630 lines
16 KiB
YAML
630 lines
16 KiB
YAML
## Aurva Data Plane
|
|
## Ref: https://github.com/aurva-io/aurva-charts.git
|
|
|
|
|
|
postgresql:
|
|
enabled: true
|
|
fullnameOverride: "aurva-dataplane-database"
|
|
global:
|
|
postgresql:
|
|
auth:
|
|
postgresPassword: "aurva"
|
|
database: "controller"
|
|
# Add toleration to make sure where this postgres db pod should reside (Applicable for production workloads): For more detail ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
|
|
primary:
|
|
extendedConfiguration: |
|
|
max_connections = 300
|
|
tolerations:
|
|
# - key: "dedicated"
|
|
# operator: "Equal"
|
|
# value: "app"
|
|
# effect: "NoSchedule"
|
|
|
|
# -- Provide a name in place of `aurva`
|
|
# namespaceOverride: aurva-dataplane
|
|
|
|
|
|
##########################################################
|
|
# Global Configs
|
|
##########################################################
|
|
global:
|
|
|
|
aurva_controller:
|
|
enabled: true
|
|
aurva_pii_analyzer:
|
|
enabled: true
|
|
aurva_ocr:
|
|
enabled: true
|
|
aurva_collector:
|
|
enabled: true
|
|
aurva_proxy:
|
|
enabled: false
|
|
|
|
|
|
deploymentAnnotations: {}
|
|
|
|
priorityClassName: ""
|
|
|
|
##########################################################
|
|
# Aurva Controller
|
|
##########################################################
|
|
aurva_controller:
|
|
|
|
# -- Additional labels for aurva-controller
|
|
additionalLabels: {}
|
|
|
|
# -- Annotations on aurva-controller
|
|
annotations: {}
|
|
# "key": "value"
|
|
|
|
revisionHistoryLimit: 3
|
|
|
|
# -- no of replicas for aurva controller
|
|
replicas: 4
|
|
|
|
# -- Additional label added on pod which is used in Service's Label Selector
|
|
podLabels: {}
|
|
|
|
# -- Additional Pod Annotations added on pod created by this Deployment
|
|
additionalPodAnnotations: {}
|
|
# "key": "value"
|
|
|
|
|
|
# -- Secrets used to pull image
|
|
imagePullSecrets: ""
|
|
|
|
# Image of the app container
|
|
image:
|
|
repository: 119191042565.dkr.ecr.ap-south-1.amazonaws.com/aurva-controller
|
|
tag: "v1.5.8-pre2"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Environment variables to be passed to the app container
|
|
env:
|
|
- name: NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: spec.nodeName
|
|
- name: NODE_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: status.hostIP
|
|
|
|
# -- If want to mount Envs from configmap or secret
|
|
envFrom:
|
|
aurva-controller:
|
|
type: secret
|
|
name: aurva-controller-secrets
|
|
|
|
# -- Resources to be defined for pod
|
|
resources:
|
|
limits:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 0.5
|
|
|
|
|
|
# -- Select nodes to deploy which matches the following labels
|
|
nodeSelector:
|
|
# cloud.google.com/gke-nodepool: default-pool
|
|
# schedule-on: app-workload
|
|
|
|
|
|
# -- Taint tolerations for nodes
|
|
tolerations:
|
|
# - key: "dedicated"
|
|
# operator: "Equal"
|
|
# value: "app"
|
|
# effect: "NoSchedule"
|
|
|
|
# -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
|
|
affinity:
|
|
# nodeAffinity:
|
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
|
# nodeSelectorTerms:
|
|
# - matchExpressions:
|
|
# - key: disktype
|
|
# operator: In
|
|
# values:
|
|
# - ssd
|
|
|
|
# -- [DNS configuration]
|
|
dnsConfig: {}
|
|
# -- Alternative DNS policy for application controller pods
|
|
dnsPolicy: "ClusterFirst"
|
|
|
|
secret:
|
|
name: "aurva-controller-secrets"
|
|
# -- Additional Labels on secrets
|
|
additionalLabels:
|
|
# key: value
|
|
# -- Annotations on secrets
|
|
annotations:
|
|
# key: value
|
|
|
|
config:
|
|
COMPANY_ID: "47c5ed30-c23e-48c3-a510-9c9378867737"
|
|
PG_USERNAME: "postgres"
|
|
PG_PASSWORD: "aurva"
|
|
PG_DBNAME: "controller"
|
|
AWS_REGION: "ap-south-1"
|
|
COMMAND_URL: "command.uat.aurva.io:443" # Please update this with ingress URL of command
|
|
ENVIRONMENT: "uat"
|
|
PROVIDER_ACCOUNT_ID: "918749230"
|
|
LOG_ENV: "production"
|
|
RDS_SCANNER_AVAILABILITY : "true"
|
|
REDSHIFT_SCANNER_AVAILABILITY : "true"
|
|
S3_SCANNER_AVAILABILITY : "true"
|
|
EGRESS_MODE_ONLY: "false"
|
|
|
|
serviceAccount:
|
|
# -- Create a service account for the aurva controller
|
|
create: true
|
|
# -- Service account name
|
|
name: aurva-controller-sa
|
|
# -- Annotations applied to created service account
|
|
annotations:
|
|
# eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
|
|
# -- Labels applied to created service account
|
|
labels: {}
|
|
|
|
##########################################################
|
|
# Aurva Collector
|
|
##########################################################
|
|
aurva_collector:
|
|
|
|
# -- Additional labels for aurva-analyzer
|
|
additionalLabels: {}
|
|
# "key": "value"
|
|
|
|
# -- Annotations on aurva-analyzer
|
|
annotations: {}
|
|
# "key": "value"
|
|
|
|
# -- Additional label added on pod which is used in Service's Label Selector
|
|
podLabels: {}
|
|
|
|
# -- Additional Pod Annotations added on pod created by this Deployment
|
|
additionalPodAnnotations: {}
|
|
# "key": "value"
|
|
|
|
# -- Secrets used to pull image
|
|
imagePullSecrets: ""
|
|
|
|
# Image of the app container
|
|
image:
|
|
repository: 119191042565.dkr.ecr.ap-south-1.amazonaws.com/aurva-collector
|
|
tag: "v1.5.8-pre2"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Environment variables to be passed to the app container
|
|
env: []
|
|
|
|
# -- If want to mount Envs from configmap or secret
|
|
envFrom:
|
|
aurva-controller:
|
|
type: secret
|
|
name: aurva-collector-secrets
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 400m
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
|
|
podSecurityContext: {}
|
|
|
|
securityContext:
|
|
privileged: false
|
|
capabilities:
|
|
add:
|
|
# For kernel v5.8 and above we don't need SYS_ADMIN or SYS_RESOURCE
|
|
# we just need CAP_BPF and CAP_PERFMON. This has been tested on our EKS node
|
|
# which is on kernel v5.10.x
|
|
# - BPF
|
|
# - PERFMON
|
|
- SYS_ADMIN
|
|
- SYS_RESOURCE
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
volumes:
|
|
- name: sys-kernal-debug
|
|
mountPath: /sys/kernel/debug
|
|
hostPath: /sys/kernel/debug
|
|
- name: sys-kernal-btf
|
|
mountPath: /sys/kernel/btf/vmlinux
|
|
hostPath: /sys/kernel/btf/vmlinux
|
|
|
|
# -- Select nodes to deploy which matches the following labels
|
|
nodeSelector:
|
|
# cloud.google.com/gke-nodepool: default-pool
|
|
# schedule-on: app-workload
|
|
|
|
|
|
# -- Taint tolerations for nodes
|
|
tolerations:
|
|
- operator: Exists
|
|
|
|
# -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
|
|
affinity:
|
|
# nodeAffinity:
|
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
|
# nodeSelectorTerms:
|
|
# - matchExpressions:
|
|
# - key: disktype
|
|
# operator: In
|
|
# values:
|
|
# - ssd
|
|
dnsPolicy: "ClusterFirst"
|
|
|
|
secret:
|
|
name: "aurva-collector-secrets"
|
|
# -- Additional Labels on secrets
|
|
additionalLabels:
|
|
# key: value
|
|
# -- Annotations on secrets
|
|
annotations:
|
|
# key: value
|
|
|
|
config:
|
|
COMPANY_ID: ""
|
|
DEPLOYMENT_TYPE: kubernetes
|
|
LOG_ENV: production
|
|
TRACE_EGRESS: "true"
|
|
TRACE_PSQL: "false"
|
|
SKIP_NAMESPACES: "aurva-dataplane,kube-system,default"
|
|
|
|
serviceAccount:
|
|
# -- Create a service account for the aurva controller
|
|
create: true
|
|
# -- Service account name
|
|
name: aurva-controller-sa
|
|
# -- Annotations applied to created service account
|
|
annotations:
|
|
# eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
|
|
# -- Labels applied to created service account
|
|
labels: {}
|
|
|
|
##########################################################
|
|
# Aurva PII Analyzer
|
|
##########################################################
|
|
aurva_pii_analyzer:
|
|
|
|
# -- Additional labels for aurva-controller
|
|
additionalLabels: {}
|
|
|
|
# -- Annotations on aurva-controller
|
|
annotations: {}
|
|
# "key": "value"
|
|
|
|
revisionHistoryLimit: 3
|
|
|
|
# -- no of replicas for aurva controller
|
|
replicas: 1
|
|
|
|
# -- Additional label added on pod which is used in Service's Label Selector
|
|
podLabels: {}
|
|
|
|
# -- Additional Pod Annotations added on pod created by this Deployment
|
|
additionalPodAnnotations: {}
|
|
# "key": "value"
|
|
|
|
|
|
# -- Secrets used to pull image
|
|
imagePullSecrets: ""
|
|
|
|
# Image of the app container
|
|
image:
|
|
repository: 119191042565.dkr.ecr.ap-south-1.amazonaws.com/aurva-piianalyzer
|
|
tag: "v1.2.8"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Environment variables to be passed to the app container
|
|
env: []
|
|
|
|
# -- If want to mount Envs from configmap or secret
|
|
envFrom:
|
|
aurva-pii-analyzer:
|
|
type: secret
|
|
name: aurva-pii-analyzer-secrets
|
|
|
|
# -- Resources to be defined for pod
|
|
resources:
|
|
limits:
|
|
memory: 4Gi
|
|
cpu: 2
|
|
requests:
|
|
memory: 2Gi
|
|
cpu: 1
|
|
|
|
|
|
# -- Select nodes to deploy which matches the following labels
|
|
nodeSelector:
|
|
# cloud.google.com/gke-nodepool: default-pool
|
|
# schedule-on: app-workload
|
|
|
|
|
|
# -- Taint tolerations for nodes
|
|
tolerations:
|
|
# - key: "dedicated"
|
|
# operator: "Equal"
|
|
# value: "app"
|
|
# effect: "NoSchedule"
|
|
|
|
# -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
|
|
affinity:
|
|
# nodeAffinity:
|
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
|
# nodeSelectorTerms:
|
|
# - matchExpressions:
|
|
# - key: disktype
|
|
# operator: In
|
|
# values:
|
|
# - ssd
|
|
|
|
# -- [DNS configuration]
|
|
dnsConfig: {}
|
|
# -- Alternative DNS policy for application controller pods
|
|
dnsPolicy: "ClusterFirst"
|
|
|
|
secret:
|
|
name: "aurva-pii-analyzer-secrets"
|
|
# -- Additional Labels on secrets
|
|
additionalLabels:
|
|
# key: value
|
|
# -- Annotations on secrets
|
|
annotations:
|
|
# key: value
|
|
|
|
config:
|
|
PG_USERNAME: "postgres"
|
|
PG_PASSWORD: "aurva"
|
|
PG_DBNAME: "controller"
|
|
SCHEDULER_TIME: "1"
|
|
SUPPORTED_REGION: "US"
|
|
|
|
serviceAccount:
|
|
# -- Create a service account for the aurva controller
|
|
create: true
|
|
# -- Service account name
|
|
name: aurva-pii-analyzer-sa
|
|
# -- Annotations applied to created service account
|
|
annotations:
|
|
# eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
|
|
# -- Labels applied to created service account
|
|
labels: {}
|
|
|
|
##########################################################
|
|
# Aurva OCR
|
|
##########################################################
|
|
aurva_ocr:
|
|
|
|
# -- Additional labels for aurva-controller
|
|
additionalLabels: {}
|
|
|
|
# -- Annotations on aurva-controller
|
|
annotations: {}
|
|
# "key": "value"
|
|
|
|
revisionHistoryLimit: 3
|
|
|
|
# -- no of replicas for aurva controller
|
|
replicas: 1
|
|
|
|
# -- Additional label added on pod which is used in Service's Label Selector
|
|
podLabels: {}
|
|
|
|
# -- Additional Pod Annotations added on pod created by this Deployment
|
|
additionalPodAnnotations: {}
|
|
# "key": "value"
|
|
|
|
|
|
# -- Secrets used to pull image
|
|
imagePullSecrets: ""
|
|
|
|
# Image of the app container
|
|
image:
|
|
repository: 119191042565.dkr.ecr.ap-south-1.amazonaws.com/aurva-ocr
|
|
tag: "v1.2.8"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Environment variables to be passed to the app container
|
|
env: []
|
|
|
|
# -- If want to mount Envs from configmap or secret
|
|
envFrom:
|
|
aurva-ocr:
|
|
type: secret
|
|
name: aurva-ocr-secrets
|
|
|
|
# -- Resources to be defined for pod
|
|
resources:
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 1
|
|
requests:
|
|
memory: 2Gi
|
|
cpu: 1
|
|
|
|
|
|
# -- Select nodes to deploy which matches the following labels
|
|
nodeSelector:
|
|
# cloud.google.com/gke-nodepool: default-pool
|
|
# schedule-on: app-workload
|
|
|
|
|
|
# -- Taint tolerations for nodes
|
|
tolerations:
|
|
# - key: "dedicated"
|
|
# operator: "Equal"
|
|
# value: "app"
|
|
# effect: "NoSchedule"
|
|
|
|
# -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
|
|
affinity:
|
|
# nodeAffinity:
|
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
|
# nodeSelectorTerms:
|
|
# - matchExpressions:
|
|
# - key: disktype
|
|
# operator: In
|
|
# values:
|
|
# - ssd
|
|
|
|
# -- [DNS configuration]
|
|
dnsConfig: {}
|
|
# -- Alternative DNS policy for application controller pods
|
|
dnsPolicy: "ClusterFirst"
|
|
|
|
secret:
|
|
name: "aurva-ocr-secrets"
|
|
# -- Additional Labels on secrets
|
|
additionalLabels:
|
|
# key: value
|
|
# -- Annotations on secrets
|
|
annotations:
|
|
# key: value
|
|
|
|
config:
|
|
PG_USERNAME: "postgres"
|
|
PG_PASSWORD: "aurva"
|
|
PG_DBNAME: "controller"
|
|
OCR_TIME_LIMIT: "1"
|
|
|
|
serviceAccount:
|
|
# -- Create a service account for the aurva controller
|
|
create: true
|
|
# -- Service account name
|
|
name: aurva-ocr-sa
|
|
# -- Annotations applied to created service account
|
|
annotations:
|
|
# eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
|
|
# -- Labels applied to created service account
|
|
labels: {}
|
|
|
|
|
|
##########################################################
|
|
# Aurva Proxy
|
|
##########################################################
|
|
aurva_proxy:
|
|
|
|
# -- Additional labels for aurva-proxy
|
|
additionalLabels: {}
|
|
|
|
# -- Annotations on aurva-proxy
|
|
annotations: {}
|
|
# "key": "value"
|
|
|
|
revisionHistoryLimit: 3
|
|
|
|
# -- no of replicas for aurva proxy
|
|
replicas: 4
|
|
|
|
# -- Additional label added on pod which is used in Service's Label Selector
|
|
podLabels: {}
|
|
|
|
# -- Additional Pod Annotations added on pod created by this Deployment
|
|
additionalPodAnnotations: {}
|
|
# "key": "value"
|
|
|
|
|
|
# -- Secrets used to pull image
|
|
imagePullSecrets: ""
|
|
|
|
# Image of the app container
|
|
image:
|
|
repository: 119191042565.dkr.ecr.ap-south-1.amazonaws.com/aurva-proxy
|
|
tag: "v1.2.6"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Environment variables to be passed to the app container
|
|
env: []
|
|
|
|
# -- If want to mount Envs from configmap or secret
|
|
envFrom:
|
|
aurva-controller:
|
|
type: secret
|
|
name: aurva-proxy-secrets
|
|
|
|
# -- Resources to be defined for pod
|
|
resources:
|
|
limits:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 0.5
|
|
|
|
|
|
# -- Select nodes to deploy which matches the following labels
|
|
nodeSelector:
|
|
# cloud.google.com/gke-nodepool: default-pool
|
|
# schedule-on: app-workload
|
|
|
|
|
|
# -- Taint tolerations for nodes
|
|
tolerations:
|
|
# - key: "dedicated"
|
|
# operator: "Equal"
|
|
# value: "app"
|
|
# effect: "NoSchedule"
|
|
|
|
# -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods.
|
|
affinity:
|
|
# nodeAffinity:
|
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
|
# nodeSelectorTerms:
|
|
# - matchExpressions:
|
|
# - key: disktype
|
|
# operator: In
|
|
# values:
|
|
# - ssd
|
|
|
|
# -- [DNS configuration]
|
|
dnsConfig: {}
|
|
# -- Alternative DNS policy for application controller pods
|
|
dnsPolicy: "ClusterFirst"
|
|
|
|
secret:
|
|
name: "aurva-proxy-secrets"
|
|
# -- Additional Labels on secrets
|
|
additionalLabels:
|
|
# key: value
|
|
# -- Annotations on secrets
|
|
annotations:
|
|
# key: value
|
|
|
|
config:
|
|
# PG_HOST: "aurva-dataplane-database.aurva-dataplane.svc.cluster.local"
|
|
PG_USERNAME: "postgres"
|
|
PG_PASSWORD: "aurva"
|
|
PG_DBNAME: "controller"
|
|
# CONTROLLER_HOST: "aurva-controller.aurva-dataplane"
|
|
CONTROLLER_PORT: "9090"
|
|
COMPANY_ID: "47c5ed30-c23e-48c3-a510-9c9378867737" # TODO: update this with your relevant COMPANY_ID
|
|
JWT_PUBLIC_KEY: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfS6iQUtuHtloso4mZeSg0663/a4F\n61UIvWTs5XtI3fE7/7LbQpPD5u5l7xDQpqRjD0wfIT32Y3WgjqyDQTadag==\n-----END PUBLIC KEY-----"
|
|
PROXY_HOST: "proxy.aurva.io"
|
|
PROXY_PORT: "8090"
|
|
|
|
serviceAccount:
|
|
# -- Create a service account for the aurva controller
|
|
create: true
|
|
# -- Service account name
|
|
name: aurva-proxy-sa
|
|
# -- Annotations applied to created service account
|
|
annotations:
|
|
# eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
|
|
# -- Labels applied to created service account
|
|
labels: {}
|