Install a Remote Network Agent in Production Using Helm

# clientId and clientSecret are your CD-as-a-Service Client Credentials, which must have the `Remote Network Agent` scope.
# Go to https://console.cloud.armory.io/configuration/credentials to create credentials or add the scope.
#
# You can configure the clientId and clientSecret using a Kubernetes secret or an Armory Continuous Deployment Secrets token.
#
# EX: using Kubernetes secrets
# Save your Client Credentials as a Kubernetes secret
# kubectl -ns armory-rna create secret generic rna-client-credentials --type=string --from-literal=client-secret=xxx-yyy-ooo --from-literal=client-id=zzz-ooo-qqq
# Set the clientSecret value as:
# clientSecret: encrypted:k8s!n:rna-client-credentials!k:client-secret
#
# EX: using AWS Secrets Manager
# ex: clientSecret: encrypted:secrets-manager!r:us-west-2!s:some-aws-sm-secret-name!k:client-secret
# See:
# - https://docs.armory.io/continuous-deployment/armory-admin/secrets/
# - https://docs.armory.io/continuous-deployment/armory-admin/secrets/secrets-kubernetes/ (ignore the note saying it only works with Operator; it has been back ported to RNA)
# - https://docs.armory.io/continuous-deployment/armory-admin/secrets/secrets-vault/
# - https://docs.armory.io/continuous-deployment/armory-admin/secrets/secrets-aws-sm/
# - https://docs.armory.io/continuous-deployment/armory-admin/secrets/secrets-gcs/
# - https://docs.armory.io/continuous-deployment/armory-admin/secrets/secrets-s3/
#
# If you have a process for injecting secrets as env vars, such as a vault injector sidecar, you can set the clientSecret to an env var here.
# ex: clientSecret: '{{ env.MY_CLIENT_SECRET }}'
# ex: https://www.vaultproject.io/docs/platform/k8s/injector
#
# Do NOT use the plain text value of clientSecret in the values file or as an arg to the Helm chart!
clientId:
clientSecret:

#############################################################################
#
# All settings below this line are optional
#
#############################################################################
# Defaults to the name used when creating the Client Credentials for this RNA.
# This is that name that your CD-as-a-Service deployment references to deploy to the cluster that the RNA is running in.
agentIdentifier:

replicaCount: 2

image:
  repository: armory/remote-network-agent
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

# imagePullSecrets:
#  - name: regcred
imagePullSecrets: []

# Proxy settings if the RNA needs to go through a proxy to connect the Agent Hub
# See the comments below or the following for more technical information:
# - https://github.com/grpc/grpc-go/blob/master/Documentation/proxy.md
# - https://pkg.go.dev/golang.org/x/net/http/httpproxy#FromEnvironment
proxy:
  enabled: false
  # Either a complete URL or a "host[:port]", in which case the "http" scheme is assumed.
  # An error is returned if the value is a different form.
  url: https://proxy.internal.example.com:443
  # nonProxyHosts specifies a string that contains comma-separated values specifying hosts that should be excluded from proxying.
  #
  # Each value is represented by an IP address prefix (1.2.3.4), an IP address prefix in CIDR notation (1.2.3.4/8),
  # a domain name, or a special DNS label (*).
  #
  # An IP address prefix and domain name can also include a literal port number (1.2.3.4:80).
  # A domain name matches that name and all subdomains. A domain name with a leading "." matches subdomains only.
  # For example "foo.com" matches "foo.com" and "bar.foo.com"; ".y.com" matches "x.y.com" but not "y.com".
  # A single asterisk (*) indicates that no proxying should be done.
  # A best effort is made to parse the string and errors are ignored.
  nonProxyHosts:

# When Kubernetes cluster account mode is enabled, installation creates a ServiceAccount, ClusterRole, and ClusterRoleBinding.
# The created ServiceAccount with ClusterRoleBinding is applied to the RNA.
# The RNA then registers itself as a deployable Kubernetes target from within CD-as-a-Service.
#
# When Kubernetes cluster account mode is disabled, the RNA only allows you to make network calls to networked resources.
kubernetes:
  enableClusterAccountMode: true
  # RBAC permissions granted to the ServiceAccount for the RNA
  clusterRoleRules:
    - apiGroups: [ "*" ]
      resources: [ "*" ]
      verbs: [ "*" ]
  serviceAccount:
    # Annotations to add to the ServiceAccount
    annotations: {}

# Additional environment variables to add to the Pods
# podEnvironmentVariables:
#  - name: FOO
#    value: bar
podEnvironmentVariables: []

# Additional labels to add to the Pods:
# podLabels:
#   key: value
podLabels: {}

log:
  # Can be set to console, console-wide (all the same metadata that gets added to json output) or json
  type: console
  # Disable color output
  disableColor: false
  # debug,info,warn,error
  level: info

# Additional annotations for Pods
# podAnnotations:
#   prometheus.io/scrape: "true"
#   prometheus.io/path: "/metrics"
#   prometheus.io/port: "8080"
#   prometheus.io/scheme: "http"
#   key: value
podAnnotations: {}

# Configure Pod resource requests and limits
# https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits
resources: {}
  # limits:
  #   cpu: 200m
  #   memory: 512Mi
  # requests:
  #   cpu: 100m
  #   memory: 256Mi

# Sets Pod's priorityClassName.
priorityClassName: ""

# Sets the RNA's Pod DNS policy
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
dnsPolicy:

# Sets Pod's dnsConfig.
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
dnsConfig: {}

# Sets Pod/Node affinities.
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
affinity: {}

# Sets Pod's node selector.
# https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
nodeSelector: {}

# Sets Pod's tolerations to node taints.
# https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
tolerations: []