values.yaml

namespace:
  create: false
  name: rekor-system
imagePullSecrets: []

initContainerImage:
  curl:
    registry: docker.io
    repository: curlimages/curl
    # -- 8.5.0
    version: "sha256:4bfa3e2c0164fb103fb9bfd4dc956facce32b6c5d47cc09fcec883ce9535d5ac"
    imagePullPolicy: IfNotPresent

redis:
  enabled: true
  replicaCount: 1
  hostname: ""
  port: 6379
  args:
    - --bind
    - 0.0.0.0
    - --appendonly
    - "yes"
  name: redis
  image:
    registry: docker.io
    repository: redis
    pullPolicy: IfNotPresent
    # -- 6.2.14-alpine3.19
    version: "sha256:c5a607fb6e1bb15d32bbcf14db22787d19e428d59e31a5da67511b49bb0f1ccc"
  resources: {}
  readinessProbe:
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 1
    failureThreshold: 3
    successThreshold: 1
    exec:
      command:
        - /bin/sh
        - -i
        - -c
        - test "$(redis-cli -h 127.0.0.1 ping)" = "PONG"
  service:
    type: ClusterIP
    ports:
      - name: 6379-tcp
        port: 6379
        protocol: TCP
        targetPort: 6379
  serviceAccount:
    create: true
    name: ""
    annotations: {}

server:
  enabled: true
  replicaCount: 1
  name: server
  port: 3000
  image:
    registry: gcr.io
    repository: projectsigstore/rekor-server
    pullPolicy: IfNotPresent
    # crane digest gcr.io/projectsigstore/rekor-server:v1.3.6
    version: sha256:1237f29e2105d7f5451bbe15a3aca8677ddd1bb80620ca2fd06f74262437cf51
  logging:
    production: false
  ingress:
    enabled: true
    className: "nginx"
    hosts:
      - path: /
        host: root
    annotations: {}
    tls: []
  ingresses:
    - enabled: false
      name: "gce-ingress"
      className: "gce"
      hosts:
        - path: /
          host: root
      annotations: {}
      tls: []
      staticGlobalIP: lb-ext-ip
      frontendConfigSpec:   # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_frontendconfig_parameters
        sslPolicy: rekor-ssl-policy
        redirectToHttps:
          enabled: true
      backendConfigSpec:   # https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters
        securityPolicy:
          name: rekor-security-policy
        logging:
          enable: true
  service:
    type: ClusterIP
    ports:
      - name: 3000-tcp
        port: 80
        protocol: TCP
        targetPort: 3000
      - name: 2112-tcp
        port: 2112
        protocol: TCP
        targetPort: 2112
  signer: memory
  readinessProbe:
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 1
    failureThreshold: 3
    successThreshold: 1
    httpGet:
      port: 3000
      path: /ping
  sharding:
    mountPath: /sharding
    filename: sharding-config.yaml
    contents: ""
  livenessProbe:
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 1
    failureThreshold: 3
    successThreshold: 1
    httpGet:
      port: 3000
      path: /ping
  securityContext:
    runAsNonRoot: true
    runAsUser: 65533
  config:
    key: treeID
    treeID: ""
  retrieve_api:
    enabled: true
  attestation_storage:
    enabled: true
    bucket: file:///var/run/attestations
    persistence:
      enabled: true
      annotations: {}
      storageClass: ""
      size: 5Gi
      mountPath: /var/lib/mysql
      subPath: ""
      existingClaim: ""
      accessModes:
        - ReadWriteOnce
  podAnnotations:
    prometheus.io/scrape: "true"
    prometheus.io/path: /metrics
    prometheus.io/port: "2112"
  resources: {}
  extraArgs: []
  serviceAccount:
    create: true
    name: ""
    annotations: {}
createtree:
  name: createtree
  force: false
  image:
    registry: ghcr.io
    repository: sigstore/scaffolding/createtree
    pullPolicy: IfNotPresent
    # v0.6.17
    version: sha256:eb1a94738f34964c7456d18d30b8a45a654af89bb5371f69b2403df373be0826
  ttlSecondsAfterFinished: 3600
  serviceAccount:
    create: true
    name: ""
    annotations: {}
  securityContext:
    runAsNonRoot: true
    runAsUser: 65533
  resources: {}
  annotations: {}
# Configure backfillredis to repair indices that were not inserted into Redis.
backfillredis:
  name: backfillredis
  enabled: false
  image:
    registry: ghcr.io
    repository: sigstore/rekor/backfill-redis
    pullPolicy: IfNotPresent
    # v1.3.5
    version: sha256:a13cd8b2a554d6116888fd1f383cf6e91fc1716df5eda392b82e6bfc66995ec3
  ttlSecondsAfterFinished: 3600
  securityContext:
    runAsNonRoot: true
    runAsUser: 65533
  rekorAddress: rekor.rekor-system.svc
  startIndex: -1
  endIndex: -1
  resources: {}

# Configure Trillian dependency
trillian:
  enabled: true
  namespace:
    name: trillian-system
    create: true
  forceNamespace: trillian-system
  fullnameOverride: trillian
  adminServer: ""
  logServer:
    name: trillian-logserver
    fullnameOverride: trillian-logserver
    portHTTP: 8090
    portRPC: 8091
  logSigner:
    name: trillian-logsigner
    fullnameOverride: trillian-logsigner
  mysql:
    fullnameOverride: trillian-mysql

# Force namespace of namespaced resources
forceNamespace: ""