values.yaml

global:
  # Specify the Kubernetes (k8s) platform acronym.
  # Allowed values are:
  # - aks: Azure Kubernetes Service
  # - eks: Amazon Elastic Kubernetes Service
  # - gke: Google Kubernetes Engine
  # - gke-autopilot: Google Kubernetes Engine Autopilot
  # - openshift: Red Hat OpenShift/OCP
  # - tkg: VMware Tanzu Kubernetes Grid
  # - tkgi: VMware Tanzu Kubernetes Grid Integrated Edition
  # - k8s: Plain/on-prem Vanilla Kubernetes
  # - rancher: Rancher Kubernetes Platform
  # - gs: Giant Swarm platform
  # - k3s: k3s Kubernetes platform
  # - mke: Mirantis Kubernetes Engine
  platform: ""
  dnsNdots:
  enforcer:
    enabled: false
  gateway:
    # change address to gateway endpoint. For Saas use the hostname containing `-gw`
    # from your onboarding email and switch port to 443
    address: aqua-gateway-svc.aqua
    port: 8443
  imageCredentials:
    # change to true if deploying enforcer on new cluster or aqua-registry-secret secret doesn't exist.
    create: false
    # use it to overwrite the default secret name
    name:
    # for dockerhub - "docker.io"
    repositoryUriPrefix: "registry.aquasec.com"
    #REQUIRED only if create is true, for dockerhub - "index.docker.io/v1/"
    registry: "registry.aquasec.com"
    username: ""
    password: ""

serviceAccount:
  # change to true if deploying enforcer on new cluster or aqua-sa serviceAccount doesn't exist.
  create: false
  attachImagePullSecret: true
  # use it to overwrite the default serviceAccount name
  name:

clusterRole:
  roleRef: ""

# Hashicorp Vault is a secrets management tool
# Below vaultSecret and vaultAnnotations section helps setting vault sidecar/initContainer agents to load enforcer-token securely
vaultSecret:
  enabled: false          # Enable to true once you have secrets in vault and annotations are enabled to load enforcer token from hashicorp vault
  vaultFilepath: ""       # Change the path to "/vault/secrets/<filename>" as per the setup

# Add hashicorp Vault annotations to enable sidecar/init-container vault agent to load enforcer token
# example annotations for self-hosted vault server:
vaultAnnotations:
  ####
  # vault.hashicorp.com/agent-inject: "true"
  # vault.hashicorp.com/agent-inject-status: update
  # vault.hashicorp.com/agent-pre-populate-only: 'false'                 # Enable to true to add vault agent as init-container without sidecar
  # vault.hashicorp.com/role: "aqua-enforcer"                            # Specify your role used by vault agent auto-auth
  # vault.hashicorp.com/agent-inject-secret-enforcer-token: ""           # Specify your vault secrets path eg: `aqua-path/data/aqua-enforcer/token`
  # vault.hashicorp.com/agent-inject-template-enforcer-token: |
  #   {{- with secret "aqua-path/data/aqua-enforcer/token" -}}
  #   export AQUA_TOKEN="{{ .Data.data.token}}"
  #   {{- end -}}
  ####
  # Change aqua secret path as per the setup
  # Add the secrets in Key Value pair as environment variable


# Enter the enforcer token in "clear-text" format without quotes generated from the Console UI
enforcerToken: enforcer-token

# Use these values to reference a pre-existing secret for the enforcer token.
# Setting these values will make the chart ignore the content of enforcerToken
enforcerTokenSecretName: null
enforcerTokenSecretKey: null

logicalName:
nodeName:
nameOverride:

expressMode: false

securityContext:
  privileged: false
  capabilities:
    add:
      - SYS_ADMIN
      - NET_ADMIN
      - NET_RAW
      - SYS_PTRACE
      - KILL
      - MKNOD
      - SETGID
      - SETUID
      - SYS_MODULE
      - AUDIT_CONTROL
      - SYSLOG
      - SYS_CHROOT
      - SYS_RESOURCE
      - IPC_LOCK

# podsSecurity policy [Deprecated from kubernetes version > 1.21]
# if securityContext.privileged is set to true, the podSecurityPolicy will be configured to grant privileged access
podSecurityPolicy:
  create: false     # Enable to true to create PSP

multiple_gateway: # enable this to connect enforcer with multiple gateways
  enabled: false
# use the below hosts to add multiple gateways as required to enforcer. Format is <hostname>:<port_number>
multi_gates:
- aqua-gateway1-svc:8443 #example gateway 1
- aqua-gateway2-svc:8443 #example gateway 2


image:
  repository: enforcer
  tag: "2022.4"
  pullPolicy: Always

restartPolicy: Always

healthMonitor:
  enabled: "true"

livenessProbe:
  httpGet:
    path: /healthz
    port: 8096
  initialDelaySeconds: 60
  periodSeconds: 30
readinessProbe:
  httpGet:
    path: /readinessz
    port: 8096
  initialDelaySeconds: 60
  periodSeconds: 30
resources: {}
  # Note: For recommendations please check the official sizing guide.
  # requests:
  #   cpu: 350m
  #   memory: 0.512Gi
  # limits:
  #   cpu: 1500m
  #   memory: 1.5Gi
nodeSelector: {}
tolerations: []
podAnnotations: {}
podLabels: {}
podSecurityContext: {}
affinity: {}
#  my-annotation-key: my value; more value

dnsPolicy: "ClusterFirst"
hostPID: "true"
hostRunPath: ""
schedulerName: "default-scheduler"
terminationGracePeriodSeconds: "30"

updateStrategy:
  maxUnavailable: 1
  type: "RollingUpdate"

priorityClass:
  create: false
  name:
  preemptionPolicy: "PreemptLowerPriority"
  value: 1000000

TLS:
  enabled: false
  # provide certificates secret name created to enable tls/mtls communication between enforcer and gateway/envoy
  secretName: ""
  #provide filename of the public key eg: aqua_enforcer.crt
  publicKey_fileName: ""
  #provide filename of the private key eg: aqua_enforcer.key
  privateKey_fileName: ""
  #provide filename of the rootCA, if using self-signed certificates eg: rootCA.crt
  rootCA_fileName: ""
  # change it to true for enabling mTLS between enforcer and gateway/envoy
  tls_verify: false

# extraEnvironmentVars is a list of extra environment variables to set in the enforcer daemonSet.
# https://docs.aquasec.com/docs/enforcer-optional-variables
# The variables could be provided via values.yaml file as shown below
# or using cli command, for example:  --set extraEnvironmentVars.http_proxy="1.1.1.1",extraEnvironmentVars.https_proxy="2.2.2.2"
extraEnvironmentVars: {}
  # http_proxy:
  # https_proxy:
  # no_proxy:
  # AQUA_OCP_FULL_VERSION: <OCP version> #set this variable with the exact OCP version to allow accurate vulnerability scanning
  # ENV_NAME: value

# extraSecretEnvironmentVars is a list of extra environment variables to set in the enforcer daemonSet.
# These variables take value from existing Secret objects.
extraSecretEnvironmentVars: []
  # - envName: ENV_NAME
  #   secretName: name
  #   secretKey: key

windowsEnforcer:
  ## To Enable Windows Enforcer to deploy on windows agents
  allWinNodes: # Enable to true, If All the nodes are Windows os
    enable: false

  WinLinuxNodes: # Enable to true, If nodes are combination of linux and Windows os
    enable: false

  # Enter the enforcer token in "clear-text" format without quotes generated from the Console UI
  enforcerToken: enforcer-token

  # Use these values to reference a pre-existing secret for the enforcer token.
  # Setting these values will make the chart ignore the content of enforcerToken
  enforcerTokenSecretName: null
  enforcerTokenSecretKey: null

  nodeName:

  securityContext:
    windowsOptions:
      hostProcess: true
      runAsUserName: "NT AUTHORITY\\SYSTEM"

  multiple_gateway: # enable this to connect enforcer with multiple gateways
    enabled: false
  # use the below hosts to add multiple gateways as required to enforcer. Format is <hostname>:<port_number>
  multi_gates:
  - aqua-gateway1-svc:8443 #example gateway 1
  - aqua-gateway2-svc:8443 #example gateway 2


  image:
    repository: windows-enforcer
    tag: "2022.4"
    pullPolicy: Always

  restartPolicy: Always

  healthMonitor:
    enabled: "true"

  livenessProbe:
    exec:
      command:
      - powershell.exe
      - -c
      - Get-Service -Name slkd | Where-Object {$_.Status -eq "Running"}
    timeoutSeconds: 5
    initialDelaySeconds: 15
    periodSeconds: 15

  readinessProbe:
    exec:
      command:
      - powershell.exe
      - -c
      - Start-Process -FilePath "C:\Program Files\AquaSec\slk.exe" -ArgumentList @("health","check") -Wait -NoNewWindow -RedirectStandardOutput "$Env:TEMP\aqua-enforcer-health.check";
      - $connection = Get-Content -Path "$Env:TEMP\aqua-enforcer-health.check" | Select-String "connection to management server";
      - Get-Content -Path "$Env:TEMP\aqua-enforcer-health.check";
      - if ($connection | Select-String "PASSED" -Quiet) {
          Exit 0;
        };
      - Exit 1;
    timeoutSeconds: 15
    initialDelaySeconds: 15
    periodSeconds: 15

  resources: {}
    # Note: For recommendations please check the official sizing guide.
    # requests:
    #   cpu: 350m
    #   memory: 0.512Gi
    # limits:
    #   cpu: 1500m
    #   memory: 1.5Gi

  # Add nodeSelector of windows agents
  nodeSelector: {}
    #kubernetes.io/os: windows

  # Add tolerations of windows agents
  tolerations: []
    #- key: "kubernetes.io/os"
    #  operator: "Equal"
    #  value: "windows"
    #  effect: "NoSchedule"

  podAnnotations: {}
  podLabels: {}
  affinity: {}
  #  my-annotation-key: my value; more value

  dnsPolicy: "ClusterFirst"
  dnsNdots: ""
  hostNetwork: "true"
  hostPID: "true"
  schedulerName: "default-scheduler"
  terminationGracePeriodSeconds: "30"

  updateStrategy:
    maxUnavailable: 1
    type: "RollingUpdate"

  priorityClass:
    create: false
    name:
    preemptionPolicy: "PreemptLowerPriority"
    value: 1000000

  TLS:
    enabled: false
    # provide certificates secret name created to enable tls/mtls communication between enforcer and gateway/envoy
    secretName: ""
    #provide filename of the public key eg: aqua_enforcer.crt
    publicKey_fileName: ""
    #provide filename of the private key eg: aqua_enforcer.key
    privateKey_fileName: ""
    #provide filename of the rootCA, if using self-signed certificates eg: rootCA.crt
    rootCA_fileName: ""
    # change it to true for enabling mTLS between enforcer and gateway/envoy
    tls_verify: false

  # extraEnvironmentVars is a list of extra environment variables to set in the enforcer daemonSet.
  # https://docs.aquasec.com/docs/enforcer-optional-variables
  # The variables could be provided via values.yaml file as shown below
  # or using cli command, for example:  --set extraEnvironmentVars.http_proxy="1.1.1.1",extraEnvironmentVars.https_proxy="2.2.2.2"
  extraEnvironmentVars: {}
    # http_proxy:
    # https_proxy:
    # no_proxy:
    # AQUA_OCP_FULL_VERSION: <OCP version> #set this variable with the exact OCP version to allow accurate vulnerability scanning
    # ENV_NAME: value

  # extraSecretEnvironmentVars is a list of extra environment variables to set in the enforcer daemonSet.
  # These variables take value from existing Secret objects.
  extraSecretEnvironmentVars: []
    # - envName: ENV_NAME
    #   secretName: name
    #   secretKey: key