values.yaml

# Default values for smartcheck.
# This is a YAML-formatted file.

## activationCode is the product activation code.
##
## Default value: (none)
activationCode:

## extraLabels is a dictionary of additional labels that will be added to all resources
## created by this chart.
extraLabels: {}

rateLimiting:
  api:
    ## The maximum API request rate (per source IP address) in requests per second.
    ##
    ## Default value: 10
    rate: 10

    ## The allowable burst rate. If this is greater than 0, then requests that exceed
    ## the maximum API request rate will be queued.
    ##
    ## This does not change the rate of requests that are sent to the backend services.
    ## Queued requests will be sent to the backend services at the rate defined in
    ## `rateLimiting.api.rate`.
    ##
    ## Default value: 10
    burst: 10

    ## The HTTP response status code to send when a request is rejected due to the rate
    ## limit being exceeded.
    ##
    ## Default value: 429 (Too many requests)
    status: 429

    ## The size, in megabytes, of the rate limiting memory zone. State monitoring for
    ## about 16,000 IP addresses takes 1 megabyte.
    ##
    ## Default value: 10
    size: 10

proxy:
  ## httpProxy, if set, will be used as the proxy for HTTP traffic from
  ## Deep Security Smart Check.
  ##
  ## The value may be either a complete URL or a `host[:port]`, in which
  ## case the `http` scheme is assumed.
  ##
  ## Default value: (none)
  httpProxy:

  ## httpsProxy, if set, will be used as the proxy for HTTPS traffic from
  ## Deep Security Smart Check. If `httpsProxy` is not set, `httpProxy`
  ## is also checked and will be used if set.
  ##
  ## The value may be either a complete URL or a `host[:port]`, in which
  ## case the `http` scheme is assumed.
  ##
  ## Default value: (none)
  httpsProxy:

  ## noProxy, if set, is a list of hosts or `host:port` combinations which
  ## should not be accessed through the proxy.
  ##
  ## Default value: (none)
  noProxy: []

  ## username, if set, is the user name to provide to the outbound proxy when making requests.
  ##
  ## Default value: (none)
  username:

  ## password, if set, is the password to provide to the outbound proxy when making requests.
  ##
  ## Default value: (none)
  password:

auth:
  ## masterPassword is used as part of the password generation process for
  ## all auto-generated internal passwords, ensuring that each installation of
  ## Deep Security Smart Check has different passwords.
  ##
  ## Default value: {must be provided by the installer}
  masterPassword:

  ## roleName is the name of the default administrator role that the system creates on startup.
  ## If a role with this name already exists, no action will be taken.
  ##
  ## Default value: administrator
  roleName: administrator

  ## auditorRoleName is the name of the default auditor role that the system creates on startup.
  ## If a role with this name already exists, no action will be taken.
  ##
  ## Default value: auditor
  auditorRoleName: auditor

  ## userRoleName is the name of the default user role that the system creates on startup.
  ## If a role with this name already exists, no action will be taken.
  ##
  ## Default value: user
  userRoleName: user

  ## userName is the name of the default administrator user that the system creates on startup.
  ## If a user with this name already exists, no action will be taken.
  ##
  ## Default value: administrator
  userName: administrator

  ## password is the password assigned to the default administrator that the system creates on startup.
  ## If a user with the name `auth.userName` already exists, no action will be taken.
  ##
  ## Default value: a generated password derived from the masterPassword and system details
  password: # autogenerated

  ## audience is the value inserted into the JWT token for authentication.
  ##
  ## Default value: deepsecurity-smartcheck
  audience: deepsecurity-smartcheck

certificate:
  secret:
    ## name is the name of the existing secret that stores the service's certificate and private key.
    ## If this is not provided, the chart will generate a self-signed certificate and private key
    ## for the service to present.
    ##
    ## The secret must exist in the same namespace as the service.
    ##
    ## Default value: none
    name:

    ## certificate is the name of the key inside the secret that stores the service's certificate.
    ## The value of the secret must be the PEM-encoded certificate or certificate chain for the service.
    ## This value is required if `certificate.secret.name` is set.
    ##
    ## Default value: none
    certificate:

    ## privateKey is the name of the key inside the secret that stores the service's private key that
    ## matches the certificate. The value of the secret must be the PEM-encoded private key for the service.
    ## The private key must not be protected by a passphrase.
    ## This value is required if `certificate.secret.name` is set.
    ##
    ## Default value: none
    privateKey:

  ## commonName is the common name to use in the default self-signed certificate.
  ##
  ## Default value: example.com
  commonName: example.com

  ## ipAlternativeNames is a list of IP addresses to include as alternate names.
  ## in the default self-signed certificate.
  ##
  ## Default value: []
  ipAlternativeNames: []

  ## dnsAlternativeNames is a list of DNS names to include as alternate names
  ## in the default self-signed certificate.
  ##
  ## Default value: []
  dnsAlternativeNames: []

  ## lifetime is the lifetime in days of the default self-signed certificate.
  ##
  ## Default value: 3650
  lifetime: 3650

service:
  ## type is the Kubernetes Service type for the `proxy` service that acts as
  ## an entry point to the system.
  ##
  ## LoadBalancer will expose the service externally using the cluster provider's load balancer.
  ## ClusterIP will expose the service on an internal cluster IP address.
  ## NodePort will expose the service on each Node's IP address.
  ##
  ## See also: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services---service-types
  ##
  ## Default value: LoadBalancer
  type: ClusterIP

  ## httpsPort is the port where the service will listen for HTTPS requests.
  ##
  ## Default value: 443
  httpsPort: 443

  ## httpPort is the port where the service will listen for HTTP requests.
  ## The service will automatically redirect all HTTP requests to HTTPS.
  ##
  ## TODO confirm that this is true (it appears not to be)
  ##
  ## Default value: 80
  httpPort: 80

db:
  ## Application database user
  ##
  ## Default value: a generated value derived from the masterPassword and system details
  user:

  ## Application database password
  ##
  ## IMPORTANT: Do not change this value after the initial install as the database
  ## will not pick up the change and the service will not be able to connect.
  ##
  ## Default value: a generated password derived from the masterPassword and system details
  password:

  ## secret is an application database secret used to encrypt data within the
  ## database. The value is put through PBKDF2 key expansion before being used
  ## as an encryption key.
  ##
  ## IMPORTANT: Do not change this value after the initial install as any
  ## encrypted data will not be able to be decrypted.
  ##
  ## Default value: a generated password derived from the masterPassword and system details
  secret:

vulnerabilityDB:
  ## Vulnerability database password
  ##
  ## Default value: a random 32-character alphanumeric string
  user:

  ## Vulnerability database password
  ##
  ## Default value: a random 32-character alphanumeric string
  password:

images:
  defaults:
    ## Default registry to pull images from. This can be overridden for
    ## each image by specifying the registry attribute at the image level.
    ## If no registry is provided, images will be pulled from your default
    ## registry (which may be Docker Hub).
    ##
    ## Default value: blank
    # registry:

    ## Default project / organization to pull images from. This can be
    ## overridden for each image by specifying the project attribute at the
    ## image level.
    ##
    ## Default value: deepsecurity
    # project: deepsecurity

    ## Default tag for images to pull. This can be overridden for each image
    ## by specifying the tag attribute at the image level.
    tag: 1.0.1

    ## Default pull policy for images. This can be overridden for each image
    ## by specifying the pullPolicy attribute at the image level.
    ##
    ## Default value: Always
    # pullPolicy: Always

    ## Default secret for pulling images. This can be overridden for each
    ## image by specifying the secretKey attribute at the image level.
    ##
    ## Default value: none
    # secretKey:
  db:
    repository: db
  auth:
    repository: auth
  malwareScan:
    repository: vscan
  scan:
    repository: scan
  registryviews:
    repository: registryviews
  docs:
    repository: api-docs
  frontend:
    repository: frontend
  proxy:
    repository: proxy
  vulnerabilityScan:
    repository: vulnerability-scan
  vulnerabilityDB:
    repository: vulnerability-db
  tasks:
    repository: tasks
  metricsCollector:
    # Using IfNotPresent instead of the default of Always because this runs every minute out of the box
    imagePullPolicy: IfNotPresent
    repository: k8s-metrics-reporter
  metricsReporter:
    # Using IfNotPresent instead of the default of Always because this runs every minute out of the box
    imagePullPolicy: IfNotPresent
    repository: k8s-metrics-reporter

replicas: {}

persistence:
  ## enabled is whether a persistent volume claim should be created for database storage.
  ## If no persistent volume claim is created, then the database will be lost every time the
  ## database container restarts.
  enabled: false

  ## storageClassName is the name of the storage class that should be used for persistent volumes.
  ## If no value is specified, then `storageClassName` is left out of the persistent volume claim.
  ## This value can be overridden for each persistent volume; see below.
  ##
  ## Reference: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class
  ##
  ## Default: blank
  storageClassName:

  db:
    ## size is the amount of persistent volume storage to request for the main application databases.
    ##
    ## Default value: 8Gi
    size: 8Gi #?

    ## storageClassName is the name of the storage class that should be used for persistent volume
    ## used by the application database. If no value is specified, then the value of
    ## `persistence.storageClassName` is used.
    ##
    ## Reference: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class
    ##
    ## Default: blank
    storageClassName:

  vulnerabilityDB:
    size: 10Gi #?

    ## storageClassName is the name of the storage class that should be used for persistent volume
    ## used by the vulnerability database. If no value is specified, then the value of
    ## `persistence.storageClassName` is used.
    ##
    ## Reference: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class
    ##
    ## Default: blank
    storageClassName:

  metrics:
    ## size is the amount of persistent volume storage to request for the metrics collector and reporter.
    ##
    ## Default value: 1Mi
    size: 1Mi #?

    ## storageClassName is the name of the storage class that should be used for persistent volume
    ## used by the metrics collector and reporter. If no value is specified, then the value of
    ## `persistence.storageClassName` is used.
    ##
    ## Reference: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class
    ##
    ## Default: blank
    storageClassName:


resources:
  defaults: {}
    # If you want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #  cpu: 100m
    #  memory: 128Mi
    # requests:
    #  cpu: 100m
    #  memory: 128Mi
  db:
    requests:
      cpu: 100m
      memory: 256Mi
  vulnerabilityScan:
    requests:
      cpu: 200m
      memory: 256Mi
    limits:
      cpu: 800m
      memory: 2Gi
  vulnerabilityDB:
    requests:
      cpu: 100m
      memory: 256Mi

nodeSelector:
  defaults: {}

tolerations:
  defaults: []

affinity:
  defaults: {}

ingress: {}

networkPolicy:
  enabled: true

# Scheduled system tasks
tasks:
  # The scan task will periodically trigger scans on views that have the `schedule`
  # flag set to `true`.
  scan:
    ## enabled controls whether or not to create the Kubernetes CronJob task that
    ## will trigger the scheduled scan.
    ##
    ## Default value: true
    enabled: true

    ## schedule controls the schedule for the scheduled scan. It is a string in
    ## [cron](https://en.wikipedia.org/wiki/Cron) format.
    ##
    ## Default value: @daily (once a day, at midnight UTC)
    schedule: "@daily"

  # The metrics collector will periodically retrieve metrics from pods that have the
  # `metrics: include` label.
  metricsCollector:
    ## enabled controls whether or not to create the Kubernetes Cronjob task that will
    ## trigger metrics collection.
    ##
    ## Default value: false
    enabled: false

    ## schedule controls the schedule for metrics collection. It is a string in
    ## [cron](https://en.wikipedia.org/wiki/Cron) format.
    ##
    ## Default value: */1 * * * * (every minute)
    schedule: "*/1 * * * *"

  metricsReporter:
    ## enabled controls whether or not to create the Kubernetes Cronjob task that will
    ## trigger metrics collection.
    ##
    ## Default value: false
    enabled: false

    ## schedule controls the schedule for metrics collection. It is a string in
    ## [cron](https://en.wikipedia.org/wiki/Cron) format.
    ##
    ## Default value: @weekly (once a week, at midnight UTC on Sunday)
    schedule: "@weekly"

    ## url is the target URL for reporting metrics. If no URL is provided, then metrics
    ## will not be reported.
    ##
    ## Default value: blank
    url:

# securityContext specifies the security contexts that we'll apply to the pods.
securityContext:
  ## enabled is a global flag controlling whether security contexts are included at all in the manifest
  ## Default value: true
  enabled: true

  ## default is the default security context that we'll apply at the pod and container level.
  ## if `securityCOntext.enabled` is true, the `pod` value will be inserted into the `Deployment` manifest
  ## as part of the pod template and the `container` value will be inserted at the container level.
  default:
    pod:
      runAsNonRoot: true
    container:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      privileged: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      # seLinuxOptions: "If unspecified, the container runtime will allocate a random SELinux context for each container": perfect.
  db: &databaseSecurityContext
    pod:
      runAsNonRoot: false
    container:
      allowPrivilegeEscalation: false
      capabilities:
        drop: []
      privileged: false
      readOnlyRootFilesystem: false
      runAsNonRoot: false
  vulnerabilityDB: *databaseSecurityContext
  vulnerabilityScan: &scanSecurityContext
    pod:
      runAsNonRoot: false
    container:
      allowPrivilegeEscalation: false
      capabilities:
        drop: []
      privileged: false
      readOnlyRootFilesystem: false
      runAsNonRoot: false
  malwareScan: *scanSecurityContext
  proxy: &staticAssetSecurityContext
    pod:
      runAsNonRoot: false
    container:
      allowPrivilegeEscalation: false
      capabilities:
        drop: []
      privileged: false
      readOnlyRootFilesystem: false
      runAsNonRoot: false
  frontend: *staticAssetSecurityContext
  docs: *staticAssetSecurityContext

  ## GKE mounts persistent volumes as root with mode 0755,
  ## so these pods need to run as root.
  metricsCollector: &metrics
    pod:
      runAsNonRoot: false
    container:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      privileged: false
      readOnlyRootFilesystem: true
      runAsNonRoot: false
      runAsUser: 0
  metricsReporter: *metrics

cursor:
  ## secret is an application cursor secret used to encrypt data within the
  ## cursor. The value is put through PBKDF2 key expansion before being used
  ## as an encryption key.
  ##
  ## IMPORTANT: Do not change this value after the initial install as any
  ## encrypted data will not be able to be decrypted.
  ##
  ## Default value: a generated password derived from the masterPassword and system details
  secret: