values.yaml

{{- define "bigbang.defaults.neuvector" -}}
# Includes suffix of "A1a" to ensure password always meets default minimum password requirements
{{- $neuvectorMetricsPass := join "" (list (randAlphaNum 12) (randAlpha 2 | upper) (randAlpha 2 | lower) (randNumeric 2))}}

# hostname is deprecated and replaced with domain. But if hostname exists then use it.
domain: {{ default .Values.domain .Values.hostname }}

openshift: {{ .Values.openshift }}

{{ $istioInjection := (and .Values.istio.enabled (eq (dig "istio" "injection" "enabled" .Values.neuvector) "enabled")) }}

istio:
  enabled: {{ .Values.istio.enabled }}
  neuvector:
    gateways:
    - istio-system/{{ default "public" .Values.neuvector.ingress.gateway }}
  injection: {{ ternary "enabled" "disabled" $istioInjection }}

{{- if .Values.monitoring.enabled }}
monitoring:
  enabled: true

controller:
  podAnnotations:
    checksum/metrics-pass: {{ sha256sum $neuvectorMetricsPass }}
  secret:
    enabled: true
    data: 
      # This configuration is read in at deploy time and users are created.
      userinitcfg.yaml:
        always_reload: true
        users:
        - username: metrics
          password: {{ $neuvectorMetricsPass }}
          role: reader
          fullname: metrics
      oidcinitcfg.yaml:
        always_reload: true
        enable: {{ .Values.neuvector.sso.enabled }}
        issuer: {{ default (include "sso.url" .) (tpl (default "" .Values.neuvector.sso.issuer) .) }}
        client_id: {{ .Values.neuvector.sso.client_id }}
        client_secret: {{ .Values.neuvector.sso.client_secret }}
        default_role: {{ .Values.neuvector.sso.default_role }} 
    
monitor:
  install: true
  exporter:
    enabled: true
    serviceMonitor:
      enabled: true
      # conditional passes only for default istio: enabled, mTLS: SCRICT
      {{- if and $istioInjection (eq (dig "istio" "mtls" "mode" "STRICT" .Values.neuvector.values) "STRICT") }}
      scheme: https
      tlsConfig:
        caFile: /etc/prom-certs/root-cert.pem
        certFile: /etc/prom-certs/cert-chain.pem
        keyFile: /etc/prom-certs/key.pem
        insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate
      {{- end }}
    svc:
      enabled: true
      type: ClusterIP
    CTRL_USERNAME: metrics
    CTRL_PASSWORD: {{ $neuvectorMetricsPass }}
{{- end }}

{{- if .Values.istio.enabled }}
manager:
  env:
    ssl: false