added repo

helm-templates/deepfence-console/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm-templates/deepfence-console/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+appVersion: 2.0.1
+description: A Helm chart for Kubernetes
+name: deepfence-console
+type: application
+version: 2.0.2

helm-templates/deepfence-console/templates/NOTES.txt

@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.host }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.router.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "deepfence-console.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.router.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "deepfence-console.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "deepfence-console.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.router.service.httpsPort }}
+{{- else if contains "ClusterIP" .Values.router.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "deepfence-console.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

helm-templates/deepfence-console/templates/_helpers.tpl

@@ -0,0 +1,81 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "deepfence-console.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "deepfence-console.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "deepfence-console.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "deepfence-console.labels" -}}
+helm.sh/chart: {{ include "deepfence-console.chart" . }}
+{{ include "deepfence-console.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "deepfence-console.selectorLabels" -}}
+app: deepfence-console
+app.kubernetes.io/name: {{ include "deepfence-console.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "deepfence-console.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "deepfence-console.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the imagePullSecret to use
+*/}}
+{{- define "deepfence-console.imagePullSecretName" -}}
+{{- if .Values.imagePullSecret.create }}
+{{- default (include "deepfence-console.fullname" .) .Values.imagePullSecret.name }}
+{{- else }}
+{{- .Values.imagePullSecret.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create secret to access docker registry
+*/}}
+{{- define "imagePullSecret" }}
+{{- printf "{\"auths\": {\"%s\": {\"auth\": \"%s\"}}}" .Values.imagePullSecret.registry (printf "%s:%s" .Values.imagePullSecret.username .Values.imagePullSecret.password | b64enc) | b64enc }}
+{{- end }}

helm-templates/deepfence-console/templates/database/fileserver/fileserver.yaml

@@ -0,0 +1,113 @@
+{{- if .Values.fileserver.create }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-file-server
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-file-server
+spec:
+  serviceName: {{ include "deepfence-console.fullname" . }}-file-server
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-file-server
+  template:
+    metadata:
+      {{- with .Values.fileserver.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-file-server
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.fileserver.podSecurityContext | nindent 8 }}
+      containers:
+        - name: fileserver
+          securityContext:
+            {{- toYaml .Values.fileserver.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.fileserver.image.repository }}:{{ default .Values.global.imageTag .Values.fileserver.image.tag }}"
+          imagePullPolicy: {{ .Values.fileserver.image.pullPolicy }}
+          envFrom:
+            - secretRef:
+                name: {{ include "deepfence-console.fullname" . }}-file-server-secret
+          ports:
+            - name: http
+              containerPort: 9000
+              protocol: TCP
+            - name: ui
+              containerPort: 9090
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /status
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          readinessProbe:
+            httpGet:
+              path: /status
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          resources:
+            {{- toYaml .Values.fileserver.resources | nindent 12 }}
+          volumeMounts:
+            - mountPath: /data
+              name: "file-server"
+      {{- with .Values.fileserver.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.fileserver.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.fileserver.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: "file-server"
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "{{ .Values.fileserver.volumeSize }}"
+        storageClassName: {{ default .Values.global.storageClass .Values.fileserver.storageClass }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-file-server
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-file-server
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 9000
+      targetPort: http
+      protocol: TCP
+    - name: ui
+      port: 9090
+      targetPort: ui
+      protocol: TCP
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-file-server
+{{- end }}

helm-templates/deepfence-console/templates/database/fileserver/secret.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.fileserver.create }}
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-file-server-secret
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-file-server-secret
+stringData:
+    {{- range $k, $v := .Values.fileserver.secrets }}
+    {{ $k }}: {{ $v }}
+    {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/database/kafka/config.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.kafka.create }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-kafka-broker-config
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-kafka-broker-config
+data:
+  {{- range $k, $v := .Values.kafka.config }}
+  {{ $k }}: {{ $v | quote }}
+  {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/database/kafka/kafka.yaml

@@ -0,0 +1,133 @@
+{{- if .Values.kafka.create }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-kafka-broker
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-kafka-broker
+spec:
+  serviceName: {{ include "deepfence-console.fullname" . }}-kafka-broker
+  replicas: {{ .Values.kafka.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-kafka-broker
+  template:
+    metadata:
+      {{- with .Values.kafka.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-kafka-broker
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.kafka.podSecurityContext | nindent 8 }}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 1
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: name
+                      operator: In
+                      values:
+                        - kafka-broker
+                topologyKey: kubernetes.io/hostname
+      initContainers:
+        - name: init
+          image: busybox
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            privileged: true
+          command:  ["/bin/chmod","-R","777", "/data"]
+          volumeMounts:
+            - name: "kafka-broker"
+              mountPath: /data
+      containers:
+        - name: kafka
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.kafka.image.repository }}:{{ default .Values.global.imageTag .Values.kafka.image.tag }}"
+          imagePullPolicy: {{ .Values.kafka.image.pullPolicy }}
+          ports:
+            - containerPort: 9092
+            - containerPort: 9093
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: REPLICAS
+              value: "{{ .Values.kafka.replicaCount }}"
+            - name: SERVICE
+              value: {{ include "deepfence-console.fullname" . }}-kafka-broker
+            - name: KAFKA_LOG_DIRS
+              value: /data/kafka
+          envFrom:
+            - configMapRef:
+                name: {{ include "deepfence-console.fullname" . }}-kafka-broker-config
+          livenessProbe:
+            tcpSocket:
+              port: 9092
+            initialDelaySeconds: 120
+            periodSeconds: 30
+          # readinessProbe:
+          #   tcpSocket:
+          #     port: 9092
+          #   initialDelaySeconds: 120
+          #   periodSeconds: 30
+          resources:
+            {{- toYaml .Values.kafka.resources | nindent 12 }}
+          volumeMounts:
+          - name: "kafka-broker"
+            mountPath: /data
+      {{- with .Values.kafka.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kafka.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: "kafka-broker"
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "{{ .Values.kafka.volumeSize }}"
+        storageClassName: {{ default .Values.global.storageClass .Values.kafka.storageClass }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-kafka-broker
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-kafka-broker
+spec:
+  type: ClusterIP
+  clusterIP: None
+  selector:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-kafka-broker
+  ports:
+    - name: '9092'
+      port: 9092
+      protocol: TCP
+      targetPort: 9092
+    - name: '9093'
+      port: 9093
+      protocol: TCP
+      targetPort: 9093
+{{- end }}

helm-templates/deepfence-console/templates/database/neo4j/config.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.neo4j.create }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-neo4j-config
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-neo4j-config
+data:
+  {{- range $k, $v := .Values.neo4j.config }}
+  {{ $k }}: {{ $v | quote }}
+  {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/database/neo4j/neo4j.yaml

@@ -0,0 +1,113 @@
+{{- if .Values.neo4j.create }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-neo4j
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-neo4j
+spec:
+  serviceName: {{ include "deepfence-console.fullname" . }}-neo4j
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-neo4j
+  template:
+    metadata:
+      {{- with .Values.neo4j.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-neo4j
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.neo4j.podSecurityContext | nindent 8 }}
+      containers:
+        - name: neo4j
+          securityContext:
+            {{- toYaml .Values.neo4j.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.neo4j.image.repository }}:{{ default .Values.global.imageTag .Values.neo4j.image.tag }}"
+          imagePullPolicy: {{ .Values.neo4j.image.pullPolicy }}
+          envFrom:
+            - secretRef:
+                name: {{ include "deepfence-console.fullname" . }}-neo4j-secret
+            - configMapRef:
+                name: {{ include "deepfence-console.fullname" . }}-neo4j-config
+          ports:
+            - name: ui
+              containerPort: 7474
+              protocol: TCP
+            - name: http
+              containerPort: 7687
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+          resources:
+            {{- toYaml .Values.neo4j.resources | nindent 12 }}
+          volumeMounts:
+            - name: "neo4j"
+              mountPath: /data
+            - name: "neo4j"
+              mountPath: /logs
+            - name: "neo4j"
+              mountPath: /plugins
+            - name: "neo4j"
+              mountPath: /backups
+      {{- with .Values.neo4j.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.neo4j.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.neo4j.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: "neo4j"
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "{{ .Values.neo4j.volumeSize }}"
+        storageClassName: {{ default .Values.global.storageClass .Values.neo4j.storageClass }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-neo4j
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-neo4j
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 7687
+      targetPort: 7687
+      protocol: TCP
+    - name: ui
+      port: 7474
+      targetPort: 7474
+      protocol: TCP
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-neo4j
+{{- end }}

helm-templates/deepfence-console/templates/database/neo4j/secret.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.neo4j.create }}
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-neo4j-secret
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-neo4j-secret
+stringData:
+    {{- range $k, $v := .Values.neo4j.secrets }}
+    {{ $k }}: {{ $v }}
+    {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/database/postgres/postgres.yaml

@@ -0,0 +1,110 @@
+{{- if .Values.postgres.create }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-postgres
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-postgres
+spec:
+  serviceName: {{ include "deepfence-console.fullname" . }}-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-postgres
+  template:
+    metadata:
+      {{- with .Values.postgres.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-postgres
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.postgres.podSecurityContext | nindent 8 }}
+      containers:
+        - name: postgres
+          securityContext:
+            {{- toYaml .Values.postgres.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.postgres.image.repository }}:{{ default .Values.global.imageTag .Values.postgres.image.tag }}"
+          imagePullPolicy: {{ .Values.postgres.image.pullPolicy }}
+          envFrom:
+            - secretRef:
+                name: {{ include "deepfence-console.fullname" . }}-postgres-secret
+          ports:
+            - name: tcp
+              containerPort: 5432
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+              - /bin/sh
+              - -c
+              - exec pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          readinessProbe:
+            exec:
+              command:
+              - /bin/sh
+              - -c
+              - exec pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          resources:
+            {{- toYaml .Values.postgres.resources | nindent 12 }}
+          volumeMounts:
+            - mountPath: /data
+              name: "postgres"
+      {{- with .Values.postgres.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postgres.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postgres.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: "postgres"
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "{{ .Values.postgres.volumeSize }}"
+        storageClassName: {{ default .Values.global.storageClass .Values.postgres.storageClass }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-postgres
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-postgres
+spec:
+  type: ClusterIP
+  ports:
+    - name: tcp
+      port: 5432
+      targetPort: tcp
+      protocol: TCP
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-postgres
+{{- end }}

helm-templates/deepfence-console/templates/database/postgres/secret.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.postgres.create }}
+---
+kind: Secret
+apiVersion: v1
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-postgres-secret
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-postgres-secret
+stringData:
+    {{- range $k, $v := .Values.postgres.secrets }}
+    {{ $k }}: {{ $v }}
+    {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/database/redis/redis.yaml

@@ -0,0 +1,107 @@
+{{- if .Values.redis.create }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-redis
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-redis
+spec:
+  serviceName: {{ include "deepfence-console.fullname" . }}-redis
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-redis
+  template:
+    metadata:
+      {{- with .Values.redis.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-redis
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.redis.podSecurityContext | nindent 8 }}
+      containers:
+        - name: redis
+          securityContext:
+            {{- toYaml .Values.redis.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.redis.image.repository }}:{{ default .Values.global.imageTag .Values.redis.image.tag }}"
+          imagePullPolicy: {{ .Values.redis.image.pullPolicy }}
+          ports:
+            - name: tcp
+              containerPort: 6379
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+              - /bin/sh
+              - -c
+              - exec redis-cli ping
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          readinessProbe:
+            exec:
+              command:
+              - /bin/sh
+              - -c
+              - exec redis-cli ping
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          resources:
+            {{- toYaml .Values.redis.resources | nindent 12 }}
+          volumeMounts:
+            - mountPath: /data
+              name: "redis"
+      {{- with .Values.redis.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.redis.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.redis.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: "redis"
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "{{ .Values.redis.volumeSize }}"
+        storageClassName: {{ default .Values.global.storageClass .Values.redis.storageClass }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-redis
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-redis
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6379
+      targetPort: tcp
+      protocol: TCP
+      name: tcp
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-redis
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-agent-serviceaccount.yaml

@@ -0,0 +1,144 @@
+{{- if .Values.console_agents.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-agent
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - pods/log
+      - services
+      - nodes
+      - namespaces
+      - persistentvolumes
+      - persistentvolumeclaims
+      - configmaps
+      - endpoints
+      - replicationcontrollers
+      - serviceaccounts
+      - secrets
+      - limitranges
+      - resourcequotas
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - statefulsets
+      - replicasets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - networkpolicies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - batch
+    resources:
+      - cronjobs
+      - jobs
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - deployments
+      - daemonsets
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - deployments/scale
+    verbs:
+      - get
+  - apiGroups:
+      - extensions
+    resources:
+      - deployments/scale
+    verbs:
+      - get
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - storageclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - volumesnapshot.external-storage.k8s.io
+    resources:
+      - volumesnapshots
+      - volumesnapshotdatas
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - policy
+    resources:
+      - podsecuritypolicies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - roles
+      - rolebindings
+      - clusterroles
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-agent
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "deepfence-console.fullname" . }}-agent
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "deepfence-console.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-agent.yaml

@@ -0,0 +1,195 @@
+{{- if .Values.console_agents.enabled }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-agent
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-agent
+spec:
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.labels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-agent
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        {{- include "deepfence-console.labels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-agent
+    spec:
+      hostPID: true
+      hostNetwork: true
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      automountServiceAccountToken: true
+      dnsPolicy: ClusterFirstWithHostNet
+      volumes:
+        {{- if .Values.console_agents.mountContainerRuntimeSocket.dockerSock }}
+        - name: docker-sock
+          hostPath:
+            path: {{ .Values.console_agents.mountContainerRuntimeSocket.dockerSockPath }}
+            type: Socket
+        {{- end }}
+        {{- if .Values.console_agents.mountContainerRuntimeSocket.containerdSock }}
+        - name: containerd-sock
+          hostPath:
+            path: {{ .Values.console_agents.mountContainerRuntimeSocket.containerdSockPath }}
+            type: Socket
+        {{- end }}
+        {{- if .Values.console_agents.mountContainerRuntimeSocket.crioSock }}
+        - name: crio-sock
+          hostPath:
+            path: {{ .Values.console_agents.mountContainerRuntimeSocket.crioSockPath }}
+            type: Socket
+        - hostPath:
+            path: /var/lib/containers
+            type: Directory
+          name: containers
+        {{- if .Values.console_agents.mountContainerRuntimeSocket.podmanSock }}
+        - name: podman-sock
+          hostPath:
+            path: {{ .Values.console_agents.mountContainerRuntimeSocket.podmanSockPath }}
+            type: Socket
+        - name: systemd
+          hostPath:
+            path: /run/systemd
+            type: Directory
+        {{- end }}
+        {{- end }}
+        - name: kernel-sys
+          hostPath:
+            path: /sys/kernel/debug
+            type: Directory
+        - name: host-fs
+          hostPath:
+            path: /
+            type: Directory
+        - name: fenced-path
+          emptyDir: {}
+        - name: fenced-path-compliance
+          emptyDir: {}
+        - name: fenced-path-compliance-scan-logs
+          emptyDir: {}
+      containers:
+        - name: deepfence-agent
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.console_agents.agent.image.repository }}:{{ default .Values.global.imageTag .Values.console_agents.agent.image.tag }}"
+          imagePullPolicy: {{ .Values.console_agents.agent.image.pullPolicy }}
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: {{ .Values.console_agents.agent.resources.requests.cpu }}
+              memory: {{ .Values.console_agents.agent.resources.requests.memory }}
+            limits:
+              cpu: {{ .Values.console_agents.agent.resources.limits.cpu }}
+              memory: {{ .Values.console_agents.agent.resources.limits.memory }}
+          env:
+            - name: MGMT_CONSOLE_URL_INTERNAL
+              value: {{ include "deepfence-console.fullname" . }}-server
+            - name: MGMT_CONSOLE_PORT_INTERNAL
+              value: "8081"
+            - name: MGMT_CONSOLE_URL
+              value: {{ include "deepfence-console.fullname" . }}-router
+            - name: MGMT_CONSOLE_PORT
+              value: "443"
+            - name: "DEEPFENCE_KEY"
+              value: "\"\""
+            - name: "DEEPFENCE_CONSOLE_AGENT"
+              value: "true"
+            - name: USER_DEFINED_TAGS
+              value: {{ .Values.console_agents.userDefinedTags }}
+            - name: DF_ENABLE_PROCESS_REPORT
+              value: "{{ .Values.console_agents.enableGraphReport }}"
+            - name: DF_ENABLE_CONNECTIONS_REPORT
+              value: "{{ .Values.console_agents.enableGraphReport }}"
+            - name: DF_KUBERNETES_ON
+              value: "Y"
+            - name: INSTANCE_ID_SUFFIX
+              value: "{{ .Values.console_agents.instanceIdSuffix }}"
+            - name: DF_DISABLE_TRAFFIC_ANALYSIS
+              value: "1"
+            - name: DF_CLUSTER_NAME
+              value: "{{ .Values.console_agents.cluster_name }}"
+            - name: AGENT_HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            {{- if .Values.clusterName }}
+            - name: SCOPE_HOSTNAME
+              value: "{{ .Values.console_agents.cluster_name }}-$(AGENT_HOSTNAME)"
+            {{- else }}
+            - name: SCOPE_HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            {{- end }}
+            - name: AGENT_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: AGENT_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- if .Values.console_agents.mountContainerRuntimeSocket.dockerSock }}
+            - name: DOCKER_SOCKET_PATH
+              value: "{{ .Values.console_agents.mountContainerRuntimeSocket.dockerSockPath }}"
+            {{ end }}
+            {{- if .Values.console_agents.mountContainerRuntimeSocket.containerdSock }}
+            - name: CONTAINERD_SOCKET_PATH
+              value: "{{ .Values.console_agents.mountContainerRuntimeSocket.containerdSockPath }}"
+            {{ end }}
+            {{- if .Values.console_agents.mountContainerRuntimeSocket.crioSock }}
+            - name: CRIO_SOCKET_PATH
+              value: "{{ .Values.console_agents.mountContainerRuntimeSocket.crioSockPath }}"
+            {{ end }}
+            {{- if .Values.console_agents.mountContainerRuntimeSocket.podmanSock }}
+            - name: PODMAN_SOCKET_PATH
+              value: "{{ .Values.console_agents.mountContainerRuntimeSocket.podmanSockPath }}"
+            {{ end }}
+          volumeMounts:
+            {{- if .Values.console_agents.mountContainerRuntimeSocket.dockerSock }}
+            - mountPath: {{ .Values.console_agents.mountContainerRuntimeSocket.dockerSockPath }}
+              name: docker-sock
+            {{ end }}
+            {{- if .Values.console_agents.mountContainerRuntimeSocket.containerdSock }}
+            - mountPath: {{ .Values.console_agents.mountContainerRuntimeSocket.containerdSockPath }}
+              name: containerd-sock
+            {{ end }}
+            {{- if .Values.console_agents.mountContainerRuntimeSocket.crioSock }}
+            - mountPath: {{ .Values.console_agents.mountContainerRuntimeSocket.crioSockPath }}
+              name: crio-sock
+            - mountPath: /var/lib/containers
+              name: containers
+            {{ end }}
+            {{- if .Values.console_agents.mountContainerRuntimeSocket.podmanSock }}
+            - mountPath: {{ .Values.console_agents.mountContainerRuntimeSocket.podmanSockPath }}
+              name: podman-sock
+            - mountPath: /run/systemd
+              name: systemd
+            {{ end }}
+            - mountPath: /sys/kernel/debug
+              name: kernel-sys
+            - mountPath: /fenced/mnt/host
+              name: host-fs
+              readOnly: true
+            - mountPath: /var/log/fenced
+              name: fenced-path
+            - mountPath: /var/log/fenced/compliance
+              name: fenced-path-compliance
+            - mountPath: /var/log/fenced/compliance-scan-logs
+              name: fenced-path-compliance-scan-logs
+      {{- with .Values.console_agents.agent.nodeSelector }}
+      nodeSelector:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.console_agents.agent.affinity }}
+      affinity:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.console_agents.agent.tolerations }}
+      tolerations:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-console-config.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ include "deepfence-console.fullname" . }}-config"
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: "{{ include "deepfence-console.fullname" . }}-config"
+data:
+  DEEPFENCE_DEBUG: "false"
+  DEEPFENCE_SAAS_DEPLOYMENT: "false"

helm-templates/deepfence-console/templates/deepfence-console-secrets/fileserver.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.fileserver.create }}
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-secrets-fileserver
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    component: file-server
+stringData:
+  DEEPFENCE_MINIO_HOST: {{ include "deepfence-console.fullname" . }}-file-server
+  DEEPFENCE_MINIO_PORT: "9000"
+  DEEPFENCE_MINIO_SECURE: "false"
+  DEEPFENCE_MINIO_BUCKET: default
+  DEEPFENCE_MINIO_PASSWORD: {{ .Values.fileserver.secrets.MINIO_ROOT_PASSWORD | quote }}
+  DEEPFENCE_MINIO_USER: {{ .Values.fileserver.secrets.MINIO_ROOT_USER | quote }}
+  DEEPFENCE_MINIO_DB_BUCKET: database
+{{- end }}
+

helm-templates/deepfence-console/templates/deepfence-console-secrets/kafka.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.kafka.create }}
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-secrets-kafka
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    component: kafka
+stringData:
+  DEEPFENCE_KAFKA_BROKERS: "{{ include "deepfence-console.fullname" . }}-kafka-broker.{{ .Release.Namespace }}.svc:9092"
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-console-secrets/neo4j.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.neo4j.create }}
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-secrets-neo4j
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    component: neo4j
+stringData:
+  DEEPFENCE_NEO4J_BOLT_PORT: "7687"
+  DEEPFENCE_NEO4J_HOST: {{ include "deepfence-console.fullname" . }}-neo4j
+  DEEPFENCE_NEO4J_USER: {{ (splitList "/" .Values.neo4j.secrets.NEO4J_AUTH) | first | quote }} 
+  DEEPFENCE_NEO4J_PASSWORD: {{ (splitList "/" .Values.neo4j.secrets.NEO4J_AUTH) | last | quote }} 
+{{- end }}
+

helm-templates/deepfence-console/templates/deepfence-console-secrets/postgres.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.postgres.create }}
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-secrets-postgres
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-secrets-postgres
+stringData:
+  DEEPFENCE_POSTGRES_USER_DB_PORT: "5432"
+  DEEPFENCE_POSTGRES_USER_DB_HOST: {{ include "deepfence-console.fullname" . }}-postgres
+  DEEPFENCE_POSTGRES_USER_DB_SSLMODE: disable
+  DEEPFENCE_POSTGRES_USER_DB_USER: {{ .Values.postgres.secrets.POSTGRES_USER | quote }}
+  DEEPFENCE_POSTGRES_USER_DB_PASSWORD: {{ .Values.postgres.secrets.POSTGRES_PASSWORD | quote }}
+  DEEPFENCE_POSTGRES_USER_DB_NAME: {{ .Values.postgres.secrets.POSTGRES_DB | quote }}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-console-secrets/redis.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.redis.create }}
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-secrets-redis
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    component: redis
+stringData:
+  DEEPFENCE_REDIS_DB_NUMBER: "0"
+  DEEPFENCE_REDIS_PORT: "6379"
+  DEEPFENCE_REDIS_HOST: {{ include "deepfence-console.fullname" . }}-redis
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-console-secrets/s3.yaml

@@ -0,0 +1,19 @@
+{{- if and (eq .Values.fileserver.create false) .Values.aws_s3_buckets.create }}
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-secrets-fileserver
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    component: file-server
+stringData:
+  DEEPFENCE_MINIO_HOST: "s3.amazonaws.com"
+  DEEPFENCE_MINIO_SECURE: "true"
+  DEEPFENCE_MINIO_DB_BUCKET: {{ .Values.aws_s3_buckets.vulnerability_db_bucket | quote }}
+  DEEPFENCE_MINIO_BUCKET: {{ .Values.aws_s3_buckets.data_bucket | quote }}
+  DEEPFENCE_MINIO_PASSWORD: {{ .Values.aws_s3_buckets.secret_access_key | quote }}
+  DEEPFENCE_MINIO_USER: {{ .Values.aws_s3_buckets.access_key_id | quote }}
+  DEEPFENCE_MINIO_REGION: {{.Values.aws_s3_buckets.region | quote }}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-ingester.yaml

@@ -0,0 +1,147 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-ingester
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-ingester
+spec:
+  {{- if not .Values.ingester.autoscaling.enabled }}
+  replicas: {{ .Values.ingester.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-ingester
+  template:
+    metadata:
+      {{- with .Values.ingester.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-ingester
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.ingester.podSecurityContext | nindent 8 }}
+      containers:
+        - name: ingester
+          securityContext:
+            {{- toYaml .Values.ingester.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.ingester.image.repository }}:{{ default .Values.global.imageTag .Values.ingester.image.tag }}"
+          imagePullPolicy: {{ .Values.ingester.image.pullPolicy }}
+          env:
+            - name: DEEPFENCE_MODE
+              value: ingester
+          envFrom:
+            - configMapRef:
+                name: "{{ include "deepfence-console.fullname" . }}-config"
+            - secretRef:
+                {{- if .Values.redis.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-redis"
+                {{- else }}
+                name: {{ .Values.redis.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if or .Values.fileserver.create .Values.aws_s3_buckets.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-fileserver"
+                {{- else if .Values.fileserver.secretName }}
+                name: {{ .Values.fileserver.secretName }}
+                {{- else if .Values.aws_s3_buckets.secretName }}
+                name: {{ .Values.aws_s3_buckets.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.kafka.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-kafka"
+                {{- else }}
+                name: {{ .Values.kafka.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.postgres.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-postgres"
+                {{- else }}
+                name: {{ .Values.postgres.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.neo4j.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-neo4j"
+                {{- else }}
+                name: {{ .Values.neo4j.secretName }}
+                {{- end }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          # livenessProbe:
+          #   httpGet:
+          #     path: /
+          #     port: http
+          # readinessProbe:
+          #   httpGet:
+          #     path: /
+          #     port: http
+          resources:
+            {{- toYaml .Values.ingester.resources | nindent 12 }}
+      {{- with .Values.ingester.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.ingester.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.ingester.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-ingester
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-ingester
+spec:
+  type: {{ .Values.ingester.service.type }}
+  ports:
+    - port: {{ .Values.ingester.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-ingester
+---
+{{- if .Values.ingester.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: deepfence-ingester
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    component: ingester
+    name: deepfence-ingester
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: deepfence-ingester
+  minReplicas: {{ .Values.ingester.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.ingester.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.ingester.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.ingester.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.ingester.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.ingester.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-router-ingress.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.ingress.enable }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-ingress
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: {{ required "ingress class name is required" .Values.ingress.class }}
+  rules:
+  - http:
+      paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: {{ include "deepfence-console.fullname" . }}-router
+              port:
+                {{- if .Values.router.forceHttpsRedirect }}
+                number: {{ .Values.router.service.httpsPort }}
+                {{- else }}
+                number: {{ .Values.router.service.httpPort }}
+                {{- end }}
+    {{- with .Values.ingress.host }}
+    host: {{ . }}
+    {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-router.yaml

@@ -0,0 +1,183 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-router
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-router
+spec:
+  {{- if not .Values.router.autoscaling.enabled }}
+  replicas: {{ .Values.router.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-router
+  template:
+    metadata:
+      {{- with .Values.router.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-router
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.router.podSecurityContext | nindent 8 }}
+      containers:
+        - name: router
+          securityContext:
+            {{- toYaml .Values.router.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.router.image.repository }}:{{ default .Values.global.imageTag .Values.router.image.tag }}"
+          imagePullPolicy: {{ .Values.router.image.pullPolicy }}
+          env:
+            - name: FORCE_HTTPS_REDIRECT
+              value: "{{ .Values.router.forceHttpsRedirect }}"
+            - name: UI_SERVICE_NAME
+              value: {{ include "deepfence-console.fullname" . }}-ui
+            - name: UI_SERVICE_PORT
+              value: {{ .Values.ui.service.port | quote }}
+            - name: API_SERVICE_HOST
+              value: {{ include "deepfence-console.fullname" . }}-server
+            - name: API_SERVICE_PORT
+              value: {{ .Values.server.service.port | quote }}
+            - name: DEEPFENCE_MINIO_HOST
+              value: {{ include "deepfence-console.fullname" . }}-file-server
+            - name: DEEPFENCE_MINIO_PORT
+              value: "9000"
+          envFrom:
+            - configMapRef:
+                name: "{{ include "deepfence-console.fullname" . }}-config"
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+            - name: https
+              containerPort: 443
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 90
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          readinessProbe:
+            httpGet:
+              path: /
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 90
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 10
+            successThreshold: 1
+          volumeMounts:
+            {{- if or .Values.router.tls.secretName (and .Values.router.tls.cert .Values.router.tls.key) }}
+            - name: certs
+              mountPath: /etc/deepfence/certs
+              readOnly: true
+            {{- end }}
+          resources:
+            {{- toYaml .Values.router.resources | nindent 12 }}
+      volumes:
+        {{- if .Values.router.tls.secretName }}
+        - name: certs
+          secret:
+            secretName: {{ .Values.router.tls.secretName }}
+        {{- else if and .Values.router.tls.cert .Values.router.tls.key }}
+        - name: certs
+          secret:
+            secretName: deepfence-router-tls
+        {{- end }}
+      {{- with .Values.router.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.router.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.router.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+{{- if or .Values.router.service.create .Values.ingress.enable }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-router
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-router
+  {{- with .Values.router.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.router.service.type }}
+  ports:
+    - port: {{ .Values.router.service.httpsPort }}
+      targetPort: https
+      protocol: TCP
+      name: https
+    - port: {{ .Values.router.service.httpPort }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-router
+{{- end }}
+---
+{{- if .Values.router.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-router
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-router
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "deepfence-console.fullname" . }}-router
+  minReplicas: {{ .Values.router.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.router.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.router.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.router.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.router.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.router.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}
+---
+{{- if and .Values.router.tls.cert .Values.router.tls.key }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-router-tls
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-router-tls
+type: kubernetes.io/tls
+data:
+  tls.crt: |-
+{{ .Values.router.tls.cert | b64enc | indent 4}}
+  tls.key: |-
+{{ .Values.router.tls.key | b64enc | indent 4}}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-scheduler.yaml

@@ -0,0 +1,115 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-scheduler
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-scheduler
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-scheduler
+  template:
+    metadata:
+      {{- with .Values.scheduler.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-scheduler
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.scheduler.podSecurityContext | nindent 8 }}
+      containers:
+        - name: scheduler
+          securityContext:
+            {{- toYaml .Values.scheduler.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.scheduler.image.repository }}:{{ default .Values.global.imageTag .Values.scheduler.image.tag }}"
+          imagePullPolicy: {{ .Values.scheduler.image.pullPolicy }}
+          env:
+            - name: DEEPFENCE_MODE
+              value: scheduler
+          envFrom:
+            - configMapRef:
+                name: "{{ include "deepfence-console.fullname" . }}-config"
+            - secretRef:
+                {{- if .Values.redis.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-redis"
+                {{- else }}
+                name: {{ .Values.redis.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if or .Values.fileserver.create .Values.aws_s3_buckets.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-fileserver"
+                {{- else if .Values.fileserver.secretName }}
+                name: {{ .Values.fileserver.secretName }}
+                {{- else if .Values.aws_s3_buckets.secretName }}
+                name: {{ .Values.aws_s3_buckets.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.kafka.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-kafka"
+                {{- else }}
+                name: {{ .Values.kafka.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.postgres.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-postgres"
+                {{- else }}
+                name: {{ .Values.postgres.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.neo4j.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-neo4j"
+                {{- else }}
+                name: {{ .Values.neo4j.secretName }}
+                {{- end }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          # livenessProbe:
+          #   httpGet:
+          #     path: /
+          #     port: http
+          # readinessProbe:
+          #   httpGet:
+          #     path: /
+          #     port: http
+          resources:
+            {{- toYaml .Values.scheduler.resources | nindent 12 }}
+      {{- with .Values.scheduler.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.scheduler.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.scheduler.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-scheduler
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-scheduler
+spec:
+  type: {{ .Values.scheduler.service.type }}
+  ports:
+    - port: {{ .Values.scheduler.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-scheduler
+

helm-templates/deepfence-console/templates/deepfence-server.yaml

@@ -0,0 +1,170 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-server
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-server
+spec:
+  {{- if not .Values.server.autoscaling.enabled }}
+  replicas: {{ .Values.server.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-server
+  template:
+    metadata:
+      {{- with .Values.server.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-server
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      automountServiceAccountToken: true
+      securityContext:
+        {{- toYaml .Values.server.podSecurityContext | nindent 8 }}
+      containers:
+        - name: server
+          securityContext:
+            {{- toYaml .Values.server.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.server.image.repository }}:{{ default .Values.global.imageTag .Values.server.image.tag }}"
+          imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+          env:
+            - name: CONSOLE_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: DEEPFENCE_ACCESS_TOKEN_EXPIRY_MINUTES
+              value: "5"
+            - name: DEEPFENCE_CONSOLE_ORCHESTRATOR
+              value: "kubernetes"
+          envFrom:
+            - configMapRef:
+                name: "{{ include "deepfence-console.fullname" . }}-config"
+            - secretRef:
+                {{- if .Values.redis.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-redis"
+                {{- else }}
+                name: {{ .Values.redis.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if or .Values.fileserver.create .Values.aws_s3_buckets.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-fileserver"
+                {{- else if .Values.fileserver.secretName }}
+                name: {{ .Values.fileserver.secretName }}
+                {{- else if .Values.aws_s3_buckets.secretName }}
+                name: {{ .Values.aws_s3_buckets.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.kafka.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-kafka"
+                {{- else }}
+                name: {{ .Values.kafka.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.postgres.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-postgres"
+                {{- else }}
+                name: {{ .Values.postgres.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.neo4j.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-neo4j"
+                {{- else }}
+                name: {{ .Values.neo4j.secretName }}
+                {{- end }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+            - name: internal
+              containerPort: 8081
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /deepfence/ping
+              port: http
+            initialDelaySeconds: 90
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          readinessProbe:
+            httpGet:
+              path: /deepfence/ping
+              port: http
+            initialDelaySeconds: 90
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          resources:
+            {{- toYaml .Values.server.resources | nindent 12 }}
+      {{- with .Values.server.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.server.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.server.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-server
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-server
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.server.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+    - port: {{ .Values.server.service.internalPort }}
+      targetPort: internal
+      protocol: TCP
+      name: internal
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-server
+---
+{{- if .Values.server.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-server
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-server
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "deepfence-console.fullname" . }}-server
+  minReplicas: {{ .Values.server.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.server.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.server.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.server.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.server.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.server.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-ui.yaml

@@ -0,0 +1,153 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-ui
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-ui
+spec:
+  {{- if not .Values.ui.autoscaling.enabled }}
+  replicas: {{ .Values.ui.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-ui
+  template:
+    metadata:
+      {{- with .Values.ui.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-ui
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.ui.podSecurityContext | nindent 8 }}
+      containers:
+        - name: ui
+          securityContext:
+            {{- toYaml .Values.ui.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.ui.image.repository }}:{{ default .Values.global.imageTag .Values.ui.image.tag }}"
+          imagePullPolicy: {{ .Values.ui.image.pullPolicy }}
+          envFrom:
+            - configMapRef:
+                name: "{{ include "deepfence-console.fullname" . }}-config"
+            - secretRef:
+                {{- if .Values.redis.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-redis"
+                {{- else }}
+                name: {{ .Values.redis.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if or .Values.fileserver.create .Values.aws_s3_buckets.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-fileserver"
+                {{- else if .Values.fileserver.secretName }}
+                name: {{ .Values.fileserver.secretName }}
+                {{- else if .Values.aws_s3_buckets.secretName }}
+                name: {{ .Values.aws_s3_buckets.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.kafka.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-kafka"
+                {{- else }}
+                name: {{ .Values.kafka.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.postgres.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-postgres"
+                {{- else }}
+                name: {{ .Values.postgres.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.neo4j.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-neo4j"
+                {{- else }}
+                name: {{ .Values.neo4j.secretName }}
+                {{- end }}
+          ports:
+            - name: http
+              containerPort: 8081
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+            successThreshold: 1
+          resources:
+            {{- toYaml .Values.ui.resources | nindent 12 }}
+      {{- with .Values.ui.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.ui.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.ui.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-ui
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-ui
+spec:
+  type: {{ .Values.ui.service.type }}
+  ports:
+    - port: {{ .Values.ui.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-ui
+---
+{{- if .Values.ui.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-ui
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-ui
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "deepfence-console.fullname" . }}-ui
+  minReplicas: {{ .Values.ui.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.ui.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.ui.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.ui.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.ui.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.ui.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/deepfence-worker.yaml

@@ -0,0 +1,146 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-worker
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-worker
+spec:
+  {{- if not .Values.worker.autoscaling.enabled }}
+  replicas: {{ .Values.worker.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "deepfence-console.selectorLabels" . | nindent 6 }}
+      name: {{ include "deepfence-console.fullname" . }}-worker
+  template:
+    metadata:
+      {{- with .Values.worker.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "deepfence-console.selectorLabels" . | nindent 8 }}
+        name: {{ include "deepfence-console.fullname" . }}-worker
+    spec:
+      serviceAccountName: {{ include "deepfence-console.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.worker.podSecurityContext | nindent 8 }}
+      containers:
+        - name: worker
+          securityContext:
+            {{- toYaml .Values.worker.securityContext | nindent 12 }}
+          image: "{{ .Values.global.imageRepoPrefix }}/{{ .Values.worker.image.repository }}:{{ default .Values.global.imageTag .Values.worker.image.tag }}"
+          imagePullPolicy: {{ .Values.worker.image.pullPolicy }}
+          env:
+            - name: DEEPFENCE_MODE
+              value: worker
+          envFrom:
+            - configMapRef:
+                name: "{{ include "deepfence-console.fullname" . }}-config"
+            - secretRef:
+                {{- if .Values.redis.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-redis"
+                {{- else }}
+                name: {{ .Values.redis.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if or .Values.fileserver.create .Values.aws_s3_buckets.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-fileserver"
+                {{- else if .Values.fileserver.secretName }}
+                name: {{ .Values.fileserver.secretName }}
+                {{- else if .Values.aws_s3_buckets.secretName }}
+                name: {{ .Values.aws_s3_buckets.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.kafka.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-kafka"
+                {{- else }}
+                name: {{ .Values.kafka.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.postgres.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-postgres"
+                {{- else }}
+                name: {{ .Values.postgres.secretName }}
+                {{- end }}
+            - secretRef:
+                {{- if .Values.neo4j.create }}
+                name: "{{ include "deepfence-console.fullname" . }}-secrets-neo4j"
+                {{- else }}
+                name: {{ .Values.neo4j.secretName }}
+                {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.worker.service.port }}
+              protocol: TCP
+          # livenessProbe:
+          #   httpGet:
+          #     path: /
+          #     port: http
+          # readinessProbe:
+          #   httpGet:
+          #     path: /
+          #     port: http
+          resources:
+            {{- toYaml .Values.worker.resources | nindent 12 }}
+      {{- with .Values.worker.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-worker
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-worker
+spec:
+  type: {{ .Values.worker.service.type }}
+  ports:
+    - port: {{ .Values.worker.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "deepfence-console.selectorLabels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-worker
+---
+{{- if .Values.worker.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}-worker
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+    name: {{ include "deepfence-console.fullname" . }}-worker
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "deepfence-console.fullname" . }}-worker
+  minReplicas: {{ .Values.worker.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.worker.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.worker.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.worker.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.worker.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.worker.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

helm-templates/deepfence-console/templates/image-pull-secret.yaml

@@ -0,0 +1,12 @@
+---
+{{- if .Values.imagePullSecret.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "deepfence-console.imagePullSecretName" . }}
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: {{ template "imagePullSecret" . }}
+{{- end }}

helm-templates/deepfence-console/templates/serviceaccount.yaml

@@ -0,0 +1,54 @@
+{{- if .Values.serviceAccount.create }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "deepfence-console.serviceAccountName" . }}
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: false
+{{- if ( include "deepfence-console.imagePullSecretName" . ) }}
+imagePullSecrets:
+  - name: {{ include "deepfence-console.imagePullSecretName" . }}
+{{- end }}
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "deepfence-console.fullname" . }}
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "deepfence-console.serviceAccountName" . }}-role
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    {{- if .Values.serviceAccount.create }}
+    name: {{ include "deepfence-console.serviceAccountName" . }}
+    {{- else }}
+    name: {{ .Values.serviceAccount.name }}
+    {{- end }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "deepfence-console.serviceAccountName" . }}-role
+  labels:
+    {{- include "deepfence-console.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
+  - watch

helm-templates/deepfence-console/values.yaml

@@ -0,0 +1,490 @@
+# Default values for deepfence-console.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+nameOverride: ""
+fullnameOverride: ""
+
+global:
+  imageRepoPrefix: "quay.io"
+  # imageRepoPrefix: "docker.io"
+  # this image tag is used everywhere for console services
+  # to override set tag at service level
+  imageTag: 2.0.1
+  storageClass: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+imagePullSecret:
+  # Specifies whether a image pull secret should be created
+  create: true
+  registry: "quay.io"
+  # registry: "https://index.docker.io/v1/"
+  username: ""
+  password: ""
+  # The name of the imagePullSecret to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+kafka:
+  # Specifies whether a kafka cluster should be created
+  create: true
+  # if create false provide name of the existing secret
+  # secret format refer templates/console-secrets/kafka.yaml
+  secretName: ""
+  # if create true then below values are used to create kafka cluster
+  replicaCount: 1 # recommended 3 for high availability kafka
+  image:
+    repository: deepfenceio/deepfence_kafka_broker
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  config:
+    # required, recommended to generate new UUID using kafka-storage tool
+    STORAGE_UUID: hNQ55qppT5GGybF52ZGlOQ
+  storageClass: ""
+  volumeSize: 50G
+  resources:
+    limits:
+      cpu: 4000m
+      memory: 8192Mi
+    requests:
+      cpu: 500m
+      memory: 1024Mi
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+postgres:
+  # Specifies whether a postgres database instance should be created
+  create: true
+  # if create false provide name of the existing secret
+  # secret format refer templates/deepfence-console-secrets/postgres.yaml
+  secretName: ""
+  # if create true then below values are used to create postgres database instance
+  secrets:
+    POSTGRES_PASSWORD: deepfence
+    POSTGRES_USER: deepfence
+    POSTGRES_DB: users
+  image:
+    repository: deepfenceio/deepfence_postgres
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  storageClass: ""
+  volumeSize: 50G
+  resources:
+    limits:
+      cpu: 2000m
+      memory: 2048Mi
+    requests:
+      cpu: 200m
+      memory: 512Mi
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+redis:
+  # Specifies whether a postgres database instance should be created
+  create: true
+  # if create false provide name of the existing secret
+  # secret format refer templates/console-secrets/redis.yaml
+  secretName: ""
+  # if create true then below values are used to create postgres database instance
+  image:
+    repository: deepfenceio/deepfence_redis
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  storageClass: ""
+  volumeSize: 10G
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 2048Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+fileserver:
+  # Specifies whether a file server instance should be created
+  # set this to false if using S3
+  create: true
+  # if create false provide name of the existing secret
+  # secret format refer templates/console-secrets/minio.yaml
+  secretName: ""
+  # if create true then below values are used to create postgres database instance
+  secrets:
+    MINIO_ROOT_USER: deepfence
+    MINIO_ROOT_PASSWORD: deepfence
+  image:
+    repository: deepfenceio/deepfence_file_server
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  storageClass: ""
+  volumeSize: 50G
+  resources:
+    limits:
+      cpu: 2000m
+      memory: 4096Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+# these values are used if fileserver.create=false
+aws_s3_buckets:
+  # Specifies whether secret should be created
+  create: false
+  # if create false provide name of the existing secret
+  # secret format refer templates/deepfence-console-secrets/s3.yaml
+  secretName: ""
+  # public bucket with read permisons on objects for hosting vulnerability database
+  # S3 bucket permissions {"Version":"2012-10-17","Statement":[{"Sid":"database","Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":["arn:aws:s3:::<bucket-name>/database/*","arn:aws:s3:::<bucket-name>/database"]}]}
+  vulnerability_db_bucket: ""
+  # prvate bucket to host reports, sbom, etc.
+  data_bucket: ""
+  # aws credentials to access buckets
+  access_key_id : ""
+  secret_access_key: ""
+  # region where the buckets are hosted ex: ap-south-1
+  region: ""
+
+neo4j:
+  # Specifies whether a neo4j database instance should be created
+  create: true
+  # if create false provide name of the existing secret
+  # secret format refer templates/console-secrets/neo4j.yaml
+  secretName: ""
+  # if create true then below values are used to create neo4j database instance
+  secrets:
+    # format should be username/password
+    NEO4J_AUTH: neo4j/e16908ffa5b9f8e9d4ed
+    # To enable periodic backup of neo4j database to S3, please set the values below
+    # AWS_ACCESS_KEY: ""
+    # AWS_SECRET_KEY: ""
+    # DF_REMOTE_BACKUP_ROOT: "" # S3 bucket name
+  config:
+    NEO4J_dbms_memory_pagecache_size: 2600m
+    NEO4JLABS_PLUGINS: '["apoc"]'
+  image:
+    repository: deepfenceio/deepfence_neo4j
+    pullPolicy: Always
+    # tag: 2.0.1
+  storageClass: ""
+  volumeSize: 50G
+  resources:
+    limits:
+      cpu: 4000m
+      memory: 16Gi
+    requests:
+      cpu: 1000m
+      memory: 2048Mi
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+# ingress for console
+ingress:
+  enable: false
+  ## name of the ingress class for ingress provider installed on the cluster, cannot be empty
+  ## Example: nginx
+  class: nginx
+  ## host example: threat.example.com
+  host: ""
+  ## annotations to customize ingress
+  annotations:
+    ## nginx ingress annotations
+    ## https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/
+    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 200m
+
+    ## aws alb annotations
+    ## aws load balancer controller needs to be installed on the cluster for these annotations to work
+    ## documentation aws load balancer controller https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/
+    # alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
+    # alb.ingress.kubernetes.io/backend-protocol: HTTPS
+    ## arn of the certificate available on aws certificate manager
+    # alb.ingress.kubernetes.io/certificate-arn: ""
+    # alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
+    # alb.ingress.kubernetes.io/scheme: internet-facing
+    # alb.ingress.kubernetes.io/target-group-attributes: stickiness.enabled=true,stickiness.lb_cookie.duration_seconds=3600
+    # alb.ingress.kubernetes.io/target-type: ip
+
+router:
+  replicaCount: 1
+  image:
+    repository: deepfenceio/deepfence_router
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  forceHttpsRedirect: true
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  service:
+    ## useful if deepfence-router chart is not installed
+    create: false
+    # useful for configuring loadbalancer options on supported clouds
+    annotations: {}
+    ## service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
+    type: ClusterIP # set service type to cluster ip and enable ingress if available
+    httpsPort: 443
+    httpPort: 80
+  resources:
+    limits:
+      cpu: 3000m
+      memory: 4096Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  autoscaling:
+    enabled: false
+    minReplicas: 1
+    maxReplicas: 3
+    targetCPUUtilizationPercentage: 80
+    # targetMemoryUtilizationPercentage: 80
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  # Use custom ssl certificate for Deepfence UI
+  # custom certificates can be configured using two options
+  # existing secret or base64 encoded cert and key string
+  # provide one off the two options to configure custom certificates
+  tls:
+    # provide secret name which contains tls cert and key
+    # reference: https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets
+    # make sure to create secret in the same namespace as that of the console
+    secretName: ""
+    # embed given cert and key as secret and mount to router pod
+    # provide certificate and key in below example format
+    # cert: |-
+    #   -----BEGIN CERTIFICATE-----
+    #   MIIFCTCCAvGgAwIBAgIUNshy8GFTjfUR7inZ1JCcN+tDuh4wDQYJKoZIhvcNAQEL
+    #   .....
+    #   BMepE4d9+TQFcPQ/OKSlP8FB2nPKZJdM+JlXDFWqeKvbdYS4QErRLd33qUmq
+    #   -----END CERTIFICATE-----
+    # key: |-
+    #   -----BEGIN PRIVATE KEY-----
+    #   MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDECeUraonCz/89
+    #   .....
+    #   bHEvWp7ugCTFhurM+lla0d+ElDO2
+    #   -----END PRIVATE KEY-----
+    cert: ""
+    key: ""
+
+server:
+  replicaCount: 1
+  image:
+    repository: deepfenceio/deepfence_server
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  service:
+    type: ClusterIP
+    port: 8080
+    internalPort: 8081
+  resources:
+    limits:
+      cpu: 3000m
+      memory: 4096Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  autoscaling:
+    enabled: false
+    minReplicas: 1
+    maxReplicas: 3
+    targetCPUUtilizationPercentage: 80
+    # targetMemoryUtilizationPercentage: 80
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+worker:
+  replicaCount: 1
+  image:
+    repository: deepfenceio/deepfence_worker
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  service:
+    type: ClusterIP
+    port: 8080
+  resources:
+    limits:
+      cpu: 2000m
+      memory: 8000Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  autoscaling:
+    enabled: false
+    minReplicas: 1
+    maxReplicas: 3
+    targetCPUUtilizationPercentage: 80
+    # targetMemoryUtilizationPercentage: 80
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+ingester:
+  replicaCount: 1
+  image:
+    repository: deepfenceio/deepfence_worker
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  service:
+    type: ClusterIP
+    port: 8080
+  resources:
+    limits:
+      cpu: 2000m
+      memory: 4096Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  autoscaling:
+    enabled: false
+    minReplicas: 1
+    maxReplicas: 3
+    targetCPUUtilizationPercentage: 80
+    # targetMemoryUtilizationPercentage: 80
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+scheduler:
+  image:
+    repository: deepfenceio/deepfence_worker
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  service:
+    type: ClusterIP
+    port: 8080
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+ui:
+  replicaCount: 1
+  image:
+    repository: deepfenceio/deepfence_ui
+    pullPolicy: Always
+    # Overrides the image tag whose default is .global.imageTag
+    # tag: 2.0.1
+  service:
+    type: ClusterIP
+    port: 8081
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  autoscaling:
+    enabled: false
+    minReplicas: 1
+    maxReplicas: 3
+    targetCPUUtilizationPercentage: 80
+    # targetMemoryUtilizationPercentage: 80
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+console_agents:
+  enabled: true
+  cluster_name: "tm-cluster"
+  enableGraphReport: true
+  userDefinedTags: ""
+  instanceIdSuffix: "N"
+  mountContainerRuntimeSocket:
+    dockerSock: false
+    # Change if socket path is not the following
+    dockerSockPath: "/var/run/docker.sock"
+    containerdSock: true
+    # Change if socket path is not the following
+    containerdSockPath: "/run/containerd/containerd.sock"
+    crioSock: false
+    # Change if socket path is not the following
+    crioSockPath: "/var/run/crio/crio.sock"
+    podmanSock: false
+    # Change if socket path is not the following
+    podmanSockPath: "/run/podman/podman.sock"
+  agent:
+    image:
+      repository: deepfenceio/deepfence_agent
+      pullPolicy: Always
+      # Overrides the image tag whose default is .global.imageTag
+      # tag: 2.0.1
+    resources:
+      requests:
+        cpu: 150m
+        memory: 512Mi
+      limits:
+        cpu: 1500m
+        memory: 2048Mi
+    podAnnotations: {}
+    podSecurityContext: {}
+    securityContext: {}
+    nodeSelector: {"kubernetes.io/os": "linux"}
+    tolerations:
+      - operator: "Exists"
+        effect: "NoSchedule"
+      - operator: "Exists"
+        effect: "NoExecute"
+    affinity: {}