main.yaml

##
# GLOBAL CONFIGURATIONS
##
domain: tatooine.dev

##
# SERVICE MESH (Istio, Istio Operator, Kiali)
##
istio:
  enabled: true
  gateways:
    public:
      tls:
        mode: MUTUAL
        cert: "" # set in secrets overlay
        key: "" # set in secrets overlay
        ca: "" # set in secrets overlay
  values:
    hub: cgr.dev/chainguard
    tag: latest
    values:
      pilot:
        image: istio-pilot
      global:
        proxy:
          image: istio-proxy
        proxy_init:
          image: istio-proxy
    postInstallHook:
      image: cgr.dev/chainguard/kubectl
      tag: latest

istioOperator:
  enabled: true
  values:
    hub: cgr.dev/chainguard
    image: istio-operator
    tag: latest

kiali:
  enabled: false

##
# LOGGING (Loki, Promtail)
##
loki:
  enabled: true
  strategy: "monolith"
  values:
    minio:
      enabled: false
    loki:
      image:
        registry: cgr.dev
        repository: chainguard/loki
        tag: latest
    gateway:
      image:
        registry: cgr.dev
        repository: chainguard/nginx
        tag: latest
    sidecar:
      image:
        registry: cgr.dev
        repository: chainguard/k8s-sidecar
        tag: latest

promtail:
  enabled: true
  values:
    image:
      registry: cgr.dev
      repository: chainguard/promtail
      tag: latest
    sidecar:
      configReloader:
        image:
          registry: cgr.dev
          repository: chainguard/configmap-reload
          tag: latest

##
# POLICY ENFORCEMENT (Kyverno, Kyverno Policies, Kyverno Reporter)
##
kyverno:
  enabled: true
  values:
    image:
      registry: cgr.dev
      repository: chainguard/kyverno
      tag: latest
    admissionController:
      initContainer:
        image:
          registry: cgr.dev
          repository: chainguard/kyvernopre
          tag: latest
      container:
        image:
          registry: cgr.dev
          repository: chainguard/kyverno
          tag: latest
    webhooksCleanup:
      image:
        registry: cgr.dev
        repository: chainguard/kubectl
        tag: latest-dev
    policyReportsCleanup:
      image:
        registry: cgr.dev
        repository: chainguard/kubectl
        tag: latest-dev
    backgroundController:
      image:
        registry: cgr.dev
        repository: chainguard/kyverno-background-controller
        tag: latest
    cleanupController:
      image:
        registry: cgr.dev
        repository: chainguard/kyverno-cleanup-controller
        tag: latest
    reportsController:
      image:
        registry: cgr.dev
        repository: chainguard/kyverno-reports-controller
        tag: latest
    cleanupJobs:
      admissionReports:
        image:
          registry: cgr.dev
          repository: chainguard/kubectl
          tag: latest-dev
      clusterAdmissionReports:
        image:
          registry: cgr.dev
          repository: chainguard/kubectl
          tag: latest-dev

kyvernoPolicies:
  enabled: true
  values:
    policies:
      disallow-image-tags:
        validationFailureAction: audit
      disallow-shared-subpath-volume-writes:
        validationFailureAction: audit
      restrict-host-ports:
        validationFailureAction: audit
      restrict-capabilities:
        validationFailureAction: audit
      restrict-image-registries:
        validationFailureAction: audit
        parameters:
          allow:
            - cgr.dev
      disallow-host-namespaces:
        validationFailureAction: audit
      disallow-privileged-containers:
        validationFailureAction: audit
      require-non-root-user:
        validationFailureAction: audit
      restrict-host-path-mount-pv:
        validationFailureAction: audit
    waitforready:
      image:
        repository: cgr.dev/chainguard/kubectl
        tag: latest-dev

kyvernoReporter:
  enabled: true
  values:
    image:
      registry: cgr.dev
      repository: chainguard/kyverno-policy-reporter
      tag: latest

##
# MONITORING (Prometheus, Grafana)
##
monitoring:
  enabled: true
  values:
    alertmanager:
      alertmanagerSpec:
        image:
          repository: chainguard/alertmanager
          tag: latest
          registry: cgr.dev
    grafana:
      sidecar:
        image:
          repository: cgr.dev/chainguard/k8s-sidecar
          tag: latest
        resources:
          limits:
            cpu: 500m
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
      image:
        registry: cgr.dev
        repository: chainguard/grafana
        tag: latest
      downloadDashboardsImage:
        repository: cgr.dev/chainguard/curl
        tag: latest-dev
    kube-state-metrics:
      image:
        registry: cgr.dev
        repository: chainguard/kube-state-metrics
        tag: latest
    prometheus:
      prometheusSpec:
        image:
          repository: chainguard/prometheus
          tag: latest
          registry: cgr.dev
    prometheusOperator:
      admissionWebhooks:
        cleanupProxy:
          image:
            registry: cgr.dev
            repository: chainguard/curl
            tag: latest
        patch:
          image:
            registry: cgr.dev
            repository: chainguard/kube-webhook-certgen
            tag: latest@sha256:fc0791df5584c2cae64ecfdeb8ae98f38d07822939f80c0bd7379892bc90e6e7
        enabled: true
      image:
        registry: cgr.dev
        repository: chainguard/prometheus-operator
        tag: latest
      thanosImage:
        registry: cgr.dev
        repository: chainguard/thanos
        tag: latest
      prometheusConfigReloader:
        image:
          registry: cgr.dev
          repository: chainguard/prometheus-config-reloader
          tag: latest
        thanosImage:
          registry: cgr.dev
          repository: chainguard/thanos
          tag: latest
        kubectlImage:
          registry: cgr.dev
          repository: chainguard/kubectl
          tag: latest-dev
    prometheus-node-exporter:
      image:
        registry: cgr.dev
        repository: chainguard/prometheus-node-exporter
        tag: latest
      version: 1.7.0
    thanosRuler:
      thanosRulerSpec:
        image:
          registry: cgr.dev
          repository: chainguard/thanos
          tag: latest

grafana:
  enabled: true
  values:
    sidecar:
      image:
        repository: chainguard/k8s-sidecar
        tag: latest
      resources:
        limits:
          cpu: 500m
          memory: 500Mi
        requests:
          cpu: 100m
          memory: 100Mi
    global:
      imageRegistry: cgr.dev
    image:
      repository: chainguard/grafana
      tag: latest
    downloadDashboardsImage:
      repository: chainguard/curl
      tag: latest-dev

##
# DISTRIBUTED TRACING (Tempo)
##
tempo:
  enabled: false

##
# RUNTIME SECURITY (Neuvector)
##
neuvector:
  enabled: false
  values:
    registry: cgr.dev
    tag: latest
    global:
      azure:
        images:
          controller:
            registry: cgr.dev
            image: chainguard/neuvector-controller
            digest: latest
          manager:
            registry: cgr.dev
            image: chainguard/neuvector-manager
            digest: latest
          scanner:
            registry: cgr.dev
            image: chainguard/neuvector-scanner
            digest: latest
          enforcer:
            registry: cgr.dev
            image: chainguard/neuvector-enforcer
            digest: latest
    controller:
      image:
        repository: chainguard/neuvector-controller
    enforcer:
      image:
        repository: chainguard/neuvector-enforcer
    manager:
      image:
        repository: chainguard/neuvector-manager
    cve:
      adapter:
        image:
          repository: chainguard/neuvector-registry-adapter
      updater:
        image:
          repository: ironbank/big-bang/base
      scanner:
        image:
          repository: chainguard/neuvector-scanner

## 
# ADDONS (Metrics Server)
##
addons:
  metricsServer:
    enabled: auto
    values:
      image:
        repository: cgr.dev/chainguard/metrics-server
        tag: latest
      args:
        - "--kubelet-insecure-tls"

##
# CUSTOM PACKAGES
##
helmRepositories:
  - name: cosmology-charts
    repository: "oci://registry.gitlab.com/willswire/cosmology/charts"
    type: "oci"
    username: ""
    password: ""
    email: ""
  - name: shadows-edge-charts
    repository: "oci://registry.gitlab.com/90cos"
    type: "oci"
    username: ""
    password: ""
    email: ""

packages:
  clip:
    enabled: true
    wrapper:
      enabled: true
    helmRepo:
      repoName: cosmology-charts
      chartName: clip
      tag: 0.2.0
    dependsOn:
      - name: istio
        namespace: bigbang
    secrets:
      - name: cloudflare-credentials
        data:
          AUTH_KEY: "" # set in secrets overlay
          ZONE_ID: "" # set in secrets overlay
  underhill:
    enabled: true
    wrapper:
      enabled: true
    istio:
      injection: "disabled"
    helmRepo:
      repoName: shadows-edge-charts
      chartName: underhill
      tag: '0.0.x-dev'
    dependsOn:
      - name: istio
        namespace: bigbang
    values:
      domain: tatooine.dev
      gateway: istio-system/public