values.yaml

global:
  rbac:
    create: true
    # Create a PodSecurityPolicy, cluster role, role binding and service account for the HiveMQ pods and assign the service account to them.
    # Disabled by default. PodSecurityPolicy has been removed from Kubernetes versions starting with v1.25 https://kubernetes.io/docs/concepts/security/pod-security-policy/
    pspEnabled: false
    pspAnnotations: {}
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
    allowedCapabilities: []
    # Image pull secrets for operator, hivemq or other images.
    imagePullSecrets: []
    # - name: hivemq-pull-secret

operator:
  # Deploy a custom resource based on the hivemq section below. Set to false if you want to create a HiveMQCluster object yourself.
  # By setting this to false, the operator will not start a HiveMQ cluster when deployed.
  deployCr: true
  image: hivemq/hivemq-operator:4.7.10
  imagePullPolicy: IfNotPresent

  # Whether the operator should handle HiveMQCluster resources across all namespaces
  crossNamespaceMode: false

  ## Nodeselector for pod assignment
  ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector
  ##
  nodeSelector: {}

  ## Affinity for pod assignment
  ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  ##
  affinity: {}

  logLevel: INFO
  # Let the operator verify all HiveMQCluster objects before accepting them.
  # Not using the validation hook can result in erroneous cluster configurations which are hard to debug.
  admissionWebhooks:
    # Enable the admission hook
    enabled: true
    # Reject updates to the CR when the admission hook fails
    failurePolicy: Fail
    ## If enabled, generate a self-signed certificate, then patch the webhook configurations with the generated data.
    ## On chart upgrades (or if the secret exists) the cert will not be re-generated. You can use this to provide your own
    ## certs ahead of time if you wish.
    patch:
      enabled: true
      image:
        repository: registry.k8s.io/ingress-nginx/kube-webhook-certgen
        tag: v1.1.1
        sha: ""
        pullPolicy: IfNotPresent
      resources: {}
      ## Provide a priority class name to the webhook patching job
      priorityClassName: ""
      podAnnotations: {}
      nodeSelector: {}
      affinity: {}
      tolerations: []
  # Set this string to a name of an externally managed ConfigMap containing the templates for the operator if you want to customize them.
  templateConfigMap: ""
  # Allow to customize the java environmental variables
  javaEnvironment: "-XX:+UnlockExperimentalVMOptions -XX:InitialRAMPercentage=75 -XX:MaxRAMPercentage=75"
  ## Extra environment variables that will be pass to the operator in the form of
  ## env:
  ## MY_CUSTOM_ENV: MY_VALUE
  env: {}
  resources:
    limits:
      cpu: 800m
      memory: 640M
    requests:
      cpu: 200m
      memory: 640M
monitoring:
  # Deploy ServiceMonitor for Prometheus Operator and enable Prometheus
  enabled: false
  # Deploy a dedicated instance of the prometheus operator, including grafana, as sub-chart
  dedicated: false
hivemq:
  # Custom container spec to add to the HiveMQ Pod
  sidecars: []
  # Custom init container specs to add to the HiveMQ Pod. This is an extension of the initialization field. In comparison, this field does not have any defaults but allows for more granular configuration using the full K8s Container API
  initContainers: []
  # HiveMQ Pod security context
  podSecurityContext: {}
    # fsGroup: 10000
    # runAsNonRoot: true
    # runAsUser: 10001
    # sysctls:
      # To ensure we don't run into port exhaustion
      # - name: net.ipv4.ip_local_port_range
      #   value: "1024 65535"
  # HiveMQ container security context within the Pod
  containerSecurityContext:
    # runAsNonRoot: true
    # allowPrivilegeEscalation: false
    # privileged: false
  # TopologySpreadConstraints to apply in the underlying Pod spec
  topologySpreadConstraints: []
  # Tolerations to apply in the underlying Pod spec
  tolerations: []

  # Node selectors for the Pod spec
  nodeSelector: {}
  # StatefulSet only: Volume claim templates to use
  volumeClaimTemplates:
    # - kind: PersistentVolumeClaim
    #   apiVersion: v1
    #   metadata:
    #     name: data
    #   spec:
    #     accessModes:
    #       - ReadWriteOnce
    #     resources:
    #       requests:
    #         storage: 100Gi
    #     volumeMode: Filesystem
  # RuntimeClass for the Pod spec
  runtimeClassName: ""
  # PriorityClass for the Pod spec
  priorityClassName: ""

  # Additional volumes to add to the HiveMQ Pod
  additionalVolumes: []
  # Additional volume mounts for the HiveMQ container
  additionalVolumeMounts: []
  # DNS suffix to use for DNS discovery
  dnsSuffix: "svc.cluster.local."

  # Annotations to add to the HiveMQ Pods
  podAnnotations: {}
  # Labels to add to the HiveMQ Pods
  podLabels: {}

  # Optional operator-internal configuration (See kubectl explain hmqc.spec.operatorHints for more info)
  operatorHints: {}

  # Custom properties to set in the custom resource, to be used in conjunction with custom operator templates.
  customProperties: {}
  # Annotations to apply to the service account
  serviceAccountAnnotations: {}
  # The values below apply to the HiveMQCluster object. If you are using deployCr: false, this is unused
  image: hivemq/hivemq4:k8s-4.36.0
  imagePullPolicy: IfNotPresent
  nodeCount: "3"
  cpu: "4"
  memory: "4Gi"
  ephemeralStorage: "15Gi"
  # This is only used if global.rbac.create is set to false
  serviceAccountName: hivemq
  # Base64 encoded license. (NOTE: use a ConfigMap when mounting multiple files)
  license: ""
  env: []
  ## Skip config validation
  #     - name: "HIVEMQ_SKIP_CONFIG_VALIDATION"
  #      value: "true"
  ## Add custom environment variables (e.g. for your extension) here.
  # - name: MY_CUSTOM_ENV
  #   value: some-value
  initialization: []
  ## Add custom initContainers here. Busybox is the default image. and /bin/sh -c the default command
  # - name: init-cfg
  #   image: busybox
  #   command:
  #   - /bin/sh
  #   - "-c"
  #   args:
  #   - |
  #     echo "mycustomfile" >> /hivemq-data/conf/test.cfg
  initBusyboxImage: busybox:latest
  initDnsWaitImage: hivemq/init-dns-wait:1.0.0
  extensions:
    - # Default platform extensions starting from 4.4.0. Add a configMap and enable them if you want to use either
      name: hivemq-kafka-extension
      extensionUri: preinstalled
      enabled: false
    - name: hivemq-google-cloud-pubsub-extension
      extensionUri: preinstalled
      enabled: false
    - name: hivemq-bridge-extension
      extensionUri: preinstalled
      enabled: false
    - name: hivemq-enterprise-security-extension
      extensionUri: preinstalled
      enabled: false
      # Note that this is just an example initialization routine. Make sure this points to the current JDBC version you require for your configuration.
      initialization: |
        # Download JDBC driver for PostgreSQL
        [[ ! -f drivers/postgres-jdbc.jar ]] &&
        curl -L https://jdbc.postgresql.org/download/postgresql-42.2.14.jar --output drivers/jdbc/postgres.jar
    - name: hivemq-distributed-tracing-extension
      extensionUri: preinstalled
      enabled: false
    - name: hivemq-amazon-kinesis-extension
      extensionUri: preinstalled
      enabled: false
  ## Feel free to add other extensions as well. You should keep the blocks above to maintain control over the platform extensions though.
  #- name: hivemq-mqtt-message-log-extension
  #  extensionUri: https://github.com/hivemq/hivemq-mqtt-message-log-extension/releases/download/1.1.3/hivemq-mqtt-message-log-extension-1.1.3.zip
  #  configMap: message-log-config
  configMaps: []
  # ConfigMaps to mount to the HiveMQ pods. These can be mounted to existing directories without shadowing the folder contents as well.
  #- name: hivemq-license
  #  path: /opt/hivemq/license
  secrets: []
  # Secrets to mount to the HiveMQ pods. These can be mounted to existing directories without shadowing the folder contents as well.
  #- name: hivemq-license
  #  path: /opt/hivemq/license
  cpuLimitRatio: "1"
  memoryLimitRatio: "1"
  ephemeralStorageLimitRatio: "1"
  affinity: |
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        # Try not to co-locate with nodes from the same cluster
        - weight: 60
          podAffinityTerm:
            labelSelector:
              matchExpressions:
                - key: hivemq-cluster
                  operator: In
                  values:
                    - {{ spec.name }}
            topologyKey: "kubernetes.io/hostname"
        # Try not to co-locate with other HiveMQ clusters
        - weight: 30
          podAffinityTerm:
            labelSelector:
              matchExpressions:
                - key: app
                  operator: In
                  values:
                    - hivemq
            topologyKey: "kubernetes.io/hostname"
  listenerConfiguration: |
    <tcp-listener>
        <port>${HIVEMQ_MQTT_PORT}</port>
        <bind-address>0.0.0.0</bind-address>
    </tcp-listener>
  restApiConfiguration: <rest-api/>
  restrictions:
    noConnectIdleTimeout: 10000
    maxClientIdLength: 65535
    maxTopicLength: 65535
    incomingBandwidthThrottling: 0
    maxConnections: -1
  security:
    controlCenterAuditLogEnabled: true
    topicFormatValidation: true
    allowRequestProblemInformation: true
    allowEmptyClientId: true
    payloadFormatValidation: false
  logLevel: "INFO"
  # The ports can be edited or expanded upon, but the MQTT port must be the first one.
  ports:
    - name: "mqtt"
      port: 1883
      expose: true
      patch:
        - '[{"op":"add","path":"/spec/selector/hivemq.com~1node-offline","value":"false"},{"op":"add","path":"/metadata/annotations","value":{"service.spec.externalTrafficPolicy":"Local"}}]'
        # If you want Kubernetes to expose the MQTT port to external traffic
        # - '[{"op":"add","path":"/spec/type","value":"LoadBalancer"}]'
    - name: "cc"
      port: 8080
      expose: true
      patch:
        - '[{"op":"add","path":"/spec/sessionAffinity","value":"ClientIP"}]'
        # If you want Kubernetes to expose the HiveMQ control center via load balancer.
        # Warning: You should consider configuring proper security and TLS beforehand. Ingress may be a better option here.
        # - '[{"op":"add","path":"/spec/type","value":"LoadBalancer"}]'
  # To enable the HiveMQ REST API and expose it as a service. Be aware of the security risks of exposing the REST API
  # - name: "api"
  #   port: 8888
  #   expose: true
  #   patch:
  #     - '[{"op":"add","path":"/spec/sessionAffinity","value":"ClientIP"}]'

  clusterOverloadProtection: "true"
  mqtt:
    sharedSubscriptionEnabled: true
    queuedMessageStrategy: "discard"
    messageExpiryMaxInterval: 4294967296
    subscriptionIdentifierEnabled: true
    keepaliveAllowUnlimited: true
    retainedMessagesEnabled: true
    topicAliasMaxPerClient: 5
    maxPacketSize: 268435460
    topicAliasEnabled: true
    serverReceiveMaximum: 10
    keepaliveMax: 65535
    wildcardSubscriptionEnabled: true
    queuedMessagesMaxQueueSize: 1000
    sessionExpiryInterval: 4294967295
    maxQos: 2
  javaOptions: "-XX:+UnlockExperimentalVMOptions -XX:InitialRAMPercentage=40 -XX:MaxRAMPercentage=50 -XX:MinRAMPercentage=30"
  clusterReplicaCount: "2"
  controllerTemplate: cluster-deployment.yaml
  # language=XML
  configOverride: |
    <?xml version="1.0"?>
    <hivemq xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:noNamespaceSchemaLocation="config.xsd">
        <listeners>
            --LISTENER-CONFIGURATION--
        </listeners>
        <control-center>
            <listeners>
                <http>
                    <port>${HIVEMQ_CONTROL_CENTER_PORT}</port>
                    <bind-address>0.0.0.0</bind-address>
                </http>
            </listeners>
            <users>
                <user>
                    <name>${HIVEMQ_CONTROL_CENTER_USER}</name>
                    <password>${HIVEMQ_CONTROL_CENTER_PASSWORD}</password>
                </user>
            </users>
        </control-center>

        <!--REST-API-CONFIGURATION-->
        <cluster>
            <enabled>true</enabled>
            <transport>
                <tcp>
                    <bind-address>${HIVEMQ_BIND_ADDRESS}</bind-address>
                    <bind-port>${HIVEMQ_CLUSTER_PORT}</bind-port>
                </tcp>
            </transport>
            <discovery>
                <extension/>
            </discovery>

            <replication>
                <replica-count>${HIVEMQ_CLUSTER_REPLICA_COUNT}</replica-count>
            </replication>

            <failure-detection>
                <tcp-health-check>
                    <enabled>true</enabled>
                    <bind-address>${HIVEMQ_BIND_ADDRESS}</bind-address>
                    <bind-port>9000</bind-port>
                    <port-range>50</port-range>
                </tcp-health-check>

                <heartbeat>
                    <enabled>true</enabled>
                    <interval>4000</interval>
                    <timeout>30000</timeout>
                </heartbeat>
            </failure-detection>

        </cluster>
        <overload-protection>
            <enabled>${HIVEMQ_CLUSTER_OVERLOAD_PROTECTION}</enabled>
        </overload-protection>
        <restrictions>
            <max-client-id-length>${HIVEMQ_MAX_CLIENT_ID_LENGTH}</max-client-id-length>
            <max-topic-length>${HIVEMQ_MAX_TOPIC_LENGTH}</max-topic-length>
            <max-connections>${HIVEMQ_MAX_CONNECTIONS}</max-connections>
            <incoming-bandwidth-throttling>${HIVEMQ_INCOMING_BANDWIDTH_THROTTLING}</incoming-bandwidth-throttling>
            <no-connect-idle-timeout>${HIVEMQ_NO_CONNECT_IDLE_TIMEOUT}</no-connect-idle-timeout>
        </restrictions>
        <mqtt>
            <session-expiry>
                <max-interval>${HIVEMQ_SESSION_EXPIRY_INTERVAL}</max-interval>
            </session-expiry>

            <message-expiry>
                <max-interval>${HIVEMQ_MESSAGE_EXPIRY_MAX_INTERVAL}</max-interval>
            </message-expiry>

            <packets>
                <max-packet-size>${HIVEMQ_MAX_PACKET_SIZE}</max-packet-size>
            </packets>

            <receive-maximum>
                <server-receive-maximum>${HIVEMQ_SERVER_RECEIVE_MAXIMUM}</server-receive-maximum>
            </receive-maximum>

            <keep-alive>
                <max-keep-alive>${HIVEMQ_KEEPALIVE_MAX}</max-keep-alive>
                <allow-unlimited>${HIVEMQ_KEEPALIVE_ALLOW_UNLIMITED}</allow-unlimited>
            </keep-alive>

            <topic-alias>
                <enabled>${HIVEMQ_TOPIC_ALIAS_ENABLED}</enabled>
                <max-per-client>${HIVEMQ_TOPIC_ALIAS_MAX_PER_CLIENT}</max-per-client>
            </topic-alias>

            <subscription-identifier>
                <enabled>${HIVEMQ_SUBSCRIPTION_IDENTIFIER_ENABLED}</enabled>
            </subscription-identifier>

            <wildcard-subscriptions>
                <enabled>${HIVEMQ_WILDCARD_SUBSCRIPTION_ENABLED}</enabled>
            </wildcard-subscriptions>

            <shared-subscriptions>
                <enabled>${HIVEMQ_SHARED_SUBSCRIPTION_ENABLED}</enabled>
            </shared-subscriptions>

            <quality-of-service>
                <max-qos>${HIVEMQ_MAX_QOS}</max-qos>
            </quality-of-service>

            <retained-messages>
                <enabled>${HIVEMQ_RETAINED_MESSAGES_ENABLED}</enabled>
            </retained-messages>

            <queued-messages>
                <max-queue-size>${HIVEMQ_QUEUED_MESSAGE_MAX_QUEUE_SIZE}</max-queue-size>
                <strategy>${HIVEMQ_QUEUED_MESSAGE_STRATEGY}</strategy>
            </queued-messages>
        </mqtt>
        <security>
            <!-- Allows the use of empty client ids -->
            <allow-empty-client-id>
                <enabled>${HIVEMQ_ALLOW_EMPTY_CLIENT_ID}</enabled>
            </allow-empty-client-id>

            <!-- Configures validation for UTF-8 PUBLISH payloads -->
            <payload-format-validation>
                <enabled>${HIVEMQ_PAYLOAD_FORMAT_VALIDATION}</enabled>
            </payload-format-validation>

            <utf8-validation>
                <enabled>${HIVEMQ_TOPIC_FORMAT_VALIDATION}</enabled>
            </utf8-validation>

            <!-- Allows clients to request problem information -->
            <allow-request-problem-information>
                <enabled>${HIVEMQ_ALLOW_REQUEST_PROBLEM_INFORMATION}</enabled>
            </allow-request-problem-information>

            <control-center-audit-log>
                <enabled>${HIVEMQ_CONTROL_CENTER_AUDIT_LOG_ENABLED}</enabled>
            </control-center-audit-log>
        </security>
    </hivemq>
nameOverride: ""
namespaceOverride: ""
fullnameOverride: ""
# Whether to add the generic, common Helm metadata labels (mainly intended for use as a utility for generating the non-Helm install manifests)
generateLabels: true