Skip to content

mimir values.yaml📜

networkPolicies.enabled📜

Type: bool

Default value
true

Description: Toggle networkPolicies

networkPolicies.egress.from.mimir.to.definition.kubeAPI📜

Type: bool

Default value
true

networkPolicies.egress.from.rollout-operator.to.definition.kubeAPI📜

Type: bool

Default value
true

istio.enabled📜

Type: bool

Default value
false

istio.sidecar.enabled📜

Type: bool

Default value
false

istio.sidecar.outboundTrafficPolicyMode📜

Type: string

Default value
"REGISTRY_ONLY"

istio.serviceEntries.custom📜

Type: list

Default value
[]

istio.authorizationPolicies.enabled📜

Type: bool

Default value
false

istio.authorizationPolicies.custom[0].name📜

Type: string

Default value
"mimir-allow-kube-apiserver-rollout-operator-authz-policy"

istio.authorizationPolicies.custom[0].enabled📜

Type: bool

Default value
true

istio.authorizationPolicies.custom[0].spec.selector.matchLabels.”app.kubernetes.io/name”📜

Type: string

Default value
"rollout-operator"

istio.authorizationPolicies.custom[0].spec.action📜

Type: string

Default value
"ALLOW"

istio.authorizationPolicies.custom[0].spec.rules[0].to[0].operation.ports[0]📜

Type: string

Default value
"8443"

istio.mtls.mode📜

Type: string

Default value
"STRICT"

domain📜

Type: string

Default value
"dev.bigbang.mil"

Description: Domain for VirtualService hosts (overridden by Big Bang)

routes📜

Type: object

Default value
inbound:
  mimir-gateway:
    enabled: false
    gateways:
    - istio-gateway/public-ingressgateway
    hosts:
    - mimir.{{ .Values.domain }}
    port: 8080
    selector:
      app.kubernetes.io/component: gateway
      app.kubernetes.io/name: mimir
    service: '{{ .Release.Name }}-gateway.{{ .Release.Namespace }}.svc.cluster.local'

Description: Routes configuration for Istio VirtualService Enables external access to Mimir via Istio ingress gateway

upgradeJob.enabled📜

Type: bool

Default value
true

Description: Enable BigBang specific autoRollingUpgrade support

upgradeJob.name📜

Type: string

Default value
"mimir-upgrade-job"

upgradeJob.image.repository📜

Type: string

Default value
"registry1.dso.mil/ironbank/big-bang/base"

Description: image repository for upgradeJob

upgradeJob.image.tag📜

Type: string

Default value
"2.1.0"

Description: image tag for upgradeJob

upgradeJob.image.imagePullPolicy📜

Type: string

Default value
"IfNotPresent"

upgradeJob.image.pullSecrets📜

Type: string

Default value
"private-registry"

upgradeJob.serviceAccount📜

Type: string

Default value
"upgrade-job-svc-account"

upgradeJob.role📜

Type: string

Default value
"upgrade-role"

upgradeJob.roleBinding📜

Type: string

Default value
"upgrade-rolebinding"

bbtests.enabled📜

Type: bool

Default value
false

bbtests.cypress.enabled📜

Type: bool

Default value
true

bbtests.cypress.artifacts📜

Type: bool

Default value
true

bbtests.cypress.envs.cypress_grafana_url📜

Type: string

Default value
"http://monitoring-grafana.monitoring.svc.cluster.local"

bbtests.scripts.image📜

Type: string

Default value
"registry1.dso.mil/ironbank/big-bang/base:2.1.0"

bbtests.scripts.envs.MIMIR_URL📜

Type: string

Default value
"http://mimir-mimir-distributor.mimir.svc:8080"

upstream.rollout_operator📜

Type: object

Default value
enabled: true
image:
  repository: registry1.dso.mil/ironbank/opensource/grafana/rollout-operator
  tag: v0.36.1
imagePullSecrets:
- name: private-registry

Description: rollout-operator is enabled by default as it is the required safety controller for zone-aware replication (zone-a/b/c ingesters and store-gateways). It installs namespace-scoped admission webhooks (no-downscale, prepare-downscale, pod-eviction) that intercept ALL StatefulSet UPDATE operations in the release namespace with failurePolicy: Fail. WARNING: If MinIO is deployed in the same namespace as Mimir, these webhooks will intercept MinIO Operator reconciliation calls and block Tenant CR updates (e.g. scaling, config changes). The minio-tenant.bucketInit job mitigates initial bucket creation, but subsequent Tenant spec changes may silently fail. The recommended configuration is to deploy Mimir and MinIO in separate namespaces. See docs/overview.md for full details on this limitation.