## Aurva Data Plane
## Ref: https://github.com/aurva-io/aurva-charts.git

postgresql:
  enabled: true
  fullnameOverride: "aurva-dataplane-database"
  volumePermissions:
    ## @param volumePermissions.enabled Enable init container that changes the owner and group of the persistent volume
    ##
    enabled: true
  global:
    storageClass: pd-standard-retain-dr
    postgresql:
      auth:
        postgresPassword: "aurva"
        database: "controller"
  # Add toleration to make sure where this postgres db pod should reside (Applicable for production workloads): For more detail ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
  primary:
    extendedConfiguration: |
      max_connections = 300
    
    #PLACEHOLDER##
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: devops

  # -- Select nodes to deploy which matches the following labels
  nodeSelector: ##PLACEHOLDER##
    dedicated: devops

# -- Provide a name in place of `aurva`
# namespaceOverride: aurva-dataplane

##########################################################
# Global Configs
##########################################################
global:
  aurva_controller:
    enabled: true
  aurva_fastdet:
    enabled: false
  aurva_pii_analyzer:
    enabled: true
  aurva_ocr:
    enabled: true
  aurva_collector:
    enabled: false

  deploymentAnnotations: {}

  priorityClassName: ""

##########################################################
# Aurva Controller
##########################################################
aurva_controller:

  # -- Additional labels for aurva-controller
  additionalLabels:
    bu: "admin"
    team: "admin-devops"
    service: "aurva-admin-prd"
    env: "prd"
    priority: "p0"
    type: "aurva_controller"
  
  # -- Annotations on aurva-controller
  annotations: {}
  #  "key": "value"

  revisionHistoryLimit: 3

  # -- no of replicas for aurva controller
  replicas: 10

  # -- Additional label added on pod which is used in Service's Label Selector
  podLabels: {}

  # -- Additional Pod Annotations added on pod created by this Deployment
  additionalPodAnnotations: {}
  #  "key": "value"

  # -- Secrets used to pull image
  imagePullSecrets: ""
  image: 
  # Image of the app container
    repository: asia-south1-docker.pkg.dev/aurva-gcp/aurva-controller/aurva-controller
    tag: "v3.20.3"
    pullPolicy: IfNotPresent

  # Environment variables to be passed to the app container
  env: []

  # -- If want to mount Envs from configmap or secret
  envFrom:
    - type: secret
      name: aurva-controller-secrets
    # - type: configmap
    #   name: proxy-datasource-config

  # -- Resources to be defined for pod
  resources:
    limits:
      memory: 2Gi
      cpu: 2
    requests:
      memory: 1Gi
      cpu: 1

  aurvaFastdet:
    image:
      repository: asia-south1-docker.pkg.dev/aurva-gcp/aurva-fastdet/aurva-fastdet
      tag: "v2.30.13"
      pullPolicy: IfNotPresent
    envFrom: []
    env: []
    resources:
      limits:
        cpu: 0.5
        memory: 512Mi
      requests:
        cpu: 0.5
        memory: 512Mi

  nodeSelector: ##PLACEHOLDER##
    dedicated: devops

  # -- Taint tolerations for nodes
  ##PLACEHOLDER##
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: devops

  # -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
  affinity:
  #  nodeAffinity:
  #    requiredDuringSchedulingIgnoredDuringExecution:
  #      nodeSelectorTerms:
  #      - matchExpressions:
  #        - key: disktype
  #          operator: In
  #          values:
  #          - ssd

  # -- [DNS configuration]
  dnsConfig: {}
  # -- Alternative DNS policy for application controller pods
  dnsPolicy: "ClusterFirst"
  
  secret:
    name: "aurva-controller-secrets"
    # -- Additional Labels on secrets
    additionalLabels:
      # key: value
    # -- Annotations on secrets
    annotations:
      # key: value
    config:
      #variables
      COMPANY_ID: "65eeb832-67ba-40fb-b95a-30ca9eaa3409"
      COMMAND_URL: "command.aurva-prd.meeshogcp.in:80"
      DEPLOYMENT_TYPE: "kubernetes"
      PG_USERNAME: "postgres"
      PG_PASSWORD: "aurva"
      PG_DBNAME: "controller"
      FLUSHER_WORKER_POOL_SIZE: "1000"
      FLUSHER_BATCH_SIZE: "30000"
      UNIQUENESS_IDENTIFIER: "k8s-admin-prd-ase1" #Recommendation: should be equal to cluster name
      PROVIDER_ACCOUNT_ID: "meesho-admin-prd-0622" # GCP PROJECT ID (not Number)
      REGION: "asia-southeast1" #eg: asia-south1
      ENVIRONMENT: "prod"
      OCR_ENABLED: "true"
      MONITORING_ENABLED: "false"
      HYBRID_ONLY_MODE: "false"
      FORCE_TLS: "false"
      FASTDET_FLAG : "true"
      AADHAAR_ENHANCER: "0"
      WORKSPACE_EVENT_TRACKING_ENABLED: "false"
      ACCESS_IQ_ENABLED: "true"
      GRPC_ENFORCE_ALPN_ENABLED: "false"
      ENABLE_FASTDET: "true"
      FASTDET_MAX_BATCH_SIZE: "100"
      HEARTBEAT_INTERVAL: "5m"
      #pii data
      PII_BUCKET_NAME: "gcs-infra-devop-aurva-admin-prd"
      PII_LOG_BUCKET_REGION: "asia-southeast1"
      PII_LOG_CRON: "*/5 * * * *"
      ENABLE_PII_LOG: "true"
      PII_EVIDENCE_UPLOAD_MAX_BLOCKING_TASKS: "50000"
      PII_EVIDENCE_UPLOAD_MAX_CONCURRENT_TASKS: "500"
      PII_EVIDENCE_MAX_CACHE_WEIGHT: "100"
      QUOTA_CLEANUP_CRON: "0 0 * * *"
      ENABLE_PII_QUOTA: "true"
      MAX_PII_EVIDENCES_PER_KEY_PER_WINDOW: "3"
      PII_QUOTA_SYNC_CRON: "*/2 * * * *"
      QUOTA_WINDOW_HOURS: "24"
      #constants
      SKIP_NAMESPACES: "argocd-central-ase1c-prd,argocd-central-prd,argocd-central-prd,argocd-dataengg-prd,argocd-datascience-prd,argocd-demand-prd,argocd-farmiso-prd,argocd-prd,argocd-shared-int,argocd-supply-prd,jenkins"
      CLOUD_PROVIDER: "gcp"
      LOG_ENV: "production"  
      RDS_SCANNER_AVAILABILITY : "false"
      REDSHIFT_SCANNER_AVAILABILITY : "false"
      S3_SCANNER_AVAILABILITY : "false"
      DYNAMO_SCANNER_AVAILABILITY: "false"
      DOCDB_SCANNER_AVAILABILITY: "false"
      OPENSEARCH_SCANNER_AVAILABILITY: "false"
      CLOUDSQL_SCANNER_AVAILABILITY: "true"
      BIGQUERY_SCANNER_AVAILABILITY: "true"
      AWS_SNAPSHOT_SCANNER_AVAILABILITY: "false"
      CLOUDSTORAGE_SCANNER_AVAILABILITY: "true"
      KEYSPACES_SCANNER_AVAILABILITY: "false"
      ALLOYDB_SCANNER_AVAILABILITY: "true"
      BIGTABLE_SCANNER_AVAILABILITY: "true"
      GCP_BACKUP_AVAILABILITY: "true"
      EGRESS_MODE_ONLY: "false"
      SENTRY_DSN: "https://fd6738e1ee4a9a9c1f079d09953b43b1@sentry.aurva.io/4"
      SCAN_UUID_ENABLED: "true"
      
  serviceAccount:
    # -- Create a service account for the aurva controller
    create: true
    # -- Service account name
    name: aurva-controller-sa
    # -- Annotations applied to created service account
    annotations:
      iam.gke.io/gcp-service-account: sa-admin-prd-aurva-contr@meesho-admin-prd-0622.iam.gserviceaccount.com
#      eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
    # -- Labels applied to created service account
    labels: {}
  autoscaling:
    enabled: true
    minReplicas: 10
    maxReplicas: 15
    metrics:
      - type: Resource
        resource:
          name: cpu
          target:
            type: Utilization
            averageUtilization: 70
      - type: Resource
        resource:
          name: memory
          target:
            type: Utilization
            averageUtilization: 70


##########################################################
# Aurva OCR
##########################################################
aurva_ocr:
  # -- Additional labels for aurva-controller
  additionalLabels:
    bu: "admin"
    team: "admin-devops"
    service: "aurva-admin-prd"
    env: "prd"
    priority: "p0"
    type: "aurva_ocr"

  # -- Annotations on aurva-controller
  annotations: {}
  #  "key": "value"

  revisionHistoryLimit: 3

  # -- no of replicas for aurva controller
  replicas: 1

  # -- Additional label added on pod which is used in Service's Label Selector
  podLabels: {}

  # -- Additional Pod Annotations added on pod created by this Deployment
  additionalPodAnnotations: {}
  #  "key": "value"

  # -- Secrets used to pull image
  imagePullSecrets: ""

  # Image of the app container
  image:
    repository: asia-south1-docker.pkg.dev/aurva-gcp/aurva-ocr/aurva-ocr
    tag: "v3.20.3"
    pullPolicy: IfNotPresent

  # Environment variables to be passed to the app container
  env: []

  # -- If want to mount Envs from configmap or secret
  envFrom:
    aurva-ocr:
      type: secret
      name: aurva-ocr-secrets

  # -- Resources to be defined for pod
  resources:
    limits:
      memory: 2Gi
      cpu: 1
    requests:
      memory: 2Gi
      cpu: 1

  # -- Select nodes to deploy which matches the following labels

  nodeSelector: ##PLACEHOLDER##
    dedicated: devops

  ##PLACEHOLDER##
  # -- Taint tolerations for nodes
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: devops

  # -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
  affinity:
  #  nodeAffinity:
  #    requiredDuringSchedulingIgnoredDuringExecution:
  #      nodeSelectorTerms:
  #      - matchExpressions:
  #        - key: disktype
  #          operator: In
  #          values:
  #          - ssd

  # -- [DNS configuration]
  dnsConfig: {}
  # -- Alternative DNS policy for application controller pods
  dnsPolicy: "ClusterFirst"

  secret:
    name: "aurva-ocr-secrets"
    # -- Additional Labels on secrets
    additionalLabels:
    # key: value
    # -- Annotations on secrets
    annotations:
    # key: value

    config:
      PG_USERNAME: "postgres"
      PG_PASSWORD: "aurva"
      PG_DBNAME: "controller"
      OCR_TIME_LIMIT: "1"
      COMPANY_ID: "65eeb832-67ba-40fb-b95a-30ca9eaa3409"
      UNIQUENESS_IDENTIFIER: "k8s-admin-prd-ase1"
      DEPLOYMENT_TYPE: "kubernetes"

  serviceAccount:
    # -- Create a service account for the aurva controller
    create: true
    # -- Service account name
    name: aurva-ocr-sa
    # -- Annotations applied to created service account
    annotations:
    # eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
    # iam.gke.io/gcp-service-account: service-account@gcp.iam.gserviceaccount.com
    # -- Labels applied to created service account
    labels: {}

##########################################################
# Aurva Collector
##########################################################
aurva_collector:

  # -- Additional labels for aurva-analyzer
  additionalLabels:
    bu: "admin"
    team: "admin-devops"
    service: "aurva-admin-prd"
    env: "prd"
    priority: "p0"
    type: "aurva_collector"

  
  # -- Annotations on aurva-analyzer
  annotations: {}
#    "key": "value"

  # -- Additional label added on pod which is used in Service's Label Selector
  podLabels: {}

  # -- Additional Pod Annotations added on pod created by this Deployment
  additionalPodAnnotations: {}
  #  "key": "value"

  # -- Secrets used to pull image
  imagePullSecrets: ""

  # Image of the app container
  image: 
    repository: asia-south1-docker.pkg.dev/aurva-gcp/aurva-collector/aurva-collector
    tag: "v3.20.3"
    pullPolicy: IfNotPresent

  # Environment variables to be passed to the app container
  env: []
    
  # -- If want to mount Envs from configmap or secret
  envFrom:
    aurva-controller:
      type: secret
      name: aurva-collector-secrets

  resources:
    limits:
      cpu: 800m
      memory: 800Mi
    requests:
      cpu: 200m
      memory: 512Mi

  podSecurityContext: {}

  securityContext:
    privileged: true
    capabilities:
      add:
      # For kernel v5.8 and above we don't need CAP_SYS_ADMIN or CAP_SYS_RESOURCE
      #  we just need CAP_BPF and CAP_PERFMON. This has been tested on our EKS node
      #  which is on kernel v5.10.x
      # When SSL Tracing is required we need CAP_SYS_ADMIN and CAP_SYS_PTRACE
      #  on top of the previous capabilities
      # So finally these are the 4 possible combinations for capabilies
      #  1. Newer Kernels without SSL
      # - BPF
      # - PERFMON
      # 2. Newer Kernels with SSL
      - SYS_ADMIN
      - SYS_PTRACE
      # 3. Older Kernels without SSL
      # - SYS_ADMIN
      # - SYS_RESOURCE
      # 4. Older Kernels with SSL
      # - SYS_ADMIN
      # - SYS_RESOURCE
      # - SYS_PTRACE
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  volumes:
    - name: debugfs
      mountPath: /sys/kernel/debug
      hostPath: /sys/kernel/debug
    - name: vmlinux
      mountPath: /sys/kernel/btf/vmlinux
      hostPath: /sys/kernel/btf/vmlinux
    - name: procfs
      mountPath: /host/proc
      hostPath: /proc
    - name: bpffs
      mountPath: /sys/fs/bpf
      hostPath: /sys/fs/bpf

  # -- Taint tolerations for nodes
  tolerations:
    # - effect: NoSchedule
    #   key: dedicated
    #   operator: Equal
    #   value: megatetra
    - operator: Exists

  # -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
  affinity:
   nodeAffinity:
     requiredDuringSchedulingIgnoredDuringExecution:
       nodeSelectorTerms:
       - matchExpressions:
         - key: dedicated
           operator: NotIn
           values:
            - vmstorage
            - vmselect
            - vmagent
            - vminsert
            - contour-internal-0
            - contour-internal-1
            - contour-external
            - alloy
            - preprod-spot-16
  dnsPolicy: "ClusterFirst"

  secret:
    name: "aurva-collector-secrets"
    # -- Additional Labels on secrets
    additionalLabels:
    #  key: value
    # -- Annotations on secrets
    annotations:
    #  key: value

    config:
      # variables
      COMPANY_ID: "65eeb832-67ba-40fb-b95a-30ca9eaa3409"
      UNIQUENESS_IDENTIFIER: "k8s-admin-prd-ase1"
      DEPLOYMENT_TYPE: "kubernetes"
      TRACE_INTERNAL_SVC: "true"
      TRACE_INTERNAL_SVC_HTTP: "true"
      INTERNAL_SVC_SAMPLE_INTERVAL: "10m"
      LOGS_TTL: "1h"
      TRACE_HTTP2: "true"
      TRACE_SSL: "false"
      TRACE_PSQL: "false"
      TRACE_SQLSERVER: "false"
      TRACE_MYSQL: "false"
      TRACE_EGRESS: "true"
      TRACE_GO_TLS: "false"
      TRACE_ML_SERVICES: "false"
      # constants
      LOG_ENV: production
      SENTRY_DSN: "https://fd6738e1ee4a9a9c1f079d09953b43b1@sentry.aurva.io/4"
      MONITORING_ENABLED: "false"
      ENABLE_INGRESS_INFORMER: "false"
      ENABLE_SERVICE_INFORMER: "false"
      ENABLE_ISTIO_INFORMER: "false"
      EXCLUDED_PII_REGEX_TYPES: "ip_address,us_bank_number,us_driver_license,us_itin,us_passport,us_routing,us_mbi,ssn"
      AGGREGATOR_MAX_CONNECTIONS: "1000"

  serviceAccount:
    # -- Create a service account for the aurva controller
    create: true
    # -- Service account name
    name: aurva-collector-sa
    # -- Annotations applied to created service account
    annotations:
      # eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
    # -- Labels applied to created service account
    labels: {}

##########################################################
# Aurva PII Analyzer
##########################################################
aurva_pii_analyzer:

  # -- Additional labels for aurva-controller
  additionalLabels:
    bu: "admin"
    team: "admin-devops"
    service: "aurva-admin-prd"
    env: "prd"
    priority: "p0"
    type: "aurva_pii_analyzer"

  # -- Annotations on aurva-controller
  annotations: {}
  #  "key": "value"

  revisionHistoryLimit: 3

  # -- no of replicas for aurva controller
  replicas: 3

  # -- Additional label added on pod which is used in Service's Label Selector
  podLabels: {}

  # -- Additional Pod Annotations added on pod created by this Deployment
  additionalPodAnnotations: {}
  #  "key": "value"

  # -- Secrets used to pull image
  imagePullSecrets: ""

  ##PLACEHOLDER##
  nodeSelector:
    dedicated: devops
  
  # Image of the app container
  image:
    repository: asia-south1-docker.pkg.dev/aurva-gcp/aurva-piianalyzer/aurva-piianalyzer
    tag: "v3.20.3"
    pullPolicy: IfNotPresent

  # Environment variables to be passed to the app container
  env: []

  # -- If want to mount Envs from configmap or secret
  envFrom:
    aurva-pii-analyzer:
      type: secret
      name: aurva-pii-analyzer-secrets

  # -- Resources to be defined for pod
  resources:
    limits:
      memory: 4Gi
      cpu: 4
    requests:
      memory: 2Gi
      cpu: 2

  nodeSelector: ##PLACEHOLDER##
    dedicated: devops

  ##PLACEHOLDER##
  # -- Taint tolerations for nodes
  tolerations:
    - effect: NoSchedule
      key: dedicated
      operator: Equal
      value: devops

  # -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
  affinity:
  #  nodeAffinity:
  #    requiredDuringSchedulingIgnoredDuringExecution:
  #      nodeSelectorTerms:
  #      - matchExpressions:
  #        - key: disktype
  #          operator: In
  #          values:
  #          - ssd

  # -- [DNS configuration]
  dnsConfig: {}
  # -- Alternative DNS policy for application controller pods
  dnsPolicy: "ClusterFirst"

  secret:
    name: "aurva-pii-analyzer-secrets"
    # -- Additional Labels on secrets
    additionalLabels:
    # key: value
    # -- Annotations on secrets
    annotations:
    # key: value

    config:
      PG_USERNAME: "postgres"
      PG_PASSWORD: "aurva"
      PG_DBNAME: "controller"
      SCHEDULER_TIME: "1"
      SUPPORTED_REGION: "US"
      COMPANY_ID: "65eeb832-67ba-40fb-b95a-30ca9eaa3409"
      UNIQUENESS_IDENTIFIER: "k8s-admin-prd-ase1"
      DEPLOYMENT_TYPE: "kubernetes"

  serviceAccount:
    # -- Create a service account for the aurva controller
    create: true
    # -- Service account name
    name: aurva-pii-analyzer-sa
    # -- Annotations applied to created service account
    annotations:
    #  eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
    # -- Labels applied to created service account
    labels: {}

  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 3
    metrics:
      - type: Resource
        resource:
          name: cpu
          target:
            type: Utilization
            averageUtilization: 70
      - type: Resource
        resource:
          name: memory
          target:
            type: Utilization
            averageUtilization: 70