Each value has a sane default tuned for an optimal getting started experience
with Consul. Before going into production, please review the parameters below
and consider if they're appropriate for your deployment.
- `global` ((#v-global)) - Holds values that affect multiple components of the chart.
- `enabled` ((#v-global-enabled)) (`boolean: true`) - The master enabled/disabled setting. If true, servers,
clients, Consul DNS and the Consul UI will be enabled. Each component can override
this default via its component-specific "enabled" config. If false, no components
will be installed by default and per-component opt-in is required, such as by
setting [`server.enabled`](#v-server-enabled) to true.
- `name` ((#v-global-name)) (`string: null`) - Set the prefix used for all resources in the Helm chart. If not set, the prefix will be `<helm release name>-consul`.
- `domain` ((#v-global-domain)) (`string: "consul"`) - The domain Consul will answer DNS queries for (see
[-domain](/docs/agent/options.html#_domain)) and the domain services synced from
Consul into Kubernetes will have, e.g. `service-name.service.consul`.
- `image` ((#v-global-image)) (`string: "consul:<latest version>"`) - The name (and tag) of the Consul Docker image for clients and servers. This can be overridden per component. This should be pinned to a specific version tag, otherwise you may inadvertently upgrade your Consul version.
Examples:
```yaml
# Consul 1.5.0
image: "consul:1.5.0"
# Consul Enterprise 1.5.0
image: "hashicorp/consul-enterprise:1.5.0-ent"
```
- `imageK8S` ((#v-global-imagek8s)) (`string: "hashicorp/consul-k8s:<latest version>"`) - The name (and tag) of the [consul-k8s](https://github.com/hashicorp/consul-k8s) Docker image that is used for functionality such the catalog sync. This can be overridden per component.
Note: support for the catalog sync's liveness and readiness probes was added to consul-k8s 0.6.0. If using an older consul-k8s version, you may need to remove these checks to make sync work. If using mesh gateways and bootstrapACLs then must be >= 0.9.0.
- `datacenter` ((#v-global-datacenter)) (`string: "dc1"`) - The name of the datacenter that the agents should
register as. This can't be changed once the Consul cluster is up and running since Consul
doesn't support an automatic way to change this value currently: [https://github.com/hashicorp/consul/issues/1858](https://github.com/hashicorp/consul/issues/1858).
- `enablePodSecurityPolicies` ((#v-global-enablepodsecuritypolicies)) (`boolean: false`) - Controls whether pod
security policies are created for the Consul components created by this chart. See [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
- `gossipEncryption` ((#v-global-gossipencryption)) - Configures which Kubernetes secret to retrieve Consul's
gossip encryption key from (see [-encrypt](/docs/agent/options.html#_encrypt)). If secretName or
secretKey are not set, gossip encryption will not be enabled. The secret must
be in the same namespace that Consul is installed into.
`enableConsulNamespaces` indicates that you are running Consul Enterprise v1.7+ with a valid Consul
Enterprise license and would like to make use of configuration beyond registering everything into
the `default` Consul namespace. Requires consul-k8s v0.12+. Additional configuration
options are found in the `consulNamespaces` section of both the catalog sync
and connect injector.
- `bootstrapACLs` ((#v-global-bootstrapacls)) (`boolean: false`) - **[DEPRECATED]** Use `global.acls.manageSystemACLs` instead.
- `acls` ((#v-global-acls)) - Configure ACLs.
- `manageSystemACLs` ((#v-global-acls-managesystemacls)) (`boolean: false`) - If true, the Helm chart will automatically manage ACL tokens and policies for all Consul and consul-k8s components. This requires servers to be running inside Kubernetes. Additionally requires Consul >= 1.4 and consul-k8s >= 0.10.1.
- `tls` ((#v-global-tls)) - Enables TLS [encryption](https://learn.hashicorp.com/consul/security-networking/agent-encryption) across the cluster to verify authenticity of the Consul servers and clients. Requires Consul v1.4.1+ and consul-k8s v0.16.2+
- `enabled` ((#v-global-enabled)) (`boolean: false`) - If true, the Helm chart will enable TLS for Consul
servers and clients and all consul-k8s components, as well as generate certificate
authority (optional) and server and client certificates.
- `serverAdditionalDNSSANs` ((#v-global-serveradditionaldnsssans)) (`array<string>: []`) - A list of additional DNS names to set as Subject Alternative Names (SANs) in the server certificate. This is useful when you need to access the Consul server(s) externally, for example, if you're using the UI.
- `serverAdditionalIPSANs` ((#v-global-serveradditionalipsans)) (`array<string>: []`) - A list of additional IP addresses to set as Subject Alternative Names (SANs) in the server certificate. This is useful when you need to access the Consul server(s) externally, for example, if you're using the UI.
- `verify` ((#v-global-verify)) (`boolean: true`) - If true, `verify_outgoing`, `verify_server_hostname`,
and `verify_incoming_rpc` will be set to `true` for Consul servers and clients.
Set this to false to incrementally roll out TLS on an existing Consul cluster.
Please see [Configuring TLS on an Existing Cluster](https://www.consul.io/docs/platform/k8s/tls-on-existing-cluster.html)
for more details.
- `httpsOnly` ((#v-global-httpsonly)) (`boolean: true`) - If true, the Helm chart will configure Consul
to disable the HTTP port on both clients and servers and to only accept HTTPS connections.
- `caCert` ((#v-global-cacert)) - A Kubernetes secret containing the certificate of the CA to use for
TLS communication within the Consul cluster. If you have generated the CA yourself
with the consul CLI, you could use the following command to create the secret
in Kubernetes:
```bash
kubectl create secret generic consul-ca-cert \
--from-file='tls.crt=./consul-agent-ca.pem'
```
- `secretName` ((#v-global-cacert-secretname)) (`string: null`) - The name of the Kubernetes secret.
- `secretKey` ((#v-global-cacert-secretkey)) (`string: null`) - The key of the Kubernetes secret.
- `caKey` ((#v-global-cakey)) - A Kubernetes secret containing the private key of the CA to use for
TLS communication within the Consul cluster. If you have generated the CA yourself
with the consul CLI, you could use the following command to create the secret
in Kubernetes:
```bash
kubectl create secret generic consul-ca-key \
--from-file='tls.key=./consul-agent-ca-key.pem'
```
- <a
name="v-global-tls-cakey-secretname"
href="#v-global-cakey-secretname"
>
`secretName`
</a> (`string: null`) - The name of the Kubernetes secret.
</a> (`string`) - This value references an existing Kubernetes [priorityClassName](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#pod-priority)
</a> (`string: global.image`) - The name of the Docker image (including any tag)
for the containers running Consul client agents.
- `join` ((#v-client-join)) (`array<string>: null`) - A list of valid [`-retry-join` values](/docs/agent/options.html#retry-join). If this is `null` (default), then the clients will attempt to automatically join the server cluster running within Kubernetes. This means that with `server.enabled` set to true, clients will automatically join that cluster. If `server.enabled` is not true, then a value must be specified so the clients can join a valid cluster.
</a> (`string: ""`) - This value references an existing Kubernetes [priorityClassName](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#pod-priority)
</a> (`string: null`) - This value defines the [Pod DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy)
</a> (`string: ""`) - A prefix to prepend to all services registered in Kubernetes
from Consul. This defaults to `""` where no prefix is prepended; Consul services
are synced with the same name to Kubernetes. (Consul -> Kubernetes sync only)
- <a
name="v-synccatalog-k8sallownamespaces"
href="#v-synccatalog-k8sallownamespaces"
>
`k8sAllowNamespaces`
</a> (`[]string: ["*"]`) - list of k8s namespaces to sync the k8s services from.
If a k8s namespace is not included in this list or is listed in `k8sDenyNamespaces`,
services in that k8s namespace will not be synced even if they are explicitly
annotated. Use `["*"]` to automatically allow all k8s namespaces. For example,
`["namespace1", "namespace2"]` will only allow services in the k8s namespaces
`namespace1` and `namespace2` to be synced and registered with Consul. All other
k8s namespaces will be ignored. Note: `k8sDenyNamespaces` takes precedence over
values defined here. Requires consul-k8s v0.12+
- <a
name="v-synccatalog-k8sdenynamespaces"
href="#v-synccatalog-k8sdenynamespaces"
>
`k8sDenyNamespaces`
</a> (`[]string: ["kube-system", "kube-public"]` - list of k8s namespaces that
should not have their services synced. This list takes precedence over `k8sAllowNamespaces`.
`*` is not supported because then nothing would be allowed to sync. Requires
consul-k8s v0.12+.
For example, if `k8sAllowNamespaces` is `["*"]` and `k8sDenyNamespaces` is `["namespace1", "namespace2"]`, then all k8s namespaces besides `namespace1` and `namespace2` will be synced.
- <a
name="v-synccatalog-k8ssourcenamespace"
href="#v-synccatalog-k8ssourcenamespace"
>
`k8sSourceNamespace`
</a> (`string: ""`) - **[DEPRECATED] Use `k8sAllowNamespaces` and `k8sDenyNamespaces`
instead.** `k8sSourceNamespace` is the Kubernetes namespace to watch for service
changes and sync to Consul. If this is not set then it will default to all namespaces.
- <a
name="v-synccatalog-consulnamespaces"
href="#v-synccatalog-consulnamespaces"
>
`consulNamespaces`
</a> - [Enterprise Only] These settings manage the catalog sync's interaction
with Consul namespaces (requires consul-ent v1.7+ and consul-k8s v0.12+). Also,
</a> (`boolean: false`) - If true, the injector will inject the Connect sidecar
into all pods by default. Otherwise, pods must specify the. [injection annotation](/docs/platform/k8s/connect.html#consul-hashicorp-com-connect-inject)
to opt-in to Connect injection. If this is true, pods can use the same annotation
to ensure the version you are using is compatible with Consul.
- <a
name="v-connectinject-namespaceselector"
href="#v-connectinject-namespaceselector"
>
`namespaceSelector`
</a> (`string: ""`) - A [selector](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
for restricting injection to only matching namespaces. By default all namespaces
except `kube-system` and `kube-public` will have injection enabled.
```yaml
namespaceSelector: |
matchLabels:
namespace-label: label-value
```
- <a
name="v-connectinject-k8sallownamespaces"
href="#v-connectinject-k8sallownamespaces"
>
`k8sAllowNamespaces`
</a> - list of k8s namespaces to allow Connect sidecar injection in. If a k8s
namespace is not included or is listed in `k8sDenyNamespaces`, pods in that k8s
namespace will not be injected even if they are explicitly annotated. Use `["*"]`
to automatically allow all k8s namespaces.
For example, `["namespace1", "namespace2"]` will only allow pods in the k8s namespaces `namespace1` and `namespace2` to have Connect sidecars injected and registered with Consul. All other k8s namespaces will be ignored.
Note: `k8sDenyNamespaces` takes precedence over values defined here and `namespaceSelector` takes precedence over both since it is applied first. `kube-system` and `kube-public` are never injected, even if included here. Requires consul-k8s v0.12+
- <a
name="v-connectinject-k8sdenynamespaces"
href="#v-connectinject-k8sdenynamespaces"
>
`k8sDenyNamespaces`
</a> - list of k8s namespaces that should not allow Connect sidecar injection.
This list takes precedence over `k8sAllowNamespaces`. `*` is not supported because
then nothing would be allowed to be injected.
For example, if `k8sAllowNamespaces` is `["*"]` and `k8sDenyNamespaces` is `["namespace1", "namespace2"]`, then all k8s namespaces besides `namespace1` and `namespace2` will be injected.
Note: `namespaceSelector` takes precedence over this since it is applied first. `kube-system` and `kube-public` are never injected. Requires consul-k8s v0.12+.
- <a
name="v-connectinject-consulnamespaces"
href="#v-connectinject-consulnamespaces"
>
`consulNamespaces`
</a> - [Enterprise Only] These settings manage the connect injector's interaction
with Consul namespaces (requires consul-ent v1.7+ and consul-k8s v0.12+). Also,
