added repo
This commit is contained in:
Your Name
@@ -0,0 +1,490 @@
|
||||
# Default values for deepfence-console.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
global:
|
||||
imageRepoPrefix: "quay.io"
|
||||
# imageRepoPrefix: "docker.io"
|
||||
# this image tag is used everywhere for console services
|
||||
# to override set tag at service level
|
||||
imageTag: 2.0.1
|
||||
storageClass: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
imagePullSecret:
|
||||
# Specifies whether a image pull secret should be created
|
||||
create: true
|
||||
registry: "quay.io"
|
||||
# registry: "https://index.docker.io/v1/"
|
||||
username: ""
|
||||
password: ""
|
||||
# The name of the imagePullSecret to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
kafka:
|
||||
# Specifies whether a kafka cluster should be created
|
||||
create: true
|
||||
# if create false provide name of the existing secret
|
||||
# secret format refer templates/console-secrets/kafka.yaml
|
||||
secretName: ""
|
||||
# if create true then below values are used to create kafka cluster
|
||||
replicaCount: 1 # recommended 3 for high availability kafka
|
||||
image:
|
||||
repository: deepfenceio/deepfence_kafka_broker
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
config:
|
||||
# required, recommended to generate new UUID using kafka-storage tool
|
||||
STORAGE_UUID: hNQ55qppT5GGybF52ZGlOQ
|
||||
storageClass: ""
|
||||
volumeSize: 50G
|
||||
resources:
|
||||
limits:
|
||||
cpu: 4000m
|
||||
memory: 8192Mi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 1024Mi
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
postgres:
|
||||
# Specifies whether a postgres database instance should be created
|
||||
create: true
|
||||
# if create false provide name of the existing secret
|
||||
# secret format refer templates/deepfence-console-secrets/postgres.yaml
|
||||
secretName: ""
|
||||
# if create true then below values are used to create postgres database instance
|
||||
secrets:
|
||||
POSTGRES_PASSWORD: deepfence
|
||||
POSTGRES_USER: deepfence
|
||||
POSTGRES_DB: users
|
||||
image:
|
||||
repository: deepfenceio/deepfence_postgres
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
storageClass: ""
|
||||
volumeSize: 50G
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 2048Mi
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
redis:
|
||||
# Specifies whether a postgres database instance should be created
|
||||
create: true
|
||||
# if create false provide name of the existing secret
|
||||
# secret format refer templates/console-secrets/redis.yaml
|
||||
secretName: ""
|
||||
# if create true then below values are used to create postgres database instance
|
||||
image:
|
||||
repository: deepfenceio/deepfence_redis
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
storageClass: ""
|
||||
volumeSize: 10G
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 2048Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
fileserver:
|
||||
# Specifies whether a file server instance should be created
|
||||
# set this to false if using S3
|
||||
create: true
|
||||
# if create false provide name of the existing secret
|
||||
# secret format refer templates/console-secrets/minio.yaml
|
||||
secretName: ""
|
||||
# if create true then below values are used to create postgres database instance
|
||||
secrets:
|
||||
MINIO_ROOT_USER: deepfence
|
||||
MINIO_ROOT_PASSWORD: deepfence
|
||||
image:
|
||||
repository: deepfenceio/deepfence_file_server
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
storageClass: ""
|
||||
volumeSize: 50G
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 4096Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
# these values are used if fileserver.create=false
|
||||
aws_s3_buckets:
|
||||
# Specifies whether secret should be created
|
||||
create: false
|
||||
# if create false provide name of the existing secret
|
||||
# secret format refer templates/deepfence-console-secrets/s3.yaml
|
||||
secretName: ""
|
||||
# public bucket with read permisons on objects for hosting vulnerability database
|
||||
# S3 bucket permissions {"Version":"2012-10-17","Statement":[{"Sid":"database","Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":["arn:aws:s3:::<bucket-name>/database/*","arn:aws:s3:::<bucket-name>/database"]}]}
|
||||
vulnerability_db_bucket: ""
|
||||
# prvate bucket to host reports, sbom, etc.
|
||||
data_bucket: ""
|
||||
# aws credentials to access buckets
|
||||
access_key_id : ""
|
||||
secret_access_key: ""
|
||||
# region where the buckets are hosted ex: ap-south-1
|
||||
region: ""
|
||||
|
||||
neo4j:
|
||||
# Specifies whether a neo4j database instance should be created
|
||||
create: true
|
||||
# if create false provide name of the existing secret
|
||||
# secret format refer templates/console-secrets/neo4j.yaml
|
||||
secretName: ""
|
||||
# if create true then below values are used to create neo4j database instance
|
||||
secrets:
|
||||
# format should be username/password
|
||||
NEO4J_AUTH: neo4j/e16908ffa5b9f8e9d4ed
|
||||
# To enable periodic backup of neo4j database to S3, please set the values below
|
||||
# AWS_ACCESS_KEY: ""
|
||||
# AWS_SECRET_KEY: ""
|
||||
# DF_REMOTE_BACKUP_ROOT: "" # S3 bucket name
|
||||
config:
|
||||
NEO4J_dbms_memory_pagecache_size: 2600m
|
||||
NEO4JLABS_PLUGINS: '["apoc"]'
|
||||
image:
|
||||
repository: deepfenceio/deepfence_neo4j
|
||||
pullPolicy: Always
|
||||
# tag: 2.0.1
|
||||
storageClass: ""
|
||||
volumeSize: 50G
|
||||
resources:
|
||||
limits:
|
||||
cpu: 4000m
|
||||
memory: 16Gi
|
||||
requests:
|
||||
cpu: 1000m
|
||||
memory: 2048Mi
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
# ingress for console
|
||||
ingress:
|
||||
enable: false
|
||||
## name of the ingress class for ingress provider installed on the cluster, cannot be empty
|
||||
## Example: nginx
|
||||
class: nginx
|
||||
## host example: threat.example.com
|
||||
host: ""
|
||||
## annotations to customize ingress
|
||||
annotations:
|
||||
## nginx ingress annotations
|
||||
## https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/
|
||||
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 200m
|
||||
|
||||
## aws alb annotations
|
||||
## aws load balancer controller needs to be installed on the cluster for these annotations to work
|
||||
## documentation aws load balancer controller https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/
|
||||
# alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
|
||||
# alb.ingress.kubernetes.io/backend-protocol: HTTPS
|
||||
## arn of the certificate available on aws certificate manager
|
||||
# alb.ingress.kubernetes.io/certificate-arn: ""
|
||||
# alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
|
||||
# alb.ingress.kubernetes.io/scheme: internet-facing
|
||||
# alb.ingress.kubernetes.io/target-group-attributes: stickiness.enabled=true,stickiness.lb_cookie.duration_seconds=3600
|
||||
# alb.ingress.kubernetes.io/target-type: ip
|
||||
|
||||
router:
|
||||
replicaCount: 1
|
||||
image:
|
||||
repository: deepfenceio/deepfence_router
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
forceHttpsRedirect: true
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
service:
|
||||
## useful if deepfence-router chart is not installed
|
||||
create: false
|
||||
# useful for configuring loadbalancer options on supported clouds
|
||||
annotations: {}
|
||||
## service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
|
||||
type: ClusterIP # set service type to cluster ip and enable ingress if available
|
||||
httpsPort: 443
|
||||
httpPort: 80
|
||||
resources:
|
||||
limits:
|
||||
cpu: 3000m
|
||||
memory: 4096Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 3
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
# Use custom ssl certificate for Deepfence UI
|
||||
# custom certificates can be configured using two options
|
||||
# existing secret or base64 encoded cert and key string
|
||||
# provide one off the two options to configure custom certificates
|
||||
tls:
|
||||
# provide secret name which contains tls cert and key
|
||||
# reference: https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets
|
||||
# make sure to create secret in the same namespace as that of the console
|
||||
secretName: ""
|
||||
# embed given cert and key as secret and mount to router pod
|
||||
# provide certificate and key in below example format
|
||||
# cert: |-
|
||||
# -----BEGIN CERTIFICATE-----
|
||||
# MIIFCTCCAvGgAwIBAgIUNshy8GFTjfUR7inZ1JCcN+tDuh4wDQYJKoZIhvcNAQEL
|
||||
# .....
|
||||
# BMepE4d9+TQFcPQ/OKSlP8FB2nPKZJdM+JlXDFWqeKvbdYS4QErRLd33qUmq
|
||||
# -----END CERTIFICATE-----
|
||||
# key: |-
|
||||
# -----BEGIN PRIVATE KEY-----
|
||||
# MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDECeUraonCz/89
|
||||
# .....
|
||||
# bHEvWp7ugCTFhurM+lla0d+ElDO2
|
||||
# -----END PRIVATE KEY-----
|
||||
cert: ""
|
||||
key: ""
|
||||
|
||||
server:
|
||||
replicaCount: 1
|
||||
image:
|
||||
repository: deepfenceio/deepfence_server
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8080
|
||||
internalPort: 8081
|
||||
resources:
|
||||
limits:
|
||||
cpu: 3000m
|
||||
memory: 4096Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 3
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
worker:
|
||||
replicaCount: 1
|
||||
image:
|
||||
repository: deepfenceio/deepfence_worker
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8080
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 8000Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 3
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
ingester:
|
||||
replicaCount: 1
|
||||
image:
|
||||
repository: deepfenceio/deepfence_worker
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8080
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 4096Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 3
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
scheduler:
|
||||
image:
|
||||
repository: deepfenceio/deepfence_worker
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8080
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
ui:
|
||||
replicaCount: 1
|
||||
image:
|
||||
repository: deepfenceio/deepfence_ui
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8081
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 3
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
console_agents:
|
||||
enabled: true
|
||||
cluster_name: "tm-cluster"
|
||||
enableGraphReport: true
|
||||
userDefinedTags: ""
|
||||
instanceIdSuffix: "N"
|
||||
mountContainerRuntimeSocket:
|
||||
dockerSock: false
|
||||
# Change if socket path is not the following
|
||||
dockerSockPath: "/var/run/docker.sock"
|
||||
containerdSock: true
|
||||
# Change if socket path is not the following
|
||||
containerdSockPath: "/run/containerd/containerd.sock"
|
||||
crioSock: false
|
||||
# Change if socket path is not the following
|
||||
crioSockPath: "/var/run/crio/crio.sock"
|
||||
podmanSock: false
|
||||
# Change if socket path is not the following
|
||||
podmanSockPath: "/run/podman/podman.sock"
|
||||
agent:
|
||||
image:
|
||||
repository: deepfenceio/deepfence_agent
|
||||
pullPolicy: Always
|
||||
# Overrides the image tag whose default is .global.imageTag
|
||||
# tag: 2.0.1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 150m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 2048Mi
|
||||
podAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
securityContext: {}
|
||||
nodeSelector: {"kubernetes.io/os": "linux"}
|
||||
tolerations:
|
||||
- operator: "Exists"
|
||||
effect: "NoSchedule"
|
||||
- operator: "Exists"
|
||||
effect: "NoExecute"
|
||||
affinity: {}
|
||||
Reference in New Issue
Block a user