KubeAid/argocd-helm-charts/vuls-dictionary/values.yaml at 5a5fc80003c07276ec963e1db4992c4f92fcf227 · Obmondo/KubeAid · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# This is for the secretes for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
imagePullSecrets: []
# This is to override the chart name.
nameOverride: ""
fullnameOverride: ""

#This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Automatically mount a ServiceAccount's API credentials?
  automount: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

# This is for setting Kubernetes Annotations to a Pod.
# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
podAnnotations: {}
# This is for setting Kubernetes Labels to a Pod.
# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
podLabels: {}

podSecurityContext: {}

securityContext: {}

# This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
ingress:
  enabled: false
  className: ""
  annotations: {}
  vulsServer:
    enabled: false
    hosts:
      - host: chart-example.local
        paths:
          - path: /vuls
            pathType: Prefix
  tls: []

nodeSelector: {}

tolerations: []

affinity: {}

vulsExporter:
  enabled: false
  image:
    repository: ghcr.io/obmondo/vuls-exporter
    tag: 1.2.0
    pullPolicy: IfNotPresent
  obmondo:
    url: ""
  interval: "12h"
  tls:
    secretName: ""
    certFile: /etc/ssl/vuls-exporter/tls.crt
    keyFile: /etc/ssl/vuls-exporter/tls.key
    caFile: ""
  resources:
    requests:
      cpu: 20m
      memory: 32Mi
    limits:
      cpu: 50m
      memory: 64Mi

# vuls2 unified database.
vuls2:
  enabled: true
  image:
    repository: ghcr.io/vulsio/vuls-nightly-db
    tag: "0"
    pullPolicy: IfNotPresent

# NVD CVE dictionary (go-cve-dictionary). A CronJob refreshes
# /vuls/cve.sqlite3 on the results PVC so the vuls server enriches scan
# results with NVD CVSS scores (the "nvd" source in cveContents).
# The full NVD dataset is several GB — make sure resultsStorage.size has
# headroom on top of the ~11 GB vuls.db.
# The vuls server only picks up a refreshed dictionary after a restart
# (it holds the old file handle), so restart the deployment after a run.
cveDictionary:
  enabled: true
  image:
    repository: vuls/go-cve-dictionary
    tag: v0.16.2
    pullPolicy: IfNotPresent
  # The first fill takes hours (unauthenticated NVD API). Trigger it
  # manually instead of waiting for the schedule:
  #   kubectl create job --from=cronjob/<release>-cve-dictionary-fetch cve-fetch-initial
  schedule: "0 3 * * 0"
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 1Gi

vulsServer:
  enabled: true
  image:
    repository: vuls/vuls
    tag: "v0.39.3"
    pullPolicy: IfNotPresent
  port: 5515
  resources:
    requests:
      cpu: 50m
      memory: 256Mi
    limits:
      cpu: 100m
      memory: 512Mi
  resultsStorage:
    storageClass: ""
    size: 15Gi
    accessMode: ReadWriteOnce