Helm Values Reference

Complete reference for all configurable values in the byjg/easyhaproxy Helm chart.

Image Configuration

Value	Description	Default
image.repository	Container image repository	byjg/easy-haproxy
image.tag	Image tag. Defaults to the chart appVersion.	""
image.pullPolicy	Image pull policy	Always
imagePullSecrets	List of image pull secret names	[]
nameOverride	Override the chart name	""
fullnameOverride	Override the full release name	""

Deployment Mode

Controls whether EasyHAProxy runs as a Deployment (with a Service) or a DaemonSet (binding to host ports).

Value	Description	Default
replicaCount	Number of replicas (only used when service.create: true; a DaemonSet runs one pod per labeled node)	1
service.create	true → Deployment + Service (NodePort, ClusterIP or LoadBalancer). false → DaemonSet with host ports.	false
service.type	Service type when service.create: true: NodePort, ClusterIP or LoadBalancer	ClusterIP
service.annotations	Annotations to add to the Service resource	{}

Recommended mode

Set service.create: true and service.type: NodePort for most setups. DaemonSet mode (service.create: false) requires maintaining a node label across node replacements, which can cause outages if forgotten.

Port Binding

Value	Description	Default
binding.ports.http	HTTP host port (DaemonSet mode)	80
binding.ports.https	HTTPS host port (DaemonSet mode)	443
binding.ports.stats	HAProxy stats host port (DaemonSet mode)	1936
binding.ports.dashboard	Monitoring dashboard host port (always stats + 10000 inside the pod)	11936
binding.nodePorts.http	HTTP node port (service.type: NodePort)	31080
binding.nodePorts.https	HTTPS node port (service.type: NodePort)	31443
binding.nodePorts.stats	HAProxy stats node port (service.type: NodePort)	31936
binding.nodePorts.dashboard	Monitoring dashboard node port (service.type: NodePort)	31937
binding.additionalPorts	List of additional ports to expose	[]

Node ports

Kubernetes only accepts node ports in its node port range (30000-32767 by default). Before chart 2.0.7 the NodePort Service used binding.ports.*, so the defaults (80, 443, …) were rejected. If you set binding.ports.* to make NodePort work, move those values to binding.nodePorts.*.

EasyHAProxy Settings

Value	Description	Default
easyhaproxy.stats.username	HAProxy stats username	admin
easyhaproxy.stats.enabled	Serve the stats endpoint and dashboard. false also removes ports 1936/11936 from the pod and Service.	true
easyhaproxy.stats.password	Login password for the stats endpoint and dashboard. Empty serves them without a login.	password
easyhaproxy.stats.corsOrigin	Allowed origin for stats API CORS (e.g. http://node01:11936). Required for the dashboard to load in a browser.	""
easyhaproxy.refresh	Seconds between service discovery polls	"10"
easyhaproxy.customErrors	Enable custom HTML error pages	"true"
easyhaproxy.sslMode	TLS mode: strict, default, or loose	loose
easyhaproxy.logLevel.certbot	Log level for Certbot	DEBUG
easyhaproxy.logLevel.easyhaproxy	Log level for EasyHAProxy	DEBUG
easyhaproxy.logLevel.haproxy	Log level for HAProxy	DEBUG
easyhaproxy.certbot.email	Email address for Let's Encrypt / ACME registration	""

Certificate Persistence

Keeps the ACME/Certbot certificates (/etc/easyhaproxy/certs/certbot) on a PersistentVolumeClaim, so a pod restart does not request them again and run into the CA rate limits. Recommended whenever easyhaproxy.certbot.email is set.

Value	Description	Default
persistence.certbot.enabled	Mount a PVC at /etc/easyhaproxy/certs/certbot	false
persistence.certbot.existingClaim	Use this existing PVC instead of creating one	""
persistence.certbot.storageClass	Storage class of the created PVC. Empty = default.	""
persistence.certbot.accessMode	Access mode of the created PVC	ReadWriteOnce
persistence.certbot.size	Size of the created PVC	1Gi

note

With service.create: true and persistence enabled, the Deployment uses the Recreate strategy: a ReadWriteOnce volume cannot attach to the new pod while the old one still holds it. Expect a short gap during upgrades.

The created PVC has helm.sh/resource-policy: keep, so helm uninstall leaves the certificates in place. Delete the PVC by hand to remove them.

Ingress Status

Controls how EasyHAProxy updates Kubernetes Ingress resources with load-balancer IPs.

Value	Description	Default
ingressStatus.enabled	Update Ingress resources with load-balancer IPs	true
ingressStatus.deploymentMode	How to detect/report IPs: auto, daemonset, nodeport, or clusterip. auto is recommended.	auto
ingressStatus.externalHostname	Hostname to report in Ingress status (for ClusterIP mode without a LoadBalancer)	""
ingressStatus.updateInterval	Seconds between Ingress status updates	30

DaemonSet Node Selection

Only applies when service.create: false

These values are ignored when running as a Deployment (service.create: true).

Value	Description	Default
masterNode.label	Node label key used for nodeAffinity	easyhaproxy/node
masterNode.values	Accepted values for the node label	["master"]

Label the target node before installing:

kubectl label nodes node-01 "easyhaproxy/node=master"

Label exactly one node

replicaCount does not apply to a DaemonSet: it runs one EasyHAProxy pod on every node with the label. Two labeled nodes mean two copies, with the problems described in Limitations, in particular failing ACME certificates.

Standard Kubernetes Fields

Value	Description	Default
podAnnotations	Annotations added to the EasyHAProxy pod	{}
resources	CPU/memory requests and limits for the pod	{}
nodeSelector	Node selector for pod scheduling	{}
tolerations	Tolerations for pod scheduling	[]
affinity	Affinity rules for pod scheduling. In DaemonSet mode nodeAffinity comes from masterNode; other keys (e.g. podAntiAffinity) are kept.	{}
podSecurityContext	Pod-level security context	{}
securityContext	Container-level security context	{}

Service Account

Value	Description	Default
serviceAccount.create	Create a dedicated ServiceAccount	true
serviceAccount.annotations	Annotations to add to the ServiceAccount	{}
serviceAccount.name	Name of the ServiceAccount. Auto-generated if empty.	""

Ingress Class

Value	Description	Default
ingressClass.create	Create an IngressClass resource named easyhaproxy	true
ingressClass.annotations	Annotations to add to the IngressClass	{}

---

Open source ByJG