values continue to work.
customCommands:
  # - command: "admin policy attach mysilo consoleAdmin --group='cn=ops,cn=groups,dc=example,dc=com'"

## Additional Annotations for the Kubernetes Job customCommandJob
customCommandJob:
  securityContext:
    enabled: false
    runAsUser: 1000
    runAsGroup: 1000
  resources:
    requests:
      memory: 128Mi
  ## Additional volumes to add to the post-job.
  extraVolumes:
    []
    # - name: extra-policies
    #   configMap:
    #     name: my-extra-policies-cm
  ## Additional volumeMounts to add to the custom commands container when
  ## running the post-job.
  extraVolumeMounts:
    []
    # - name: extra-policies
    #   mountPath: /mnt/extras/
  # Command to run after the main command on exit
  exitCommand: ""

## Merge jobs
postJob:
  podAnnotations: {}
  annotations: {}
  securityContext:
    enabled: false
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  nodeSelector: {}
  tolerations: []
  affinity: {}

## Add environment variables for Silo. The MINIO_* names remain the stable
## configuration interface and are passed to the Silo container(s).
environment:
  ## Please refer for comprehensive list https://silo.pgsty.com/reference/minio-server/minio-server/
  ## MINIO_BROWSER: "off"

## The name of a secret in the same kubernetes namespace which contain secret values
## This can be useful for LDAP password, etc
## The key in the secret must be 'config.env'
##
extraSecret: ~

## OpenID Identity Management
## The following section documents environment variables for enabling external identity management using an OpenID Connect (OIDC)-compatible provider.
## See https://silo.pgsty.com/operations/external-iam/configure-openid-external-identity-management/ for a tutorial on using these variables.
oidc:
  enabled: false
  configUrl: "https://identity-provider-url/.well-known/openid-configuration"
  clientId: "silo"
  clientSecret: ""
  # Provide existing client secret from the Kubernetes Secret resource, existing secret will have priority over `clientId` and/or `clientSecret``
  existingClientSecretName: ""
  existingClientIdKey: ""
  existingClientSecretKey: ""
  claimName: "policy"
  scopes: "openid,profile,email"
  redirectUri: "https://console-endpoint-url/oauth_callback"
  # Can leave empty
  claimPrefix: ""
  comment: ""
  displayName: ""

networkPolicy:
  enabled: false
  # Specifies whether the policies created will be standard Network Policies (flavor: kubernetes)
  # or Cilium Network Policies (flavor: cilium)
  flavor: kubernetes
  # Allow external access to the Silo API.
  allowExternal: true
  ## @params networkPolicy.egress configuration of the egress traffic
  egress:
    ## @param networkPolicy.egress.enabled When enabled, an egress network policy will be
    ## created allowing Silo to connect to external data sources from the cluster.
    ##
    enabled: false
    ## @param networkPolicy.egress.ports Add individual ports to be allowed by the egress
    ## Add ports to the egress by specifying - port: <port number>
    ## E.X.
    ## - port: 80
    ## - port: 443
    ## - port: 53
    ##   protocol: UDP
    ##
    ports: []
    ## @param networkPolicy.egress.to Allow egress traffic to specific destinations
    ## Add destinations to the egress by specifying - ipBlock: <CIDR>
    ## E.X.
    ## to:
    ##  - namespaceSelector:
    ##    matchExpressions:
    ##    - {key: role, operator: In, values: [silo]}
    ##
    to: []
  # only when using flavor: cilium
  egressEntities:
    - kube-apiserver

## PodDisruptionBudget settings
## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
##
podDisruptionBudget:
  enabled: false
  maxUnavailable: 1

## Specify the service account to use for Silo pods. If 'create' is set to 'false'
## and 'name' is left unspecified, the account 'default' will be used.
serviceAccount:
  create: true
  ## The name of the service account to use. If 'create' is 'true', a service account with that name
  ## will be created.
  name: "silo-sa"

metrics:
  serviceMonitor:
    enabled: false
    # scrape each node/pod individually for additional metrics
    includeNode: false
    public: true
    additionalLabels: {}
    annotations: {}
    # for node metrics
    relabelConfigs: {}
    # for cluster metrics
    relabelConfigsCluster:
      {}
      # metricRelabelings:
      #   - regex: (server|pod)
      #     action: labeldrop
    namespace: ~
    # Scrape interval, for example `interval: 30s`
    interval: ~
    # Scrape timeout, for example `scrapeTimeout: 10s`
    scrapeTimeout: ~

## ETCD settings. The existing MINIO_ETCD_* configuration interface is retained.
## Define endpoints to enable this section.
etcd:
  endpoints: []
  pathPrefix: ""
  corednsPathPrefix: ""
  clientCert: ""
  clientCertKey: ""