values.sample.yaml

environmentName: <company-name>
  #
# useUnprivilegedContainers will pull images that do not run as root if
# using tonic provided images rather than rehosted customer images
# additionally it enforces that containers cannot run as root, uses the
# default runtime security profile, forbids privilege escalation and drops
# all SYS_CAP privileges. This setting allows tonic to run in restricted
# environments such as openshift
# NOTE setting explicit image tags in any of the tonicai services will
# overwrite the default unprivileged image tags. If you rehost unprivileged
# images then you should set useUnprivilegedContainers and tonicai service
# image tags; otherwise you only need to set this flag to true or false
useUnprivilegedContainers: false
# setting this to true will run tonic containers with a read only root
# filesystem and provides necessary emptyDir volume mounts
readOnlyRootFilesystem: false

# tonicdb is the postgres database that will hold information about your workspace.
tonicdb:
  host: <db-host>
  port: 5432
  dbName: tonic
  user: <user>
  password: <password>
  sslMode: Require

# tonicStatisticsSeed will cause generations to be consisent with each other for anything where consistency is set to true.
# otherwise each generation will be internally consistent, but not consistent with other generations.
# add quote to integer values to get rid of helm cast large number to float64, refer to this issue: https://github.com/helm/helm/issues/1707
# tonicStatisticsSeed: "<any-integer>"

# numberOfWorkers will determine how many worker containers are deployed when installing the helm chart.
numberOfWorkers: 1

# enableLogCollection will send errors and general information about generations to Tonic if true. It will not send user data.
enableLogCollection: false

# This value will be provided to you by Tonic and will allow you to authenticate against our private docker repository.
dockerConfigAuth: <docker-config-auth>

# Service account for tonic
serviceAccount:
  create: true
  annotations: {}

# You can set this to a specific Tonic version number if you wish to ensure you always get the same version. Otherwise you will always deploy the latest version of Tonic.
tonicVersion: latest

# Container repository with tonic images. If you don't use the default one you will have to copy images over before deployment
tonicai:
  web_server:
    env: {}
    envRaw: {}
    #image: quay.io/tonicai/tonic_web_server
    # Comma separated list of user emails that should be have the Admin role in Tonic.
    administrators: example@email.com,other@email.com
    # annotations to apply to the service that routes traffic to the web server
    annotations: {}
      # By default this chart will create an internal load balancer service on
      # EKS and AKS; however, providing additional annotations will disable this
      # If additional annotations are applied and you need a load balancer to
      # the Tonic installation see documentation from your cloud provider
      # AWS: https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html
      #      https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.5/
      # Azure: https://learn.microsoft.com/en-us/azure/aks/internal-lb
      # GCP: https://cloud.google.com/kubernetes-engine/docs/concepts/service-load-balancer
    features:
      # Enables/Disables the HostIntegrations endpoint
      host_integration_enabled: "true"
      kubernetes_role: "default"
    ports:
      httpsOnly: true
      https: 443
      http: 80
    # Supported values are LoadBalancer, ClusterIP and NodePort.
    # By default, this is set to LoadBalancer when use_ingress = false and ClusterIP when use_ingress = true
    # If a value is provided here, it will override the default set based on use_ingress
    # service_type: "LoadBalancer"
    resources:
      requests:
        memory: "2Gi"
        ephemeral-storage: "1Gi"
      limits:
        memory: "3Gi"
  worker:
    #image: quay.io/tonicai/tonic_worker
    env: {}
    envRaw: {}
    ports:
      httpsOnly: true
      https: 443
      http: 80
    resources:
      requests:
        memory: "6Gi"
        ephemeral-storage: "1Gi"
      limits:
        memory: "12Gi"
  notifications:
    #image: quay.io/tonicai/tonic_notifications
    env: {}
    envRaw: {}
    resources:
      requests:
        memory: "512Mi"
        ephemeral-storage: "1Gi"
      limits:
        memory: "1Gi"
  pyml_service:
    #image: quay.io/tonicai/tonic_pyml_service
    env: {}
    envRaw: {}
    resources:
      requests:
        memory: "512Mi"
        ephemeral-storage: "1Gi"
      limits:
        memory: "8Gi"
        # To enable Nvidia acceleration for the pyml container, uncomment the following
        # lines and specify how many GPUs to allocate for the pod. If this feature is
        # enabled then your cluster must support the nvidia.com/gpu resource.
        #nvida.com/gpu: 1
    # If you use node taints and pod tolerances to control scheduling
    # of GPU bound workloads, then you can also provide a list of tolerations the
    # pyml pod should accept
    tolerations: []
    # - key: "tonic.ai/gpu"
    #   operator: "Exists"
    #   effect: "NoSchedule"
  # use_ingress typically only used by TIM
  #use_ingress: true
  #ingress:
  #  class: nginx
  #  host: null
  #  labels: {}
  # By default this chart will create an nginx ingress, however providing
  # additional annotations will disable this
  #  annotations: {}

# Deployment Strategy: This can be set to either "RollingUpdate" or "Recreate".  If not provided, the default value
# is "RollingUpdate".  "RollingUpdate" will perform a rolling update of the deployment similar to a blue/green
# deployment and thus requires additional resources as both old and new versions will be running silmultaneously
# for several minutes. Tonic will be available during this time, but behavior may be unpredictable depending on
# differences in the running an new versions. "Recreate" means that the current deployment will be deleted and a
# new one created.  This will result in Tonic being down during an update.
deployStrategy: RollingUpdate

containerization:
  # if self managing RBAC, to use containerization the tonic service account
  # will need a rolebinding that grants:
  # rules:
  #   - apiGroups: [""]
  #     resources: ["pods"]
  #     verbs: ["get", "list", "delete", "create", "watch", "deletecollection"]
  #   - apiGroups: [""]
  #     resources: ["secrets"]
  #     verbs: ["list", "delete", "create", "deletecollection"]
  rbac:
    create: true
  datapacker:
    imageRepo: quay.io/tonicai/datapacker
# Professional and Enterprise License Only: Below are the settings for Single Sign On. Not every provider requires every value. The Tonic support team will help you configure this.
# tonicSsoConfig:
#   groupFilter: <regex that matches groups to import into Tonic, like .*Tonic.*>

#   AWS SSO Config
#   -----------------
#   provider: AWS
#   identityProviderId: <identity-provider-id>
#   entityId: <entity-id>
#   # provided for existing chart installations, new installations should set
#   # metadataXml.url or metadataXml.base64 instead
#   samlIdpMetadataXml: <base64 encoded SAML metadata IDP xml>
#   metadataXml:
#     url: <url to metadata xml, given priority>
#     base64: <base64 encoded SAML metadata IDP xml>

#   Azure SSO Config
#   -----------------
#   provider: Azure
#   clientId: <client-id>
#   clientSecret: <client-secret>
#   tenantId: <tenant-id>

#   Duo SSO Config
#   -----------------
#   provider: Duo
#   clientId: <client-id>
#   clientSecret: <client-secret>
#   domain: <sso-domain>

#   Google SSO Config
#   -----------------
#   clientId: <client-id>
#   clientSecret: <client-secret>
#   provider: Google
#   domain: <sso-domain>
#   googleAccountServiceJson: <base64 encoded version of your service account json>

#   Okta SSO Config
#   -----------------
#   provider: Okta
#   authServerId: <customer auth server if you have one>
#   clientId: <client-id>
#   domain: <sso-domain>
#   identityProviderId: <identity-provider-id>

#   Keycloak SSO Config
#   -----------------
#   provider: Keycloak
#   clientId: <client-id>
#   domain: <url-of-keycloak>
#   realmId: <realm-id>

#   Generic Saml SSO Config
#   -----------------------
#   provider: SAML
#   metadataXml:
#     url: <url to metadataXml, given priority>
#     base64: <base64 encoded metadataXml>
#   entityId: <entity id used to send requests from tonic, if not provided, will be determined from metadata xml>

#   Generic OIDC SSO Config
#   -----------------
#   provider: OIDC
#   clientId: <client-id>
#   authority: <url-of-authority>
#   optionalConfig:
#     scopes: <space delimited scopes>
#     firstNameClaimName: <Name of first name claim if different than OIDC standard>
#     lastNameClaimName: <Name of last name claim if different than OIDC standard>
#     emailClaimName: <Name of email/username claim if different than OIDC standard>
#     groupsClaimName: <Name of groups claim>

# Professional and Enterprise License Only: Configuration options for tonic-notifications.
# tonicSmtpConfig:
#   tonicUrl: <tonic URL, for links>
#   sendingAddress: <notifications@yourdomain.com>
#   smtpServerAddress: <smtp host>
#   smtpServerPort: <smtp port>
#   smtpUsername: <smtp username>
#   smtpPassword: <smtp password>


# Role used by Tonic to connect to AWS Lambda. This is needed for Snowflake and Redshift integrations.
# awsLambdaRoleArn: arn:aws:iam::<accountId>:role/<role-name>

# Your license should be configured by an admin within the Tonic UI. It can optionally be set here if there is no admin.
# tonicLicense: <license-key>