174 lines
7.9 KiB
YAML
174 lines
7.9 KiB
YAML
# Default values for deepfence-router.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
# Configure port for browser / agents
|
|
managementConsolePort: "443"
|
|
|
|
service:
|
|
name: deepfence-console-router
|
|
# Select the type of service to be used.
|
|
# When exposing the service in an on premisses Kubernetes cluster, select NodePort as type
|
|
# Also, possible to use Ingress as type when ingress controller is installed
|
|
type: LoadBalancer # LoadBalancer/NodePort/Ingress/ClusterIP
|
|
# NodePort configuration. Only used when the service type is NodePort
|
|
nodePortHttps: ""
|
|
nodePortHttp: ""
|
|
# Using static ip address for load balancer
|
|
# - Google Cloud: https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip
|
|
# loadBalancerIP: "1.2.3.4"
|
|
# - Azure: https://docs.microsoft.com/en-us/azure/aks/static-ip
|
|
# loadBalancerIP: "1.2.3.4"
|
|
loadBalancerIP: ""
|
|
# If loadBalancerType is "external", we recommend setting loadBalancerSourceRanges
|
|
# to the ip address / CIDR ranges of your laptop's ip or corporate CIDR range.
|
|
# If this is set empty, ports 443 and 80 will be open to the public internet.
|
|
# Example: ["143.231.0.0/16","210.57.79.18/32"]
|
|
loadBalancerSourceRanges: []
|
|
|
|
# externalIPs: When kubernetes is not cloud managed, add public ip addresses of kubernetes nodes to externalIPs
|
|
externalIPs: []
|
|
externalTrafficPolicy: "Cluster"
|
|
|
|
annotations:
|
|
## aws
|
|
## as default aws creates classic load balancer, to change to nlb use below annotation
|
|
## https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support
|
|
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
|
|
|
|
## Static ip for NLB
|
|
## https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html
|
|
## Example: "eipalloc-0123456789abcdefg,eipalloc-0123456789hijklmn"
|
|
# service.beta.kubernetes.io/aws-load-balancer-eip-allocations: ""
|
|
|
|
## ACM SSL certificate for AWS Classic LoadBalancer
|
|
## This cannot be set if aws-load-balancer-eip-allocations is set
|
|
## https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
|
|
## https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/
|
|
## Example: "arn:aws:acm:{region}:{user id}:certificate/{id}"
|
|
# service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ""
|
|
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "https"
|
|
# service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
|
|
|
|
## if internal load balancer is required
|
|
## set this based on cloud provider
|
|
|
|
## aws
|
|
## https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
|
# service.beta.kubernetes.io/aws-load-balancer-internal: "true"
|
|
|
|
## azure
|
|
# service.beta.kubernetes.io/azure-load-balancer-internal: "true"
|
|
|
|
## gcp
|
|
# networking.gke.io/load-balancer-type: "Internal"
|
|
# cloud.google.com/load-balancer-type: "Internal"
|
|
# cloud.google.com/app-protocols: '{"https-port":"HTTPS","http-port":"HTTP"}'
|
|
|
|
## ibm cloud
|
|
# service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: "private"
|
|
|
|
## openstack
|
|
# service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
|
|
|
|
|
|
# User can create separate k8s service for agents if required.
|
|
# One use case for this is to deploy external load balancer for browser access for management console and internal load balancer for agent communication.
|
|
createSeparateServiceForAgents: false
|
|
|
|
agentService:
|
|
# Configuration service accessed by agents
|
|
name: deepfence-agent-router
|
|
type: LoadBalancer # LoadBalancer/NodePort/Ingress/ClusterIP
|
|
# Using static ip address for load balancer
|
|
# - Google Cloud: https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip
|
|
# loadBalancerIP: "1.2.3.4"
|
|
# - Azure: https://docs.microsoft.com/en-us/azure/aks/static-ip
|
|
# loadBalancerIP: "1.2.3.4"
|
|
loadBalancerIP: ""
|
|
# If loadBalancerType is "external", we recommend setting loadBalancerSourceRanges to the ip address / CIDR ranges
|
|
# of your laptop's ip or corporate CIDR range. If this is set empty, ports 443 and 80 will be open to the public internet.
|
|
# Example: ["143.231.0.0/16","210.57.79.18/32"]
|
|
loadBalancerSourceRanges: []
|
|
# externalIPs: When kubernetes is not cloud managed, add public ip addresses of kubernetes nodes to externalIPs
|
|
externalIPs: []
|
|
externalTrafficPolicy: "Cluster"
|
|
|
|
annotations:
|
|
## aws
|
|
## as default aws creates classic load balancer, to change to nlb use below annotation
|
|
## https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support
|
|
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
|
|
|
|
## Static ip for NLB
|
|
## https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html
|
|
## Example: "eipalloc-0123456789abcdefg,eipalloc-0123456789hijklmn"
|
|
# service.beta.kubernetes.io/aws-load-balancer-eip-allocations: ""
|
|
|
|
## ACM SSL certificate for AWS Classic LoadBalancer
|
|
## This cannot be set if aws-load-balancer-eip-allocations is set
|
|
## https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
|
|
## https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/
|
|
## Example: "arn:aws:acm:{region}:{user id}:certificate/{id}"
|
|
# service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ""
|
|
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "https"
|
|
# service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
|
|
|
|
## https://kubernetes.io/docs/concepts/services-networking/service/#other-elb-annotations
|
|
## if internal load balancer is required
|
|
## set this based on cloud provider
|
|
|
|
## aws
|
|
## https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
|
# service.beta.kubernetes.io/aws-load-balancer-internal: "true"
|
|
|
|
## azure
|
|
# service.beta.kubernetes.io/azure-load-balancer-internal: "true"
|
|
|
|
## gcp
|
|
# networking.gke.io/load-balancer-type: "Internal"
|
|
# cloud.google.com/load-balancer-type: "Internal"
|
|
# cloud.google.com/app-protocols: '{"https-port":"HTTPS","http-port":"HTTP"}'
|
|
|
|
## ibm cloud
|
|
# service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: "private"
|
|
|
|
## openstack
|
|
# service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
|
|
|
|
|
|
# ingress configuration for console
|
|
ingress:
|
|
## name of the ingress class for ingress provider installed on the cluster, cannot be empty
|
|
## Example: nginx
|
|
class: nginx
|
|
## host example: threat.example.com
|
|
host: ""
|
|
## annotations to customize ingress
|
|
annotations:
|
|
## nginx ingress annotations
|
|
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
|
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: 200m
|
|
|
|
## gke ingress
|
|
# kubernetes.io/ingress.class: gce
|
|
## use the below annotation to attach gke managed certificate
|
|
## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#gcloud
|
|
# networking.gke.io/managed-certificates: <managed certificate name>
|
|
|
|
## aws alb annotations
|
|
## aws load balancer controller needs to be installed on the cluster for these annotations to work
|
|
## documentation aws load balancer controller https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/
|
|
# alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
|
|
# alb.ingress.kubernetes.io/backend-protocol: HTTPS
|
|
## arn of the certificate available on aws certificate manager
|
|
# alb.ingress.kubernetes.io/certificate-arn: ""
|
|
# alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
|
|
# alb.ingress.kubernetes.io/scheme: internet-facing
|
|
# alb.ingress.kubernetes.io/target-group-attributes: stickiness.enabled=true,stickiness.lb_cookie.duration_seconds=3600
|
|
# alb.ingress.kubernetes.io/target-type: ip
|