# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "kube-state-metrics.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "kube-state-metrics.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "kube-state-metrics.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
    {{ default (include "kube-state-metrics.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
    {{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}

{{/*
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
*/}}
{{- define "kube-state-metrics.namespace" -}}
  {{- if .Values.namespaceOverride -}}
    {{- .Values.namespaceOverride -}}
  {{- else -}}
    {{- .Release.Namespace -}}
  {{- end -}}
{{- end -}}
 # clusterrole.yaml
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  name: {{ template "kube-state-metrics.fullname" . }}
rules:
{{ if .Values.collectors.certificatesigningrequests }}
- apiGroups: ["certificates.k8s.io"]
  resources:
  - certificatesigningrequests
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.configmaps }}
- apiGroups: [""]
  resources:
  - configmaps
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.cronjobs }}
- apiGroups: ["batch"]
  resources:
  - cronjobs
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.daemonsets }}
- apiGroups: ["extensions", "apps"]
  resources:
  - daemonsets
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.deployments }}
- apiGroups: ["extensions", "apps"]
  resources:
  - deployments
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.endpoints }}
- apiGroups: [""]
  resources:
  - endpoints
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.horizontalpodautoscalers }}
- apiGroups: ["autoscaling"]
  resources:
  - horizontalpodautoscalers
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.ingresses }}
- apiGroups: ["extensions", "networking.k8s.io"]
  resources:
  - ingresses
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.jobs }}
- apiGroups: ["batch"]
  resources:
  - jobs
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.limitranges }}
- apiGroups: [""]
  resources:
  - limitranges
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.mutatingwebhookconfigurations }}
- apiGroups: ["admissionregistration.k8s.io"]
  resources:
    - mutatingwebhookconfigurations
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.namespaces }}
- apiGroups: [""]
  resources:
  - namespaces
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.networkpolicies }}
- apiGroups: ["networking.k8s.io"]
  resources:
  - networkpolicies
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.nodes }}
- apiGroups: [""]
  resources:
  - nodes
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.persistentvolumeclaims }}
- apiGroups: [""]
  resources:
  - persistentvolumeclaims
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.persistentvolumes }}
- apiGroups: [""]
  resources:
  - persistentvolumes
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.poddisruptionbudgets }}
- apiGroups: ["policy"]
  resources:
    - poddisruptionbudgets
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.pods }}
- apiGroups: [""]
  resources:
  - pods
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.replicasets }}
- apiGroups: ["extensions", "apps"]
  resources:
  - replicasets
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.replicationcontrollers }}
- apiGroups: [""]
  resources:
  - replicationcontrollers
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.resourcequotas }}
- apiGroups: [""]
  resources:
  - resourcequotas
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.secrets }}
- apiGroups: [""]
  resources:
  - secrets
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.services }}
- apiGroups: [""]
  resources:
  - services
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.statefulsets }}
- apiGroups: ["apps"]
  resources:
  - statefulsets
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.storageclasses }}
- apiGroups: ["storage.k8s.io"]
  resources:
    - storageclasses
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.validatingwebhookconfigurations }}
- apiGroups: ["admissionregistration.k8s.io"]
  resources:
    - validatingwebhookconfigurations
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.volumeattachments }}
- apiGroups: ["storage.k8s.io"]
  resources:
    - volumeattachments
  verbs: ["list", "watch"]
{{ end -}}
{{ if .Values.collectors.verticalpodautoscalers }}
- apiGroups: ["autoscaling.k8s.io"]
  resources:
    - verticalpodautoscalers
  verbs: ["list", "watch"]
{{ end -}}
{{- end -}}
 # clusterrolebinding.yaml
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  name: {{ template "kube-state-metrics.fullname" . }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "kube-state-metrics.fullname" . }}
subjects:
- kind: ServiceAccount
  name: {{ template "kube-state-metrics.fullname" . }}
  namespace: {{ template "kube-state-metrics.namespace" . }}
{{- end -}}
 # deployment.yaml
apiVersion: apps/v1
{{- if .Values.autosharding.enabled }}
kind: StatefulSet
{{- else }}
kind: Deployment
{{- end }}
metadata:
  name: {{ template "kube-state-metrics.fullname" . }}
  namespace: {{ template "kube-state-metrics.namespace" . }}
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app.kubernetes.io/instance: "{{ .Release.Name }}"
    app.kubernetes.io/managed-by: "{{ .Release.Service }}"
{{- if .Values.customLabels }}
{{ toYaml .Values.customLabels | indent 4 }}
{{- end }}
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
  replicas: {{ .Values.replicas }}
{{- if .Values.autosharding.enabled }}
  serviceName: {{ template "kube-state-metrics.fullname" . }}
  volumeClaimTemplates: []
{{- end }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
        app.kubernetes.io/instance: "{{ .Release.Name }}"
{{- if .Values.customLabels }}
{{ toYaml .Values.customLabels | indent 8 }}
{{- end }}
{{- if .Values.podAnnotations }}
      annotations:
{{ toYaml .Values.podAnnotations | indent 8 }}
{{- end }}
    spec:
      hostNetwork: {{ .Values.hostNetwork }}
      serviceAccountName: {{ template "kube-state-metrics.serviceAccountName" . }}
      {{- if .Values.securityContext.enabled }}
      securityContext:
        fsGroup: {{ .Values.securityContext.fsGroup }}
        runAsGroup: {{ .Values.securityContext.runAsGroup }}
        runAsUser: {{ .Values.securityContext.runAsUser }}
      {{- end }}
    {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
    {{- end }}
      containers:
      - name: {{ .Chart.Name }}
{{- if .Values.autosharding.enabled }}
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
{{- end }}
        args:
{{  if .Values.collectors.certificatesigningrequests  }}
        - --collectors=certificatesigningrequests
{{  end  }}
{{  if .Values.collectors.configmaps  }}
        - --collectors=configmaps
{{  end  }}
{{  if .Values.collectors.cronjobs  }}
        - --collectors=cronjobs
{{  end  }}
{{ if .Values.collectors.daemonsets  }}
        - --collectors=daemonsets
{{  end  }}
{{  if .Values.collectors.deployments  }}
        - --collectors=deployments
{{  end  }}
{{  if .Values.collectors.endpoints  }}
        - --collectors=endpoints
{{  end  }}
{{  if .Values.collectors.horizontalpodautoscalers  }}
        - --collectors=horizontalpodautoscalers
{{  end  }}
{{  if .Values.collectors.ingresses  }}
        - --collectors=ingresses
{{  end  }}
{{  if .Values.collectors.jobs  }}
        - --collectors=jobs
{{  end  }}
{{  if .Values.collectors.limitranges  }}
        - --collectors=limitranges
{{  end  }}
{{  if .Values.collectors.mutatingwebhookconfigurations  }}
        - --collectors=mutatingwebhookconfigurations
{{  end  }}
{{  if .Values.collectors.namespaces  }}
        - --collectors=namespaces
{{  end  }}
{{  if .Values.collectors.networkpolicies  }}
        - --collectors=networkpolicies
{{  end  }}
{{  if .Values.collectors.nodes  }}
        - --collectors=nodes
{{  end  }}
{{  if .Values.collectors.persistentvolumeclaims  }}
        - --collectors=persistentvolumeclaims
{{  end  }}
{{  if .Values.collectors.persistentvolumes  }}
        - --collectors=persistentvolumes
{{  end  }}
{{  if .Values.collectors.poddisruptionbudgets  }}
        - --collectors=poddisruptionbudgets
{{  end  }}
{{  if .Values.collectors.pods  }}
        - --collectors=pods
{{  end  }}
{{  if .Values.collectors.replicasets  }}
        - --collectors=replicasets
{{  end  }}
{{  if .Values.collectors.replicationcontrollers  }}
        - --collectors=replicationcontrollers
{{  end  }}
{{  if .Values.collectors.resourcequotas  }}
        - --collectors=resourcequotas
{{  end  }}
{{  if .Values.collectors.secrets  }}
        - --collectors=secrets
{{  end  }}
{{  if .Values.collectors.services  }}
        - --collectors=services
{{  end  }}
{{  if .Values.collectors.statefulsets  }}
        - --collectors=statefulsets
{{  end  }}
{{  if .Values.collectors.storageclasses  }}
        - --collectors=storageclasses
{{  end  }}
{{  if .Values.collectors.validatingwebhookconfigurations  }}
        - --collectors=validatingwebhookconfigurations
{{  end  }}
{{  if .Values.collectors.verticalpodautoscalers  }}
        - --collectors=verticalpodautoscalers
{{  end  }}
{{  if .Values.collectors.volumeattachments  }}
        - --collectors=volumeattachments
{{  end  }}
{{ if .Values.namespace }}
        - --namespace={{ .Values.namespace }}
{{ end }}
{{ if .Values.autosharding.enabled }}
        - --pod=$(POD_NAME)
        - --pod-namespace=$(POD_NAMESPACE)
{{ end }}
{{ if .Values.kubeconfig.enabled }}
        - --kubeconfig=/opt/k8s/.kube/config
{{ end }}
{{- if .Values.kubeconfig.enabled }}
        volumeMounts:
        - name: kubeconfig
          mountPath: /opt/k8s/.kube/
          readOnly: true
{{- end }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        ports:
        - containerPort: 8080
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 5
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 5
          timeoutSeconds: 5
{{- if .Values.resources }}
        resources:
{{ toYaml .Values.resources | indent 10 }}
{{- end }}
{{- if .Values.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
{{- end }}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
{{- if .Values.kubeconfig.enabled}}
      volumes:
        - name: kubeconfig
          secret:
            secretName: {{ template "kube-state-metrics.fullname" . }}-kubeconfig
{{- end }}
 # kubeconfig-secret.yaml
{{- if .Values.kubeconfig.enabled -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "kube-state-metrics.fullname" . }}-kubeconfig
  namespace: {{ template "kube-state-metrics.namespace" . }}
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app.kubernetes.io/instance: "{{ .Release.Name }}"
    app.kubernetes.io/managed-by: "{{ .Release.Service }}"
type: Opaque
data:
  config: '{{ .Values.kubeconfig.secret }}'
{{- end -}}
 # pdb.yaml
{{- if .Values.podDisruptionBudget -}}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: {{ template "kube-state-metrics.fullname" . }}
  namespace: {{ template "kube-state-metrics.namespace" . }}
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app.kubernetes.io/instance: "{{ .Release.Name }}"
    app.kubernetes.io/managed-by: "{{ .Release.Service }}"
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
{{ toYaml .Values.podDisruptionBudget | indent 2 }}
{{- end -}} # podsecuritypolicy.yaml
{{- if .Values.podSecurityPolicy.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: {{ template "kube-state-metrics.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
{{- if .Values.podSecurityPolicy.annotations }}
  annotations:
{{ toYaml .Values.podSecurityPolicy.annotations | indent 4 }}
{{- end }}
spec:
  privileged: false
  volumes:
    - 'secret'
{{- if .Values.podSecurityPolicy.additionalVolumes }}
{{ toYaml .Values.podSecurityPolicy.additionalVolumes | indent 4 }}
{{- end }}
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      # Forbid adding the root group.
      - min: 1
        max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      # Forbid adding the root group.
      - min: 1
        max: 65535
  readOnlyRootFilesystem: false
{{- end }}
 # psp-clusterrole.yaml
{{- if and .Values.podSecurityPolicy.enabled .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  name: psp-{{ template "kube-state-metrics.fullname" . }}
rules:
{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }}
{{- if semverCompare "> 1.15.0-0" $kubeTargetVersion }}
- apiGroups: ['policy']
{{- else }}
- apiGroups: ['extensions']
{{- end }}
  resources: ['podsecuritypolicies']
  verbs:     ['use']
  resourceNames:
  - {{ template "kube-state-metrics.fullname" . }}
{{- end }}
 # psp-clusterrolebinding.yaml
{{- if and .Values.podSecurityPolicy.enabled .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  name: psp-{{ template "kube-state-metrics.fullname" . }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: psp-{{ template "kube-state-metrics.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "kube-state-metrics.fullname" . }}
    namespace: {{ template "kube-state-metrics.namespace" . }}
{{- end }}
 # service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "kube-state-metrics.fullname" . }}
  namespace: {{ template "kube-state-metrics.namespace" . }}
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app.kubernetes.io/instance: "{{ .Release.Name }}"
    app.kubernetes.io/managed-by: "{{ .Release.Service }}"
{{- if .Values.customLabels }}
{{ toYaml .Values.customLabels | indent 4 }}
{{- end }}
  annotations:
    {{- if .Values.prometheusScrape }}
    prometheus.io/scrape: '{{ .Values.prometheusScrape }}'
    {{- end }}
    {{- if .Values.service.annotations }}
    {{- toYaml .Values.service.annotations | nindent 4 }}
    {{- end }}
spec:
  type: "{{ .Values.service.type }}"
  ports:
  - name: "http"
    protocol: TCP
    port: {{ .Values.service.port }}
  {{- if .Values.service.nodePort }}
    nodePort: {{ .Values.service.nodePort }}
  {{- end }}
    targetPort: 8080
{{- if .Values.service.loadBalancerIP }}
  loadBalancerIP: "{{ .Values.service.loadBalancerIP }}"
{{- end }}
  selector:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 # serviceaccount.yaml
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  name: {{ template "kube-state-metrics.fullname" . }}
  namespace: {{ template "kube-state-metrics.namespace" . }}
{{- if .Values.serviceAccount.annotations }}
  annotations:
{{ toYaml .Values.serviceAccount.annotations | indent 4 }}
{{- end }}
imagePullSecrets:
{{ toYaml .Values.serviceAccount.imagePullSecrets | indent 2 }}
{{- end -}}
 # servicemonitor.yaml
{{- if .Values.prometheus.monitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: {{ template "kube-state-metrics.fullname" . }}
  namespace: {{ template "kube-state-metrics.namespace" . }}
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    app.kubernetes.io/instance: "{{ .Release.Name }}"
    app.kubernetes.io/managed-by: "{{ .Release.Service }}"
    {{- if .Values.prometheus.monitor.additionalLabels }}
{{ toYaml .Values.prometheus.monitor.additionalLabels | indent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  endpoints:
    - port: http
      {{- if .Values.prometheus.monitor.honorLabels }}
      honorLabels: true
      {{- end }}
{{- end }}
 # stsdiscovery-role.yaml
{{- if and .Values.autosharding.enabled .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: stsdiscovery-{{ template "kube-state-metrics.fullname" . }}
  namespace: {{ template "kube-state-metrics.namespace" . }}
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
- apiGroups:
  - apps
  resourceNames:
  - {{ template "kube-state-metrics.fullname" . }}
  resources:
  - statefulsets
  verbs:
  - get
  - list
  - watch
{{- end }}
 # stsdiscovery-rolebinding.yaml
{{- if and .Values.autosharding.enabled .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: stsdiscovery-{{ template "kube-state-metrics.fullname" . }}
  namespace: {{ template "kube-state-metrics.namespace" . }}
  labels:
    app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: stsdiscovery-{{ template "kube-state-metrics.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "kube-state-metrics.fullname" . }}
    namespace: {{ template "kube-state-metrics.namespace" . }}
{{- end }}

# Default values for kube-state-metrics.
prometheusScrape: true
image:
  repository: quay.io/coreos/kube-state-metrics
  tag: v1.9.7
  pullPolicy: IfNotPresent

imagePullSecrets: []
# - name: "image-pull-secret"

# If set to true, this will deploy kube-state-metrics as a StatefulSet and the data
# will be automatically sharded across <.Values.replicas> pods using the built-in
# autodiscovery feature: https://github.com/kubernetes/kube-state-metrics#automated-sharding
# This is an experimental feature and there are no stability guarantees.
autosharding:
  enabled: false

replicas: 1

service:
  port: 8080
  # Default to clusterIP for backward compatibility
  type: ClusterIP
  nodePort: 0
  loadBalancerIP: ""
  annotations: {}

customLabels: {}

hostNetwork: false

rbac:
  # If true, create & use RBAC resources
  create: true

serviceAccount:
  # Specifies whether a ServiceAccount should be created, require rbac true
  create: true
  # The name of the ServiceAccount to use.
  # If not set and create is true, a name is generated using the fullname template
  name:
  # Reference to one or more secrets to be used when pulling images
  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  imagePullSecrets: []
  # ServiceAccount annotations.
  # Use case: AWS EKS IAM roles for service accounts
  # ref: https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html
  annotations: {}

prometheus:
  monitor:
    enabled: false
    additionalLabels: {}
    namespace: ""
    honorLabels: false

## Specify if a Pod Security Policy for kube-state-metrics must be created
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
##
podSecurityPolicy:
  enabled: false
  annotations: {}
    ## Specify pod annotations
    ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor
    ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
    ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl
    ##
    # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
    # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
    # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'

  additionalVolumes: []

securityContext:
  enabled: true
  runAsGroup: 65534
  runAsUser: 65534
  fsGroup: 65534

## Node labels for pod assignment
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
nodeSelector: {}

## Affinity settings for pod assignment
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
affinity: {}

## Tolerations for pod assignment
## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
tolerations: []

# Annotations to be added to the pod
podAnnotations: {}

## Assign a PriorityClassName to pods if set
# priorityClassName: ""

# Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
podDisruptionBudget: {}

# Available collectors for kube-state-metrics. By default all available
# collectors are enabled.
collectors:
  certificatesigningrequests: true
  configmaps: true
  cronjobs: true
  daemonsets: true
  deployments: true
  endpoints: true
  horizontalpodautoscalers: true
  ingresses: true
  jobs: true
  limitranges: true
  mutatingwebhookconfigurations: true
  namespaces: true
  networkpolicies: true
  nodes: true
  persistentvolumeclaims: true
  persistentvolumes: true
  poddisruptionbudgets: true
  pods: true
  replicasets: true
  replicationcontrollers: true
  resourcequotas: true
  secrets: true
  services: true
  statefulsets: true
  storageclasses: true
  validatingwebhookconfigurations: true
  verticalpodautoscalers: false
  volumeattachments: true

# Enabling kubeconfig will pass the --kubeconfig argument to the container
kubeconfig:
  enabled: false
  # base64 encoded kube-config file
  secret:

# Namespace to be enabled for collecting resources. By default all namespaces are collected.
# namespace: ""

## Override the deployment namespace
##
namespaceOverride: ""

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #  cpu: 100m
  #  memory: 64Mi
  # requests:
  #  cpu: 10m
  #  memory: 32Mi

## Provide a k8s version to define apiGroups for podSecurityPolicy Cluster Role.
## For example: kubeTargetVersionOverride: 1.14.9
##
kubeTargetVersionOverride: ""
