# Default values for deepfence-router.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

nameOverride: ""
fullnameOverride: ""

# Configure port for browser / agents
managementConsolePort: "443"

service:
  name: deepfence-console-router
  # Select the type of service to be used. 
  # When exposing the service in an on premisses Kubernetes cluster, select NodePort as type
  # Also, possible to use Ingress as type when ingress controller is installed
  type: LoadBalancer # LoadBalancer/NodePort/Ingress/ClusterIP
  # NodePort configuration. Only used when the service type is NodePort
  nodePortHttps: ""
  nodePortHttp: ""
  #  Using static ip address for load balancer
  # - Google Cloud: https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip
  # loadBalancerIP: "1.2.3.4"
  # - Azure: https://docs.microsoft.com/en-us/azure/aks/static-ip
  # loadBalancerIP: "1.2.3.4"
  loadBalancerIP: ""
  # If loadBalancerType is "external", we recommend setting loadBalancerSourceRanges
  # to the ip address / CIDR ranges of your laptop's ip or corporate CIDR range. 
  # If this is set empty, ports 443 and 80 will be open to the public internet.
  # Example: ["143.231.0.0/16","210.57.79.18/32"]
  loadBalancerSourceRanges: []

  # externalIPs: When kubernetes is not cloud managed, add public ip addresses of kubernetes nodes to externalIPs
  externalIPs: []
  externalTrafficPolicy: "Cluster"

  annotations:
    ## aws
    ## as default aws creates classic load balancer, to change to nlb use below annotation
    ## https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"

    ## Static ip for NLB
    ## https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html
    ## Example: "eipalloc-0123456789abcdefg,eipalloc-0123456789hijklmn"
    # service.beta.kubernetes.io/aws-load-balancer-eip-allocations: ""

    ## ACM SSL certificate for AWS Classic LoadBalancer
    ## This cannot be set if aws-load-balancer-eip-allocations is set
    ## https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
    ## https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/
    ## Example: "arn:aws:acm:{region}:{user id}:certificate/{id}"
    # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ""
    # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "https"
    # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"

    ## if internal load balancer is required
    ## set this based on cloud provider

    ## aws
    ## https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
    # service.beta.kubernetes.io/aws-load-balancer-internal: "true"

    ## azure
    # service.beta.kubernetes.io/azure-load-balancer-internal: "true"

    ## gcp
    # networking.gke.io/load-balancer-type: "Internal"
    # cloud.google.com/load-balancer-type: "Internal"
    # cloud.google.com/app-protocols: '{"https-port":"HTTPS","http-port":"HTTP"}'

    ## ibm cloud
    # service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: "private"

    ## openstack
    # service.beta.kubernetes.io/openstack-internal-load-balancer: "true"


# User can create separate k8s service for agents if required.
# One use case for this is to deploy external load balancer for browser access for management console and internal load balancer for agent communication.
createSeparateServiceForAgents: false

agentService:
  # Configuration service accessed by agents
  name: deepfence-agent-router
  type: LoadBalancer # LoadBalancer/NodePort/Ingress/ClusterIP
  #  Using static ip address for load balancer
  # - Google Cloud: https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip
  # loadBalancerIP: "1.2.3.4"
  # - Azure: https://docs.microsoft.com/en-us/azure/aks/static-ip
  # loadBalancerIP: "1.2.3.4"
  loadBalancerIP: ""
  # If loadBalancerType is "external", we recommend setting loadBalancerSourceRanges to the ip address / CIDR ranges
  # of your laptop's ip or corporate CIDR range. If this is set empty, ports 443 and 80 will be open to the public internet.
  # Example: ["143.231.0.0/16","210.57.79.18/32"]
  loadBalancerSourceRanges: []
  # externalIPs: When kubernetes is not cloud managed, add public ip addresses of kubernetes nodes to externalIPs
  externalIPs: []
  externalTrafficPolicy: "Cluster"

  annotations:
    ## aws
    ## as default aws creates classic load balancer, to change to nlb use below annotation
    ## https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"

    ## Static ip for NLB
    ## https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html
    ## Example: "eipalloc-0123456789abcdefg,eipalloc-0123456789hijklmn"
    # service.beta.kubernetes.io/aws-load-balancer-eip-allocations: ""

    ## ACM SSL certificate for AWS Classic LoadBalancer
    ## This cannot be set if aws-load-balancer-eip-allocations is set
    ## https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
    ## https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/
    ## Example: "arn:aws:acm:{region}:{user id}:certificate/{id}"
    # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ""
    # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "https"
    # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"

    ## https://kubernetes.io/docs/concepts/services-networking/service/#other-elb-annotations
    ## if internal load balancer is required
    ## set this based on cloud provider

    ## aws
    ## https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
    # service.beta.kubernetes.io/aws-load-balancer-internal: "true"

    ## azure
    # service.beta.kubernetes.io/azure-load-balancer-internal: "true"

    ## gcp
    # networking.gke.io/load-balancer-type: "Internal"
    # cloud.google.com/load-balancer-type: "Internal"
    # cloud.google.com/app-protocols: '{"https-port":"HTTPS","http-port":"HTTP"}'

    ## ibm cloud
    # service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: "private"

    ## openstack
    # service.beta.kubernetes.io/openstack-internal-load-balancer: "true"


# ingress configuration for console
ingress:
  ## name of the ingress class for ingress provider installed on the cluster, cannot be empty
  ## Example: nginx
  class: nginx
  ## host example: threat.example.com
  host: ""
  ## annotations to customize ingress
  annotations:
    ## nginx ingress annotations
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 200m

    ## gke ingress
    # kubernetes.io/ingress.class: gce
    ## use the below annotation to attach gke managed certificate
    ## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#gcloud
    # networking.gke.io/managed-certificates: <managed certificate name>

    ## aws alb annotations
    ## aws load balancer controller needs to be installed on the cluster for these annotations to work
    ## documentation aws load balancer controller https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/
    # alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
    # alb.ingress.kubernetes.io/backend-protocol: HTTPS
    ## arn of the certificate available on aws certificate manager
    # alb.ingress.kubernetes.io/certificate-arn: ""
    # alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
    # alb.ingress.kubernetes.io/scheme: internet-facing
    # alb.ingress.kubernetes.io/target-group-attributes: stickiness.enabled=true,stickiness.lb_cookie.duration_seconds=3600
    # alb.ingress.kubernetes.io/target-type: ip