feat: add aralez helm chart

Add basic Aralez deployment configuration, Helm chart linting workflow,
and Dependabot configuration.

.github/ct.yml

@@ -0,0 +1,9 @@
+helm-extra-args: --timeout 300s
+check-version-increment: true
+debug: true
+chart-dirs:
+  - charts
+validate-maintainers: true
+namespace: default
+release-label: test
+target-branch: main

.github/dependabot.yml

@@ -0,0 +1,23 @@
+---
+# See https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    commit-message:
+      prefix: "chore:"
+    open-pull-requests-limit: 8
+    rebase-strategy: disabled
+    schedule:
+      interval: "monthly"
+      day: "monday"
+      time: "10:00"
+      timezone: "UTC"
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "actions/*"
+          - "helm/*"

.github/workflows/charts.yaml

@@ -0,0 +1,28 @@
+name: Helm chart check
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "charts/**"
+
+jobs:
+  helm-lint:
+    name: Helm chart check
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install chart-testing tools
+        id: lint
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
+
+      - name: Run helm chart linter
+        run: ct --config .github/ct.yml lint
+      - name: Run helm template
+        run: helm lint charts/aralez

charts/aralez/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/aralez/Chart.yaml

@@ -0,0 +1,18 @@
+# yaml-language-server: $schema=https://json.schemastore.org/chart.json
+apiVersion: v2
+name: aralez
+description: Ingress controller for Kubernetes
+type: application
+home: https://github.com/sadoyan/aralez/charts
+sources:
+  - https://github.com/sadoyan/helm-charts/tree/main/charts/aralez
+keywords:
+  - ingress-controller
+  - aralez
+maintainers: []
+#
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.0.1
+#
+# renovate: datasource=docker depName=ghcr.io/sadoyan/aralez
+appVersion: 0.93.3

charts/aralez/README.md.gotmpl

@@ -0,0 +1,17 @@
+{{ template "chart.header" . }}
+
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+
+{{ template "chart.description" . }}
+
+{{ template "chart.homepageLine" . }}
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}

charts/aralez/ci/values.yaml

@@ -0,0 +1,18 @@
+ingressClass: aralez
+ingressClassResource:
+  enabled: true
+
+# hostNetwork: true
+# hostPort:
+#   ports:
+#     http: 8080
+#     https: 8443
+
+priorityClassName: system-cluster-critical
+
+env: []
+
+args: []
+
+useDaemonSet: true
+terminationGracePeriodSeconds: 120

charts/aralez/templates/_helpers.tpl

@@ -0,0 +1,104 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "aralez.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "aralez.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "aralez.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "aralez.labels" -}}
+helm.sh/chart: {{ include "aralez.chart" . }}
+{{ include "aralez.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.podLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "aralez.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "aralez.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Return a podAffinity/podAntiAffinity definition
+*/}}
+{{- define "affinities.pods" -}}
+  {{- if eq .Values.podAntiAffinityPreset "soft" }}
+    {{- include "affinities.pods.soft" . -}}
+  {{- else if eq .Values.podAntiAffinityPreset "hard" }}
+    {{- include "affinities.pods.hard" . -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Return a soft podAntiAffinity definition
+*/}}
+{{- define "affinities.pods.soft" -}}
+podAntiAffinity:
+  preferredDuringSchedulingIgnoredDuringExecution:
+    - podAffinityTerm:
+        labelSelector:
+          matchLabels: {{- (include "aralez.selectorLabels" .) | nindent 12 }}
+        namespaces:
+          - {{ .Release.Namespace | quote }}
+        topologyKey: kubernetes.io/hostname
+      weight: 1
+{{- end -}}
+
+{{/*
+Return a hard podAntiAffinity definition
+*/}}
+{{- define "affinities.pods.hard" -}}
+podAntiAffinity:
+  requiredDuringSchedulingIgnoredDuringExecution:
+    - labelSelector:
+        matchLabels: {{- (include "aralez.selectorLabels" .) | nindent 10 }}
+      namespaces:
+        - {{ .Release.Namespace | quote }}
+      topologyKey: kubernetes.io/hostname
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "aralez.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "aralez.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/aralez/templates/certs.yaml

@@ -0,0 +1,21 @@
+{{- $ca := genCA .Chart.Name 3650 }}
+{{- $server := genSignedCert "server" (list "127.0.0.1") nil 3650 $ca }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "aralez.fullname" . }}-tls
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+type: kubernetes.io/tls
+data:
+{{- $secretName := printf "%s-tls" (include "aralez.fullname" .) }}
+{{- $secretData := (lookup "v1" "Secret" .Release.Namespace $secretName).data }}
+{{- if and $secretData (hasKey $secretData "ca.crt") }}
+  ca.crt: {{ get $secretData "ca.crt" }}
+  tls.crt: {{ get $secretData "tls.crt" }}
+  tls.key: {{ get $secretData "tls.key" }}
+{{- else }}
+  ca.crt: {{ $ca.Cert | b64enc }}
+  tls.crt: {{ $server.Cert | b64enc }}
+  tls.key: {{ $server.Key | b64enc }}
+{{- end }}

charts/aralez/templates/configmap.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "aralez.fullname" . }}
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+data:
+  aralez.yaml: |
+    daemon: false
+    upstreams_conf: /etc/aralez/upstreams.yaml
+    proxy_configs: /etc/aralez-proxy
+    proxy_address_http: "0.0.0.0:{{ .Values.hostPort.ports.http }}"
+    proxy_address_tls: "0.0.0.0:{{ .Values.hostPort.ports.https }}"
+    config_api_enabled: false
+    config_address: "0.0.0.0:3000"
+    upgrade_sock: /tmp/aralez.sock
+    pid_file: /tmp/aralez.pid
+    log_level: debug
+    hc_method: HEAD
+    hc_interval: 5
+
+  upstreams.yaml: |
+    provider: "kubernetes"
+    sticky_sessions: 172000
+    kubernetes: {}
+  {{- with .Values.upstreams }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}

charts/aralez/templates/deployment.yaml

@@ -0,0 +1,130 @@
+apiVersion: apps/v1
+{{- if .Values.useDaemonSet }}
+kind: DaemonSet
+{{- else }}
+kind: Deployment
+{{- end }}
+metadata:
+  name: {{ include "aralez.fullname" . }}
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+spec:
+  {{- if not (or .Values.autoscaling.enabled .Values.useDaemonSet) }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  {{- if not .Values.useDaemonSet }}
+  strategy:
+    type: {{ .Values.updateStrategy.type }}
+  {{- else }}
+  updateStrategy:
+    type: {{ .Values.updateStrategy.type }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "aralez.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "aralez.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      annotations:
+      {{- if .Values.upstreams }}
+        checksum/upstreams: {{ toJson .Values.upstreams | sha256sum }}
+      {{- end }}
+    spec:
+      enableServiceLinks: false
+      {{- if and .Values.hostNetwork .Values.useDaemonSet }}
+      hostNetwork: {{ .Values.hostNetwork }}
+      dnsPolicy: "ClusterFirstWithHostNet"
+      {{- end }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "aralez.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- if .Values.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["aralez"]
+          args:
+            - --conf=/etc/aralez/aralez.yaml
+            {{- range $value := .Values.args }}
+            - {{ $value }}
+            {{- end }}
+          env:
+          {{- with .Values.env }}
+            {{- . | toYaml | nindent 12 }}
+          {{- end }}
+          ports:
+            {{- if .Values.hostPort.ports.http }}
+            - name: http
+              containerPort: {{ .Values.hostPort.ports.http }}
+              protocol: TCP
+            {{- end }}
+            {{- if .Values.hostPort.ports.https }}
+            - name: https
+              containerPort: {{ .Values.hostPort.ports.https }}
+              protocol: TCP
+            {{- end }}
+          # readinessProbe:
+          #   httpGet:
+          #     path: /status
+          #     port: 3000
+          #   initialDelaySeconds: 30
+          #   timeoutSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/aralez
+            - name: tlscerts
+              mountPath: /etc/aralez-proxy/certificates
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: config
+          configMap:
+            name: {{ include "aralez.fullname" . }}
+        - name: tlscerts
+          secret:
+            secretName: {{ include "aralez.fullname" . }}-tls
+            defaultMode: 256
+            items:
+              - key: tls.crt
+                path: tls.crt
+              - key: tls.key
+                path: tls.key
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      affinity:
+        {{- include "affinities.pods" . | nindent 8 }}
+      {{- with .Values.affinity }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/aralez/templates/hpa.yaml

@@ -0,0 +1,24 @@
+{{- if and .Values.autoscaling.enabled (not .Values.useDaemonSet) }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "aralez.fullname" . }}
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "aralez.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+{{- end }}

charts/aralez/templates/ingressclass.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.ingressClassResource.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+  name: {{ .Values.ingressClass }}
+spec:
+  controller: {{ .Values.ingressClassResource.controllerValue }}
+{{- end }}

charts/aralez/templates/service.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "aralez.fullname" . }}
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if eq .Values.service.type "NodePort" }}
+  externalTrafficPolicy: Local
+  {{- end }}
+  {{- with .Values.service.ipFamilies }}
+  ipFamilies:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  ipFamilyPolicy: {{ if eq (len .Values.service.ipFamilies) 2 }}PreferDualStack{{ else }}SingleStack{{ end }}
+  ports:
+    {{- if .Values.hostPort.ports.http }}
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+      {{- if .Values.hostPort.enabled }}
+      nodePort: {{ .Values.hostPort.ports.http }}
+      {{- end }}
+    {{- end }}
+    {{- if .Values.hostPort.ports.https }}
+    - port: 443
+      targetPort: https
+      protocol: TCP
+      name: https
+      {{- if .Values.hostPort.enabled }}
+      nodePort: {{ .Values.hostPort.ports.https }}
+      {{- end }}
+    {{- end }}
+  selector:
+    {{- include "aralez.selectorLabels" . | nindent 4 }}

charts/aralez/templates/serviceaccount.yaml

@@ -0,0 +1,52 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "aralez.serviceAccountName" . }}
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: true
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "aralez.fullname" . }}
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["networking.k8s.io"]
+  resources: ["ingresses", "ingressclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["networking.k8s.io"]
+  resources: ["ingresses/status"]
+  verbs: ["get", "update", "patch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["nodes", "services", "endpoints"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["discovery.k8s.io"]
+  resources: ["endpointslices"]
+  verbs: ["get", "list", "watch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "aralez.fullname" . }}
+  labels:
+    {{- include "aralez.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "aralez.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "aralez.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}

charts/aralez/values.yaml

@@ -0,0 +1,164 @@
+# Default values for aralez.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  repository: ghcr.io/sadoyan/aralez
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+# -- Environment variables
+env: []
+
+# -- Aralez arguments
+args: []
+
+# -- Aralez upstreams file body
+# refs: https://aralez.rs/docs/kubernetes/
+upstreams:
+  rate_limit: 500000
+  x4xx_limit: 100000
+  to_https: true
+  server_headers:
+    - "X-Forwarded-Proto:https"
+    - "X-Forwarded-Port:443"
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+# -- Annotations for pod.
+# ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+podAnnotations: {}
+  # cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
+
+# -- Extra labels for pod.
+# ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+podLabels: {}
+
+# -- Pod Security Context.
+# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 9999
+  runAsGroup: 9999
+  fsGroup: 9999
+  fsGroupChangePolicy: "OnRootMismatch"
+
+# -- Container Security Context.
+# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+securityContext:
+  seccompProfile:
+    type: RuntimeDefault
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+# -- Pod host network
+# Use it only for performance reason
+hostNetwork: false
+
+# -- Service node port
+# refs: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
+hostPort:
+  enabled: false
+  ports:
+    http: 8080
+    https: 8443
+
+ingressClass: aralez
+ingressClassResource:
+  enabled: true
+  controllerValue: aralez.proxy/ingress-controller
+
+# -- Bitwarden service parameters
+# ref: https://kubernetes.io/docs/user-guide/services/
+service:
+  # -- service type
+  type: ClusterIP
+
+  annotations: {}
+
+  # -- IP families for service
+  # possible values: IPv4, IPv6
+  # ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
+  ipFamilies: [IPv4]
+
+# -- Resource requests and limits.
+# ref: https://kubernetes.io/docs/user-guide/compute-resources/
+resources:
+  limits:
+    cpu: 1
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+# -- Horizontal and Vertical pod autoscaler.
+# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
+autoscaling:
+  enabled: false
+
+  minReplicas: 1
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 80
+
+# -- Use a daemonset instead of a deployment
+useDaemonSet: false
+
+# -- The time in seconds that is allowed for a Aralez instance to gracefully shutdown
+# ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks
+terminationGracePeriodSeconds: 120
+
+## updateStrategy for PostgreSQL StatefulSet and its slaves StatefulSets
+## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+
+# -- Priority Class Name
+# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+priorityClassName: ""
+
+# Additional volumes on the output Deployment definition.
+volumes: []
+# - name: foo
+#   secret:
+#     secretName: mysecret
+#     optional: false
+
+# Additional volumeMounts on the output Deployment definition.
+volumeMounts: []
+# - name: foo
+#   mountPath: "/etc/foo"
+#   readOnly: true
+
+# -- Node labels for pod assignment.
+# ref: https://kubernetes.io/docs/user-guide/node-selection/
+nodeSelector: {}
+
+# -- Tolerations for pod assignment.
+# ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+tolerations: []
+
+# -- Pod Anti Affinity
+# soft/hard
+podAntiAffinityPreset: soft
+
+# -- Affinity for pod assignment.
+# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+affinity: {}