values.yaml

# Specifies the secret data for imagePullSecrets needed to fetch the private docker images
imageCredentials:
  create: true
  name: aqua-registry-secret # example
  repositoryUriPrefix: "registry.aquasec.com" # for dockerhub - "docker.io"
  registry: "registry.aquasec.com" #REQUIRED only if create is true, for dockerhub - "index.docker.io/v1/"
  username: ""
  password: ""

rbac:
  enabled: true
  privileged: true
  roleRef:

#Please specify k8s platform acronym. Allowed values are aks, eks, gke, openshift, tkg, tkgi, k8s
# aks = Azure Kubernetes Service
# gke = Google kubernetes Engine
# openshift = RedHat Openshift/OCP
# tkg = VMware Tanzu kubernetes Grid
# tkgi = VMware Tanzu kubernetes Grid Integrated Edition
# k8s = Plain/on-prem Vanilla Kubernetes
# gs = GaintSwarm platform
# k3s = k3s kubernetes platform
platform: ""

openshift_route:
  create: false    #Enable if required openshift route for web and gateway

serviceaccount:
  annotations: {}

# enable only one of the modes
clustermode:
activeactive:

admin:
  token:
  password:

dockerSock:
  mount: # put true for mount docker socket.
  path: /var/run/docker.sock # pks - /var/vcap/data/sys/run/docker/docker.sock

db:
  external:
    enabled: false
    name:
    host:
    port:
    user:
    password:
    auditName:
    auditHost:
    auditPort:
    auditUser:
    auditPassword:
    pubsubName:
    pubsubHost:
    pubsubPort:
    pubsubUser:
    pubsubPassword:

  passwordFromSecret:
    enabled: false              #Enable if loading passwords for db and audit-db from secret
    dbPasswordName:             #Specify the Password Secret name used for db password
    dbPasswordKey:              #Specify the db password key name stored in the #dbPasswordName secret
    dbAuditPasswordName:           #Specify the Password Secret name used for audit db password
    dbAuditPasswordKey:             #Specify the audit db password key name stored in the #dbAuditPasswordName secret
    dbPubsubPasswordName:            #Specify the Password Secret name used for pubsub db password
    dbPubsubPasswordKey:            #Specify the pubsub db password key name stored in the #PubsubPasswordName secret
  ssl: false
  auditssl: false
  pubsubssl: false
  securityContext:
    runAsUser: 70
    runAsGroup: 70
    fsGroup: 11433
  container_securityContext:
    privileged: false
  image:
    repository: database
    tag: "5.3"
    pullPolicy: IfNotPresent
  service:
    type: ClusterIP
  persistence:
    enabled: true
    storageClass:
    size: 30Gi
    accessMode: ReadWriteOnce
  livenessProbe:
    exec:
      command:
      - sh
      - -c
      - exec pg_isready --host $POD_IP
    initialDelaySeconds: 60
    timeoutSeconds: 5
    failureThreshold: 6
  readinessProbe:
    exec:
      command:
      - sh
      - -c
      - exec pg_isready --host $POD_IP
    initialDelaySeconds: 5
    timeoutSeconds: 3
    periodSeconds: 5
  resources: {}
    # Note: For recommendations please check the official sizing guide.
    # requests:
    #   cpu: 3000m
    #   memory: 6Gi
    # limits:
    #   cpu: 12000m
    #   memory: 20Gi
  nodeSelector: {}
  tolerations: []
  affinity: {}

  # extraEnvironmentVars is a list of extra environment variables to set in the database deployments.
  extraEnvironmentVars: {}
    # ENV_NAME: value

  # extraSecretEnvironmentVars is a list of extra environment variables to set in the database deployments.
  # These variables take value from existing Secret objects.
  extraSecretEnvironmentVars: []
    # - envName: ENV_NAME
    #   secretName: name
    #   secretKey: key

gate:
  replicaCount: 1
  logLevel:
  image:
    repository: gateway
    tag: "5.3"
    pullPolicy: IfNotPresent
  service:
    type: ClusterIP     # you can enable gateway to external by changing type to "LoadBalancer"
    loadbalancerIP: "" # Specify loadBalancerIP address for aqua-web in AKS platform
    annotations: {}
    ports:
      - name: aqua-gate
        port: 3622
        targetPort: 3622
        nodePort:
        protocol: TCP
      - name: aqua-gate-ssl
        port: 8443
        targetPort: 8443
        nodePort:
        protocol: TCP
      - name: aqua-health
        port: 8082
        protocol: TCP
        targetPort: 8082
        nodePort:
  publicIP:
  livenessProbe:
    httpGet:
      path: /
      port: 8082
    initialDelaySeconds: 60
    periodSeconds: 30
  readinessProbe:
    tcpSocket:
      port: 8443
    initialDelaySeconds: 60
    periodSeconds: 60
  resources: {}
    # Note: For recommendations please check the official sizing guide.
    # requests:
    #   cpu: 1500m
    #   memory: 7Gi
    # limits:
    #   cpu: 6000m
    #   memory: 10Gi
  nodeSelector: {}
  tolerations: []
  affinity: {}
  securityContext:
    runAsUser: 11431
    runAsGroup: 11433
    fsGroup: 11433
  container_securityContext: {}

  # TLS is for enabling mTLS/TLS establishment between gateway <-> server and gateway <-> enforcers
  TLS:
    enabled: false              # enable to true for secure communication (mTLS/TLS)
    secretName: ""               # provide certificates secret name created to enable tls/mtls communication between enforcer and gateway/envoy
    publicKey_fileName: ""       #provide filename of the public key eg: aqua_gateway.crt
    privateKey_fileName: ""      #provide filename of the private key eg: aqua_gateway.key
    rootCA_fileName: ""          #provide filename of the rootCA, if using self-signed certificates eg: rootCA.crt
    aqua_verify_enforcer: "0"    # change it to "1" for enabling mTLS between enforcer and gateway/envoy

  # extraEnvironmentVars is a list of extra environment variables to set in the gateway deployments.
  # https://docs.aquasec.com/docs/gateway-optional-variables
  extraEnvironmentVars: {}
    # ENV_NAME: value

  # extraSecretEnvironmentVars is a list of extra environment variables to set in the gateway deployments.
  # These variables take value from existing Secret objects.
  extraSecretEnvironmentVars: []
    # - envName: ENV_NAME
    #   secretName: name
    #   secretKey: key

web:
  replicaCount: 1
  logLevel:
  image:
    repository: console
    tag: "5.3"
    pullPolicy: IfNotPresent
  service:
    type: LoadBalancer
    loadbalancerIP: "" # Specify loadBalancerIP address for aqua-gateway in AKS platform
    annotations: {}
    ports:
      - name: aqua-web
        port: 8080
        targetPort: 8080
        nodePort:
        protocol: TCP
      - name: aqua-web-ssl
        port: 443
        targetPort: 8443
        nodePort:
        protocol: TCP
    #As 443, 8443 already occupied in k3s kubernetes by traefik ingress. below are the console ports
    k3sPorts:
      - name: aqua-web
        port: 8080
        targetPort: 8080
        nodePort:
        protocol: TCP
      - name: aqua-web-ssl
        port: 444
        targetPort: 8443
        nodePort:
        protocol: TCP
  ingress:
    enabled: false
    externalPort:
    annotations: {}
    #  kubernetes.io/ingress.class: nginx
    hosts: #REQUIRED
    #- aquasec-test.example.com
    path: /
    tls: []
    #  - secretName: aquasec-tls
    #    hosts:
    #      - aquasec.domain.com

  # Note: Please change the ports according to the requirement.
  # default liveness and readiness probe
  livenessProbe:
    httpGet:
      path: /
      port: 8080
    initialDelaySeconds: 60
    periodSeconds: 30

  readinessProbe:
    httpGet:
      path: /
      port: 8080
    initialDelaySeconds: 60
    periodSeconds: 30

  resources: {}
    # Note: For recommendations please check the official sizing guide.
    # requests:
    #   cpu: 2000m
    #   memory: 3Gi
    # limits:
    #   cpu: 6000m
    #   memory: 10Gi
  nodeSelector: {}
  tolerations: []
  affinity: {}
  securityContext:
    runAsUser: 11431
    runAsGroup: 11433
    fsGroup: 11433
  container_securityContext: {}

  # TLS is for enabling mTLS/TLS establishment between server <-> gateway and https for aqua console
  TLS:
    enabled: false              # enable to true for secure communication
    secretName: ""              # provide certificates secret name created to enable tls/mtls communication between enforcer and gateway/envoy
    publicKey_fileName: ""      #provide filename of the public key eg: aqua_web.crt
    privateKey_fileName: ""     #provide filename of the private key eg: aqua_web.key
    rootCA_fileName: ""         #provide filename of the rootCA, if using self-signed certificates eg: rootCA.crt

  maintenance_db:
    name: ""         #specify the AQUA_MAINTENANCE_DB name if enabled

  # extraEnvironmentVars is a list of extra environment variables to set in the web deployments.
  # https://docs.aquasec.com/docs/server-optional-variables
  extraEnvironmentVars: {}
    # ENV_NAME: value

  # extraSecretEnvironmentVars is a list of extra environment variables to set in the web deployments.
  # These variables take value from existing Secret objects.
  extraSecretEnvironmentVars: []
    # - envName: ENV_NAME
    #   secretName: name
    #   secretKey: key

envoy:
  enabled: false
  replicaCount: 1

  image:
    repository: envoy
    tag: "5.3"
    pullPolicy: IfNotPresent

  service:
    type: LoadBalancer
    loadbalancerIP: "" # Specify loadBalancerIP address for envoy in AKS platform
    annotations: {}
      # service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
      # service.beta.kubernetes.io/aws-load-balancer-internal: "false"
      # service.beta.kubernetes.io/aws-load-balancer-type: nlb
    ports:
    - name: https
      port: 443
      targetPort: 8443
      nodePort:
      protocol: TCP
    #As 443, 8443 already occupied in k3s kubernetes by traefik ingress. below are the envoy service ports
    k3sPorts:
      - name: https
        port: 445
        targetPort: 8443
        nodePort:
        protocol: TCP

  # Enabling Envoy requires the use of TLS certificates for the listener section, while the cluster TLS section is optional and to be enabled if TLS is in use for gate and web.
  # Find the instructions in the readme for help with generating the required certificates.
  TLS:
    listener:
      enabled: false                    # true to enable loading custom self-signed or CA certs, by default envoy uses packaged self-signed certs.
      secretName: "aqua-lb-tls"         # provide secret name containing the certificates
      publicKey_fileName: ""            # provide filename of the public key in the secret eg: aqua-lb.fqdn.crt
      privateKey_fileName: ""           # provide filename of the private key in the secret eg: aqua-lb.fqdn.key
      rootCA_fileName: ""               # optional: use this field if using a custom CA or chain
    cluster:
      enabled: false                    # true to enable secure communication between Aqua Envoy and Gateways
      secretName: "aqua-lb-tls-custer"  # provide secret name containing the certificates
      publicKey_fileName: ""            # provide filename of the public key in the secret eg: aqua-lb.crt
      privateKey_fileName: ""           # provide filename of the private key in the secret eg: aqua-lb.key
      rootCA_fileName: ""               # optional: use this field if using a custom CA or chain

  livenessProbe:
    failureThreshold: 3
    httpGet:
      httpHeaders:
      - name: x-envoy-livenessprobe
        value: healthz
      path: /healthz
      port: 8443
      scheme: HTTPS
    initialDelaySeconds: 10
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 1
  readinessProbe:
    failureThreshold: 3
    httpGet:
      httpHeaders:
      - name: x-envoy-livenessprobe
        value: healthz
      path: /healthz
      port: 8443
      scheme: HTTPS
    initialDelaySeconds: 3
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 1

  resources: {}
    # Note: For recommendations please check the official sizing guide.
    # requests:
    #   cpu: 2000m
    #   memory: 4Gi
    # limits:
    #   cpu: 4000m
    #   memory: 10Gi
  nodeSelector: {}
  tolerations: []
  affinity: {}
  securityContext: {}

  ## Enabling this will replace any templated envoy configuration with the list of files passed below
  custom_envoy_files: {}
    # envoy.yaml: |
    #   static_resources:
    #     listeners:
    #     - address:
    #         socket_address:
    #           address: 0.0.0.0
    #           port_value: 8443
    #       filter_chains:
    #       - filters:
    #         - name: envoy.filters.network.http_connection_manager
    #           typed_config:
    #             "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
    #             stream_idle_timeout: 0s
    #             drain_timeout: 20s
    #             access_log:
    #             - name: envoy.access_loggers.file
    #               typed_config:
    #                 "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
    #                 path: "/dev/stdout"
    #             codec_type: AUTO
    #             stat_prefix: ingress_https
    #             route_config:
    #               name: local_route
    #               virtual_hosts:
    #               - name: https
    #                 domains:
    #                 - "*"
    #                 routes:
    #                 - match:
    #                     prefix: "/"
    #                   route:
    #                     cluster: aqua-gateway-svc
    #                     timeout: 0s
    #             http_filters:
    #             - name: envoy.filters.http.health_check
    #               typed_config:
    #                 "@type": type.googleapis.com/envoy.config.filter.http.health_check.v2.HealthCheck
    #                 pass_through_mode: false
    #                 headers:
    #                 - name: ":path"
    #                   exact_match: "/healthz"
    #                 - name: "x-envoy-livenessprobe"
    #                   exact_match: "healthz"
    #             - name: envoy.filters.http.router
    #               typed_config: {}
    #         transport_socket:
    #           name: envoy.transport_sockets.tls
    #           typed_config:
    #             "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
    #             common_tls_context:
    #               alpn_protocols: "h2,http/1.1"
    #               tls_certificates:
    #               - certificate_chain:
    #                   filename: "/etc/ssl/envoy/tls.crt"
    #                 private_key:
    #                   filename: "/etc/ssl/envoy/tls.key"
    #     clusters:
    #     - name: aqua-gateway-svc
    #       connect_timeout: 180s
    #       type: STRICT_DNS
    #       dns_lookup_family: V4_ONLY
    #       lb_policy: ROUND_ROBIN
    #       http2_protocol_options:
    #         hpack_table_size: 4294967
    #         max_concurrent_streams: 2147483647
    #       circuit_breakers:
    #           thresholds:
    #               max_pending_requests: 2147483647
    #               max_requests: 2147483647
    #       load_assignment:
    #         cluster_name: aqua-gateway-svc
    #         endpoints:
    #         - lb_endpoints:
    #           - endpoint:
    #               address:
    #                 socket_address:
    #                   address: {{ .Release.Name }}-gateway-headless-svc.{{ .Release.Namespace }}.svc.cluster.local
    #                   port_value: 8443
    #       transport_socket:
    #           name: envoy.transport_sockets.tls
    #           typed_config:
    #               "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
    #               sni: aqua-gateway-svc
    #   admin:
    #     access_log_path: "/dev/stdout"
    #     address:
    #       socket_address:
    #         address: 127.0.0.1
    #         port_value: 8090