staging.yaml

release: c1dd7d38b5b672ef5f4b342b31b783b159178cb0
trustImage: ghcr.io/trustification/trust
uiImage: ghcr.io/trustification/trust
docsImage: ghcr.io/trustification/trust-docs
testsImage: ghcr.io/trustification/trust-tests
guacImage: ghcr.io/trustification/guac:v0.3.32
domain: staging.trustification.dev
replicas: 1
imagePullPolicy: IfNotPresent
region: eu-west-1
enableTests: true
createRoutes: true
enableMonitoring: true
enableDocs: true
config:
  enabled: true
  name: trustification-config
  authentication: trustification.dev/config/staging/auth.yaml
  collectorist: trustification.dev/config/staging/collectorist.yaml
default:
  routeAnnotations:
    "haproxy.router.openshift.io/hsts_header": "max-age=31536000;includeSubDomains;preload"
spog:
  crdaUrl: https://rhda.rhcloud.com/
  branding: true
  ui:
    customize: false
    segmentWriteKey:
      valueFrom:
        secretKeyRef:
          name: segment-write-keys
          key: spogUi
    resources:
      requests:
        cpu: "100m"
        memory: "64Mi"
      limits:
        memory: "64Mi"
  api:
    tracing: "enabled"
    segmentWriteKey:
      valueFrom:
        secretKeyRef:
          name: segment-write-keys
          key: spogApi
    snyk:
      credentials: snyk-collector-secret
    resources:
      requests:
        cpu: "100m"
        memory: "512Mi"
      limits:
        memory: "512Mi"
bombastic:
  bucket: bombastic-staging
  credentials: bombastic-credentials-secret
  indexMode: file
  collector:
    enabled: true
    schedule: "0 * * * *"
    resources:
      requests:
        cpu: "100m"
        memory: "4Gi"
      limits:
        cpu: "1"
        memory: "4Gi"
  indexer:
    topics:
      stored: sbom-stored-staging
      indexed: sbom-indexed-staging
      failed: sbom-failed-staging
    indexSyncInterval: 1m
    resources:
      requests:
        cpu: "100m"
        memory: "4Gi"
      limits:
        memory: "4Gi"
  walker:
    enabled: true
    suspend: true
    schedule: "0 * * * *"
    source: "https://access.redhat.com/security/data/sbom/beta/"
    signingKey: "https://access.redhat.com/security/data/97f5eac4.txt#77E79ABE93673533ED09EBE2DCE3823597F5EAC4"
    resources:
      requests:
        cpu: "100m"
        memory: "2Gi"
      limits:
        memory: "2Gi"
  api:
    tracing: "enabled"
    resources:
      requests:
        cpu: "100m"
        memory: "1Gi"
      limits:
        memory: "1Gi"
vexination:
  bucket: vexination-staging
  credentials: vexination-credentials-secret
  indexMode: file
  collector:
    enabled: true
    schedule: "30 * * * *"
    resources:
      requests:
        cpu: "100m"
        memory: "4Gi"
      limits:
        cpu: "1"
        memory: "4Gi"
  indexer:
    topics:
      stored: vex-stored-staging
      indexed: vex-indexed-staging
      failed: vex-failed-staging
    indexSyncInterval: 1m
    resources:
      requests:
        cpu: "100m"
        memory: "2Gi"
      limits:
        memory: "2Gi"
  api:
    tracing: "enabled"
    resources:
      requests:
        cpu: "100m"
        memory: "1Gi"
      limits:
        memory: "1Gi"
  walker:
    enabled: true
    suspend: true
    schedule: "0 * * * *"
    source: https://www.redhat.com/.well-known/csaf/provider-metadata.json
    ignore: https://access.redhat.com/security/data/csaf/v2/advisories/
    resources:
      requests:
        cpu: "100m"
        memory: "2Gi"
      limits:
        memory: "2Gi"
collectorist:
  enabled: false
  api:
    resources:
collector:
  osv:
    enabled: false
    resources:
  snyk:
    enabled: false
    credentials: snyk-collector-secret
    resources:
v11y:
  enabled: true
  bucket: v11y-staging
  credentials: v11y-credentials-secret
  indexMode: file
  api:
    tracing: "enabled"
    resources:
  indexer:
    topics:
      stored: v11y-stored-staging
      indexed: v11y-indexed-staging
      failed: v11y-failed-staging
    indexSyncInterval: 30m
    resources:
      requests:
        cpu: "100m"
        memory: "2Gi"
      limits:
        memory: "2Gi"
  walker:
    enabled: true
    resources:
      requests:
        cpu: "100m"
        memory: "256Mi"
      limits:
        memory: "512Mi"
exhort:
  enabled: true
  api:
    resources:
keycloakRealm:
  redirectUris:
    - http://localhost:*
    - https://staging.trustification.dev
    - https://staging.trustification.dev/*
    - https://sbom.staging.trustification.dev
    - https://sbom.staging.trustification.dev/*
    - https://vex.staging.trustification.dev
    - https://vex.staging.trustification.dev/*
    - https://trustification-*-preview.surge.sh
    - https://trustification-*-preview.surge.sh/*
oidcClients:
  frontend:
    issuerUrl: https://sso.staging.trustification.dev/realms/chicken
    clientId:
      value: frontend
  walker:
    issuerUrl: https://sso.staging.trustification.dev/realms/chicken
    clientSecret:
      valueFrom:
        secretKeyRef:
          name: oidc-client-walker
          key: client-secret
  testingManager:
    issuerUrl: https://sso.staging.trustification.dev/realms/chicken
    clientSecret:
      valueFrom:
        secretKeyRef:
          name: oidc-client-testing-manager
          key: client-secret
  testingUser:
    issuerUrl: https://sso.staging.trustification.dev/realms/chicken
    clientSecret:
      valueFrom:
        secretKeyRef:
          name: oidc-client-testing-user
          key: client-secret
guac:
  enabled: true
  database:
    enabled: true
    image: docker.io/library/postgres:15
  initJob: {}
  graphql:
    debug: true
    affinity:
      # tie to the zone of the RDS database
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: topology.kubernetes.io/zone
                  operator: In
                  values:
                    - eu-west-1c
    resources:
      requests:
        cpu: "100m"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "2Gi"
keycloak:
  enabled: true
  production: true
  proxy: reencrypt
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false
  auth:
    adminUser: admin
    existingSecret: sso-admin
    passwordSecretKey: password
  tls:
    enabled: true
    existingSecret: sso-tls
    usePem: true
  service:
    annotations:
      service.beta.openshift.io/serving-cert-secret-name: sso-tls
  ingress:
    enabled: true
    ingressClassName: openshift-default
    hostname: sso.staging.trustification.dev
    servicePort: https
    annotations:
      route.openshift.io/termination: reencrypt
  postgresql:
    primary:
      containerSecurityContext:
        enabled: false
      podSecurityContext:
        enabled: false
    auth:
      existingSecret: sso-postgres
dataset:
  enabled: true