values.yaml

namespace:
  create: false
  name: rekor-system
imagePullSecrets: []

initContainerImage:
  curl:
    registry: docker.io
    repository: curlimages/curl
    # -- 8.11.1
    version: sha256:c1fe1679c34d9784c1b0d1e5f62ac0a79fca01fb6377cdd33e90473c6f9f9a69
    imagePullPolicy: IfNotPresent
initContainerResources: {}

redis:
  enabled: true
  replicaCount: 1
  hostname: ""
  port: 6379
  args:
    - --bind
    - 0.0.0.0
    - --appendonly
    - "yes"
  name: redis
  image:
    registry: docker.io
    repository: redis
    pullPolicy: IfNotPresent
    # -- 6.2.16-alpine3.20
    version: "sha256:2ba50e1ac3a0ea17b736ce9db2b0a9f6f8b85d4c27d5f5accc6a416d8f42c6d5"
  resources: {}
  readinessProbe:
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 1
    failureThreshold: 3
    successThreshold: 1
    exec:
      command:
        - /bin/sh
        - -i
        - -c
        - test "$(redis-cli -h 127.0.0.1 ping)" = "PONG"
  service:
    type: ClusterIP
    ports:
      - name: 6379-tcp
        port: 6379
        protocol: TCP
        targetPort: 6379
  serviceAccount:
    create: true
    name: ""
    annotations: {}
  tolerations: []
  nodeSelector: {}
  affinity: {}

mysql:
  gcp:
    enabled: false
    instance: ""
    scaffoldSQLProxy:
      registry: ghcr.io
      repository: sigstore/scaffolding/cloudsqlproxy
      # -- v0.7.18 which is based on cloud-sql-proxy:2.14.2-alpine
      version: sha256:77dfbe3f7c196c5e64d9efd6e69fcb025be834c42e82cb5e2120a2a4cea254a3
      resources:
        requests:
          memory: "2Gi"
          cpu: "1"
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        capabilities:
          drop:
            - ALL
    cloudsql:
      registry: gcr.io
      repository: cloud-sql-connectors/cloud-sql-proxy:2.14.2-alpine
      # -- crane digest gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.2-alpine
      version: sha256:0a9a73d045cbec04fd64f6f06f8f5a865c4c75cef1913a54285dbaa75ea6d2ce
      resources:
        requests:
          memory: "2Gi"
          cpu: "1"
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        capabilities:
          drop:
            - ALL
      unixDomainSocket:
        enabled: false
        path: /cloudsql
  enabled: false
  replicaCount: 1
  name: mysql
  hostname: ""
  port: 3306
  strategy:
    type: Recreate
  image:
    registry: gcr.io
    repository: trillian-opensource-ci/db_server
    pullPolicy: IfNotPresent

server:
  enabled: true
  replicaCount: 1
  name: server
  port: 3000
  image:
    registry: ghcr.io
    repository: sigstore/rekor/rekor-server
    pullPolicy: IfNotPresent
    # crane digest ghcr.io/sigstore/rekor/rekor-server:v1.3.8
    version: sha256:9b10d2a1eb8180f9992f73269854328f0d5b27da5d9bfb70c65e1430355f3e96
  # -- KMS type for signing key (possible values: "" / "none", "aws")
  kmsType: none
  # -- AWS region if using AWS KMS for signing key
  awsKmsRegion: us-east-1
  # -- kubernetes secret name containing IAM credentials for use with AWS KMS
  awsKmsCredentialsSecretName: aws-kms-credentials
  logging:
    production: false
  ingress:
    enabled: true
    className: "nginx"
    hosts:
      - path: /
        host: root
    annotations: {}
    tls: []
  ingresses:
    - enabled: false
      name: "gce-ingress"
      className: "gce"
      hosts:
        - path: /
          host: root
      annotations: {}
      tls: []
      staticGlobalIP: lb-ext-ip
      frontendConfigSpec:   # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_frontendconfig_parameters
        sslPolicy: rekor-ssl-policy
        redirectToHttps:
          enabled: true
      backendConfigSpec:   # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters
        securityPolicy:
          name: rekor-security-policy
        logging:
          enable: true
  service:
    type: ClusterIP
    ports:
      - name: 3000-tcp
        port: 80
        protocol: TCP
        targetPort: 3000
      - name: 2112-tcp
        port: 2112
        protocol: TCP
        targetPort: 2112
  signer: memory
  readinessProbe:
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 1
    failureThreshold: 3
    successThreshold: 1
    httpGet:
      port: 3000
      path: /ping
  sharding:
    mountPath: /sharding
    filename: sharding-config.yaml
    contents: ""
  livenessProbe:
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 1
    failureThreshold: 3
    successThreshold: 1
    httpGet:
      port: 3000
      path: /ping
  securityContext:
    runAsNonRoot: true
    runAsUser: 65533
  config:
    key: treeID
    treeID: ""
  retrieve_api:
    enabled: true
  attestation_storage:
    enabled: true
    bucket: file:///var/run/attestations
    persistence:
      enabled: true
      annotations: {}
      storageClass: ""
      size: 5Gi
      mountPath: /var/lib/mysql
      subPath: ""
      existingClaim: ""
      accessModes:
        - ReadWriteOnce
  podAnnotations:
    prometheus.io/scrape: "true"
    prometheus.io/path: /metrics
    prometheus.io/port: "2112"
  resources: {}
  extraArgs: []
  serviceAccount:
    create: true
    name: ""
    annotations: {}
  searchIndex:
    storageProvider: ""
    mysql: {}
  tolerations: []
  nodeSelector: {}
  affinity: {}

createtree:
  name: createtree
  force: false
  image:
    registry: ghcr.io
    repository: sigstore/scaffolding/createtree
    pullPolicy: IfNotPresent
    # v0.7.18
    version: sha256:c950d5bd0375d07e719e02345c73592b9633606a6b2ad0215baae687a2151923
  ttlSecondsAfterFinished: 3600
  serviceAccount:
    create: true
    name: ""
    annotations: {}
  securityContext:
    runAsNonRoot: true
    runAsUser: 65533
  resources: {}
  annotations: {}
  tolerations: []
  nodeSelector: {}
  affinity: {}

# Configure backfillredis to repair indices that were not inserted into Redis.
backfillredis:
  name: backfillredis
  enabled: false
  image:
    registry: ghcr.io
    repository: sigstore/rekor/backfill-redis
    pullPolicy: IfNotPresent
    # v1.3.6
    version: sha256:a13cd8b2a554d6116888fd1f383cf6e91fc1716df5eda392b82e6bfc66995ec3
  ttlSecondsAfterFinished: 3600
  securityContext:
    runAsNonRoot: true
    runAsUser: 65533
  rekorAddress: rekor.rekor-system.svc
  startIndex: -1
  endIndex: -1
  resources: {}
  tolerations: []
  nodeSelector: {}
  affinity: {}

# Configure Trillian dependency
trillian:
  enabled: true
  namespace:
    name: trillian-system
    create: true
  forceNamespace: trillian-system
  fullnameOverride: trillian
  adminServer: ""
  logServer:
    name: trillian-logserver
    fullnameOverride: trillian-logserver
    portHTTP: 8090
    portRPC: 8091
  logSigner:
    name: trillian-logsigner
    fullnameOverride: trillian-logsigner
  mysql:
    fullnameOverride: trillian-mysql

# Force namespace of namespaced resources
forceNamespace: ""