# Default values for deepfence-console.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

nameOverride: ""
fullnameOverride: "sec-admin-deepfence-console"

global:
  imageRepoPrefix: "quay.io"
  # imageRepoPrefix: "docker.io"
  # this image tag is used everywhere for console services
  # to override set tag at service level
  imageTag: 2.1.0
  storageClass: "standard-rwo"

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

imagePullSecret:
  # Specifies whether a image pull secret should be created
  create: true
  registry: "quay.io"
  # registry: "https://index.docker.io/v1/"
  username: "deepfenceio+meesho_com"
  password: "KM8X1CZGMXAJ4IRS8DDM8RIPZDFAYGBUGI78YFEJXBA1RCNY0GIBW10N7KNHOYS2"
  # The name of the imagePullSecret to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

kafka:
  # Specifies whether a kafka cluster should be created
  create: true
  # if create false provide name of the existing secret
  # secret format refer templates/console-secrets/kafka.yaml
  secretName: ""
  # if create true then below values are used to create kafka cluster
  replicaCount: 1 # recommended 3 for high availability kafka
  image:
    repository: deepfenceio/deepfence_kafka_broker
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  config:
    # required, recommended to generate new UUID using kafka-storage tool
    STORAGE_UUID: hNQ55qppT5GGybF52ZGlOQ
  storageClass: ""
  volumeSize: 50G
  resources:
    limits:
      cpu: 4000m
      memory: 8192Mi
    requests:
      cpu: 500m
      memory: 1024Mi
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

postgres:
  # Specifies whether a postgres database instance should be created
  create: true
  # if create false provide name of the existing secret
  # secret format refer templates/deepfence-console-secrets/postgres.yaml
  secretName: ""
  # if create true then below values are used to create postgres database instance
  secrets:
    POSTGRES_PASSWORD: deepfence
    POSTGRES_USER: deepfence
    POSTGRES_DB: users
  image:
    repository: deepfenceio/deepfence_postgres
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  storageClass: ""
  volumeSize: 50G
  resources:
    limits:
      cpu: 2000m
      memory: 2048Mi
    requests:
      cpu: 200m
      memory: 512Mi
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

redis:
  # Specifies whether a postgres database instance should be created
  create: true
  # if create false provide name of the existing secret
  # secret format refer templates/console-secrets/redis.yaml
  secretName: ""
  # if create true then below values are used to create postgres database instance
  image:
    repository: deepfenceio/deepfence_redis
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  storageClass: ""
  volumeSize: 10G
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 100m
      memory: 128Mi
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

fileserver:
  # Specifies whether a file server instance should be created
  # set this to false if using S3
  create: true
  # if create false provide name of the existing secret
  # secret format refer templates/console-secrets/minio.yaml
  secretName: ""
  # if create true then below values are used to create postgres database instance
  secrets:
    MINIO_ROOT_USER: deepfence
    MINIO_ROOT_PASSWORD: deepfence
  image:
    repository: deepfenceio/deepfence_file_server
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  storageClass: ""
  volumeSize: 50G
  resources:
    limits:
      cpu: 2000m
      memory: 4096Mi
    requests:
      cpu: 100m
      memory: 128Mi
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

# these values are used if fileserver.create=false
aws_s3_buckets:
  # Specifies whether secret should be created
  create: false
  # if create false provide name of the existing secret
  # secret format refer templates/deepfence-console-secrets/s3.yaml
  secretName: ""
  # public bucket with read permisons on objects for hosting vulnerability database
  # S3 bucket permissions {"Version":"2012-10-17","Statement":[{"Sid":"database","Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":["arn:aws:s3:::<bucket-name>/database/*","arn:aws:s3:::<bucket-name>/database"]}]}
  vulnerability_db_bucket: ""
  # prvate bucket to host reports, sbom, etc.
  data_bucket: ""
  # aws credentials to access buckets
  access_key_id : ""
  secret_access_key: ""
  # region where the buckets are hosted ex: ap-south-1
  region: ""

neo4j:
  # Specifies whether a neo4j database instance should be created
  create: true
  # if create false provide name of the existing secret
  # secret format refer templates/console-secrets/neo4j.yaml
  secretName: ""
  # if create true then below values are used to create neo4j database instance
  secrets:
    # format should be username/password
    NEO4J_AUTH: neo4j/e16908ffa5b9f8e9d4ed
    # To enable periodic backup of neo4j database to S3, please set the values below
    # AWS_ACCESS_KEY: ""
    # AWS_SECRET_KEY: ""
    # DF_REMOTE_BACKUP_ROOT: "" # S3 bucket name
  config:
    NEO4J_dbms_memory_pagecache_size: 2600m
    NEO4JLABS_PLUGINS: '["apoc"]'
  image:
    repository: deepfenceio/deepfence_neo4j
    pullPolicy: Always
    # tag: 2.0.1
  storageClass: ""
  volumeSize: 50G
  resources:
    limits:
      cpu: 4000m
      memory: 16Gi
    requests:
      cpu: 1000m
      memory: 2048Mi
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

# ingress for console
ingress:
  enable: false
  ## name of the ingress class for ingress provider installed on the cluster, cannot be empty
  ## Example: nginx
  class: nginx
  ## host example: threat.example.com
  host: ""
  ## annotations to customize ingress
  annotations:
    ## nginx ingress annotations
    ## https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 200m

    ## aws alb annotations
    ## aws load balancer controller needs to be installed on the cluster for these annotations to work
    ## documentation aws load balancer controller https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/
    # alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
    # alb.ingress.kubernetes.io/backend-protocol: HTTPS
    ## arn of the certificate available on aws certificate manager
    # alb.ingress.kubernetes.io/certificate-arn: ""
    # alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
    # alb.ingress.kubernetes.io/scheme: internet-facing
    # alb.ingress.kubernetes.io/target-group-attributes: stickiness.enabled=true,stickiness.lb_cookie.duration_seconds=3600
    # alb.ingress.kubernetes.io/target-type: ip

router:
  replicaCount: 1
  image:
    repository: deepfenceio/deepfence_router
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  forceHttpsRedirect: true
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  service:
    ## useful if deepfence-router chart is not installed
    create: false
    # useful for configuring loadbalancer options on supported clouds
    annotations: {}
    ## service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
    type: ClusterIP # set service type to cluster ip and enable ingress if available
    httpsPort: 443
    httpPort: 80
  resources:
    limits:
      cpu: 3000m
      memory: 4096Mi
    requests:
      cpu: 100m
      memory: 128Mi
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}
  # Use custom ssl certificate for Deepfence UI
  # custom certificates can be configured using two options
  # existing secret or base64 encoded cert and key string
  # provide one off the two options to configure custom certificates
  tls:
    # provide secret name which contains tls cert and key
    # reference: https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets
    # make sure to create secret in the same namespace as that of the console
    secretName: ""
    # embed given cert and key as secret and mount to router pod
    # provide certificate and key in below example format
    # cert: |-
    #   -----BEGIN CERTIFICATE-----
    #   MIIFCTCCAvGgAwIBAgIUNshy8GFTjfUR7inZ1JCcN+tDuh4wDQYJKoZIhvcNAQEL
    #   .....
    #   BMepE4d9+TQFcPQ/OKSlP8FB2nPKZJdM+JlXDFWqeKvbdYS4QErRLd33qUmq
    #   -----END CERTIFICATE-----
    # key: |-
    #   -----BEGIN PRIVATE KEY-----
    #   MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDECeUraonCz/89
    #   .....
    #   bHEvWp7ugCTFhurM+lla0d+ElDO2
    #   -----END PRIVATE KEY-----
    cert: ""
    key: ""

server:
  replicaCount: 1
  image:
    repository: deepfenceio/deepfence_server
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  service:
    type: ClusterIP
    port: 8080
    internalPort: 8081
  resources:
    limits:
      cpu: 3000m
      memory: 4096Mi
    requests:
      cpu: 250m
      memory: 256Mi
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

worker:
  replicaCount: 1
  image:
    repository: deepfenceio/deepfence_worker
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  service:
    type: ClusterIP
    port: 8080
  resources:
    limits:
      cpu: 2000m
      memory: 8000Mi
    requests:
      cpu: 250m
      memory: 256Mi
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

ingester:
  replicaCount: 1
  image:
    repository: deepfenceio/deepfence_worker
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  service:
    type: ClusterIP
    port: 8080
  resources:
    limits:
      cpu: 2000m
      memory: 4096Mi
    requests:
      cpu: 100m
      memory: 128Mi
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

scheduler:
  image:
    repository: deepfenceio/deepfence_worker
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  service:
    type: ClusterIP
    port: 8080
  resources:
    limits:
      cpu: 1000m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 128Mi
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

ui:
  replicaCount: 1
  image:
    repository: deepfenceio/deepfence_ui
    pullPolicy: Always
    # Overrides the image tag whose default is .global.imageTag
    # tag: 2.0.1
  service:
    type: ClusterIP
    port: 8081
  resources:
    limits:
      cpu: 1000m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 128Mi
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  nodeSelector: {}
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: deepfence
  affinity: {}

console_agents:
  enabled: false
  cluster_name: "tm-cluster"
  enableGraphReport: true
  userDefinedTags: ""
  instanceIdSuffix: "N"
  mountContainerRuntimeSocket:
    dockerSock: false
    # Change if socket path is not the following
    dockerSockPath: "/var/run/docker.sock"
    containerdSock: true
    # Change if socket path is not the following
    containerdSockPath: "/run/containerd/containerd.sock"
    crioSock: false
    # Change if socket path is not the following
    crioSockPath: "/var/run/crio/crio.sock"
    podmanSock: false
    # Change if socket path is not the following
    podmanSockPath: "/run/podman/podman.sock"
  agent:
    image:
      repository: deepfenceio/deepfence_agent
      pullPolicy: Always
      # Overrides the image tag whose default is .global.imageTag
      # tag: 2.0.1
    resources:
      requests:
        cpu: 150m
        memory: 512Mi
      limits:
        cpu: 1500m
        memory: 2048Mi
    podAnnotations: {}
    podSecurityContext: {}
    securityContext: {}
    nodeSelector: {"kubernetes.io/os": "linux"}
    tolerations:
      - operator: "Exists"
        effect: "NoSchedule"
      - operator: "Exists"
        effect: "NoExecute"
    affinity: {}