-
Notifications
You must be signed in to change notification settings - Fork 92
/
values.yaml
295 lines (287 loc) · 6.95 KB
/
values.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
namespace:
create: false
name: rekor-system
imagePullSecrets: []
initContainerImage:
curl:
registry: docker.io
repository: curlimages/curl
# -- 8.10.1
version: sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b
imagePullPolicy: IfNotPresent
initContainerResources: {}
redis:
enabled: true
replicaCount: 1
hostname: ""
port: 6379
args:
- --bind
- 0.0.0.0
- --appendonly
- "yes"
name: redis
image:
registry: docker.io
repository: redis
pullPolicy: IfNotPresent
# -- 6.2.16-alpine3.20
version: "sha256:2ba50e1ac3a0ea17b736ce9db2b0a9f6f8b85d4c27d5f5accc6a416d8f42c6d5"
resources: {}
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 1
failureThreshold: 3
successThreshold: 1
exec:
command:
- /bin/sh
- -i
- -c
- test "$(redis-cli -h 127.0.0.1 ping)" = "PONG"
service:
type: ClusterIP
ports:
- name: 6379-tcp
port: 6379
protocol: TCP
targetPort: 6379
serviceAccount:
create: true
name: ""
annotations: {}
tolerations: []
nodeSelector: {}
affinity: {}
mysql:
gcp:
enabled: false
instance: ""
scaffoldSQLProxy:
registry: ghcr.io
repository: sigstore/scaffolding/cloudsqlproxy
# -- v0.7.15 which is based on cloud-sql-proxy:2.14.0-alpine
version: sha256:862598dc2457fd246dc5363e0bd21462343c89e714dbd4159e49f119e8ff5ca5
resources:
requests:
memory: "2Gi"
cpu: "1"
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
capabilities:
drop:
- ALL
cloudsql:
registry: gcr.io
repository: cloud-sql-connectors/cloud-sql-proxy:2.14.0-alpine
# -- crane digest gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.0-alpine
version: sha256:6dc1d9ea84ff43eaeaebe51bb52de9e24dce8d8affd2fda0dc0d218897456c12
resources:
requests:
memory: "2Gi"
cpu: "1"
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
capabilities:
drop:
- ALL
unixDomainSocket:
enabled: false
path: /cloudsql
enabled: false
replicaCount: 1
name: mysql
hostname: ""
port: 3306
strategy:
type: Recreate
image:
registry: gcr.io
repository: trillian-opensource-ci/db_server
pullPolicy: IfNotPresent
server:
enabled: true
replicaCount: 1
name: server
port: 3000
image:
registry: ghcr.io
repository: sigstore/rekor/rekor-server
pullPolicy: IfNotPresent
# crane digest ghcr.io/sigstore/rekor/rekor-server:v1.3.7
version: sha256:b0358d1d1d399bc50f1375fcf4f665e4432bebd7fc4900d893ddc788f05fc76e
# -- KMS type for signing key (possible values: "" / "none", "aws")
kmsType: none
# -- AWS region if using AWS KMS for signing key
awsKmsRegion: us-east-1
# -- kubernetes secret name containing IAM credentials for use with AWS KMS
awsKmsCredentialsSecretName: aws-kms-credentials
logging:
production: false
ingress:
enabled: true
className: "nginx"
hosts:
- path: /
host: root
annotations: {}
tls: []
ingresses:
- enabled: false
name: "gce-ingress"
className: "gce"
hosts:
- path: /
host: root
annotations: {}
tls: []
staticGlobalIP: lb-ext-ip
frontendConfigSpec: # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_frontendconfig_parameters
sslPolicy: rekor-ssl-policy
redirectToHttps:
enabled: true
backendConfigSpec: # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters
securityPolicy:
name: rekor-security-policy
logging:
enable: true
service:
type: ClusterIP
ports:
- name: 3000-tcp
port: 80
protocol: TCP
targetPort: 3000
- name: 2112-tcp
port: 2112
protocol: TCP
targetPort: 2112
signer: memory
readinessProbe:
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 1
failureThreshold: 3
successThreshold: 1
httpGet:
port: 3000
path: /ping
sharding:
mountPath: /sharding
filename: sharding-config.yaml
contents: ""
livenessProbe:
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 1
failureThreshold: 3
successThreshold: 1
httpGet:
port: 3000
path: /ping
securityContext:
runAsNonRoot: true
runAsUser: 65533
config:
key: treeID
treeID: ""
retrieve_api:
enabled: true
attestation_storage:
enabled: true
bucket: file:///var/run/attestations
persistence:
enabled: true
annotations: {}
storageClass: ""
size: 5Gi
mountPath: /var/lib/mysql
subPath: ""
existingClaim: ""
accessModes:
- ReadWriteOnce
podAnnotations:
prometheus.io/scrape: "true"
prometheus.io/path: /metrics
prometheus.io/port: "2112"
resources: {}
extraArgs: []
serviceAccount:
create: true
name: ""
annotations: {}
searchIndex:
storageProvider: ""
mysql: {}
tolerations: []
nodeSelector: {}
affinity: {}
createtree:
name: createtree
force: false
image:
registry: ghcr.io
repository: sigstore/scaffolding/createtree
pullPolicy: IfNotPresent
# v0.7.15
version: sha256:ee42272373b46a898b21a0aea21cf703e90048e03f45a4640381b4a04735ffd8
ttlSecondsAfterFinished: 3600
serviceAccount:
create: true
name: ""
annotations: {}
securityContext:
runAsNonRoot: true
runAsUser: 65533
resources: {}
annotations: {}
tolerations: []
nodeSelector: {}
affinity: {}
# Configure backfillredis to repair indices that were not inserted into Redis.
backfillredis:
name: backfillredis
enabled: false
image:
registry: ghcr.io
repository: sigstore/rekor/backfill-redis
pullPolicy: IfNotPresent
# v1.3.6
version: sha256:a13cd8b2a554d6116888fd1f383cf6e91fc1716df5eda392b82e6bfc66995ec3
ttlSecondsAfterFinished: 3600
securityContext:
runAsNonRoot: true
runAsUser: 65533
rekorAddress: rekor.rekor-system.svc
startIndex: -1
endIndex: -1
resources: {}
tolerations: []
nodeSelector: {}
affinity: {}
# Configure Trillian dependency
trillian:
enabled: true
namespace:
name: trillian-system
create: true
forceNamespace: trillian-system
fullnameOverride: trillian
adminServer: ""
logServer:
name: trillian-logserver
fullnameOverride: trillian-logserver
portHTTP: 8090
portRPC: 8091
logSigner:
name: trillian-logsigner
fullnameOverride: trillian-logsigner
mysql:
fullnameOverride: trillian-mysql
# Force namespace of namespaced resources
forceNamespace: ""