prowler/contrib/k8s/helm/prowler-app/values.yaml

# This is to override the chart name.
nameOverride: ""
fullnameOverride: ""

# Reference to the secret containing the API authentication secret.
# Used to inject the environment variable for the API container.
djangoTokenSigningKey:
  secretKeyRef:
    name: prowler-secret
    key: DJANGO_TOKEN_SIGNING_KEY
djangoTokenVerifyingKey:
  secretKeyRef:
    name: prowler-secret
    key: DJANGO_TOKEN_VERIFYING_KEY
djangoSecretsEncryptionKey:
  secretKeyRef:
    name: prowler-secret
    key: DJANGO_SECRETS_ENCRYPTION_KEY

ui:
  # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
  replicaCount: 1

  # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
  image:
    repository: prowlercloud/prowler-ui
    # This sets the pull policy for images.
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: ""

  # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  imagePullSecrets: []

  # Reference to the secret containing the UI authentication secret.
  # Used to inject the environment variable for the UI container.
  # By default, expects a Secret named 'prowler-secret' with a key 'AUTH_SECRET'.
  authSecret:
    secretKeyRef:
      name: prowler-secret
      key: AUTH_SECRET

  # Secret names to be used as env vars.
  secrets: []
    # - "prowler-ui-secret"

  # This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
  serviceAccount:
    # Specifies whether a service account should be created
    create: true
    # Automatically mount a ServiceAccount's API credentials?
    automount: true
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  # This is for setting Kubernetes Annotations to a Pod.
  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  podAnnotations: {}
  # This is for setting Kubernetes Labels to a Pod.
  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  podLabels: {}

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  # This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
  service:
    # This sets the service type more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
    # This sets the ports more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#field-spec-ports
    port: 3000

  # The URL of the UI. This is only set if ingress is disabled.
  authUrl: ""

  # This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
  ingress:
    enabled: false
    className: ""
    annotations: {}
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
    hosts:
      - host: chart-example.local
        paths:
          - path: /
            pathType: ImplementationSpecific
    tls: []
    #  - secretName: chart-example-tls
    #    hosts:
    #      - chart-example.local

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  # This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
  livenessProbe:
    httpGet:
      path: /
      port: http
  readinessProbe:
    httpGet:
      path: /
      port: http

  # This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80

  # Additional volumes on the output Deployment definition.
  volumes: []
  # - name: foo
  #   secret:
  #     secretName: mysecret
  #     optional: false

  # Additional volumeMounts on the output Deployment definition.
  volumeMounts: []
  # - name: foo
  #   mountPath: "/etc/foo"
  #   readOnly: true

  nodeSelector: {}

  tolerations: []

  affinity: {}

api:
  # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
  replicaCount: 1

  # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
  image:
    repository: prowlercloud/prowler-api
    # This sets the pull policy for images.
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: ""

  # Shared with celery-worker and celery-beat
  djangoConfig:
    # API scan settings
    # The path to the directory where scan output should be stored
    DJANGO_TMP_OUTPUT_DIRECTORY: "/tmp/prowler_api_output"
    # The maximum number of findings to process in a single batch
    DJANGO_FINDINGS_BATCH_SIZE: "1000"
    # Django settings
    DJANGO_ALLOWED_HOSTS: "*"
    DJANGO_BIND_ADDRESS: "0.0.0.0"
    DJANGO_PORT: "8080"
    DJANGO_DEBUG: "False"
    DJANGO_SETTINGS_MODULE: "config.django.production"
    # Select one of [ndjson|human_readable]
    DJANGO_LOGGING_FORMATTER: "ndjson"
    # Select one of [DEBUG|INFO|WARNING|ERROR|CRITICAL]
    # Applies to both Django and Celery Workers
    DJANGO_LOGGING_LEVEL: "INFO"
    # Defaults to the maximum available based on CPU cores if not set.
    DJANGO_WORKERS: "4"
    # Token lifetime is in minutes
    DJANGO_ACCESS_TOKEN_LIFETIME: "30"
    # Token lifetime is in minutes
    DJANGO_REFRESH_TOKEN_LIFETIME: "1440"
    DJANGO_CACHE_MAX_AGE: "3600"
    DJANGO_STALE_WHILE_REVALIDATE: "60"
    DJANGO_MANAGE_DB_PARTITIONS: "True"
    DJANGO_BROKER_VISIBILITY_TIMEOUT: "86400"
    # Caps the Celery prefork pool size on the worker pods. Without it, Celery
    # sizes the pool from the number of visible CPUs, so on large nodes the
    # worker spawns one child per CPU, each loading the full Prowler SDK, and
    # OOMKills under memory pressure. Raise it on bigger workers.
    DJANGO_CELERY_WORKER_CONCURRENCY: "2"

  # Secret names to be used as env vars for api, worker, and worker_beat.
  secrets: []
    # - "prowler-api-keys"

  command:
    - /home/prowler/docker-entrypoint.sh
  args:
    - prod

  # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  imagePullSecrets: []

  # This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
  serviceAccount:
    # Specifies whether a service account should be created
    create: true
    # Automatically mount a ServiceAccount's API credentials?
    automount: true
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  # This is for setting Kubernetes Annotations to a Pod.
  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  podAnnotations: {}
  # This is for setting Kubernetes Labels to a Pod.
  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  podLabels: {}

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  # This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
  service:
    # This sets the service type more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
    # This sets the ports more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#field-spec-ports
    port: 8080

  # This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
  ingress:
    enabled: false
    className: ""
    annotations: {}
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
    hosts:
      - host: chart-example.local
        paths:
          - path: /
            pathType: ImplementationSpecific
    tls: []
    #  - secretName: chart-example-tls
    #    hosts:
    #      - chart-example.local

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  # 3m30s to setup DB
  # startupProbe:
  #   httpGet:
  #     path: /health/live
  #     port: http

  # This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
  # /health/live succeeds while the process answers; /health/ready also
  # checks PostgreSQL, Valkey and Neo4j connectivity and returns 503 when
  # any of them is unreachable.
  livenessProbe:
    failureThreshold: 10
    httpGet:
      path: /health/live
      port: http
    periodSeconds: 20
  readinessProbe:
    failureThreshold: 10
    httpGet:
      path: /health/ready
      port: http
    periodSeconds: 20

  # This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80

  # Additional volumes on the output Deployment definition.
  volumes: []
  # - name: foo
  #   secret:
  #     secretName: mysecret
  #     optional: false

  # Additional volumeMounts on the output Deployment definition.
  volumeMounts: []
  # - name: foo
  #   mountPath: "/etc/foo"
  #   readOnly: true

  nodeSelector: {}

  tolerations: []

  affinity: {}

worker:
  # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
  replicaCount: 1

  # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
  image:
    repository: prowlercloud/prowler-api
    # This sets the pull policy for images.
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: ""

  command:
    - /home/prowler/docker-entrypoint.sh
  args:
    - worker

  # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  imagePullSecrets: []

  # This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
  serviceAccount:
    # Specifies whether a service account should be created
    create: true
    # Automatically mount a ServiceAccount's API credentials?
    automount: true
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  # This is for setting Kubernetes Annotations to a Pod.
  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  podAnnotations: {}
  # This is for setting Kubernetes Labels to a Pod.
  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  podLabels: {}

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  # This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
  livenessProbe: {}
  readinessProbe: {}

  # This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 10
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 80

  # Additional volumes on the output Deployment definition.
  volumes: []
  # - name: foo
  #   secret:
  #     secretName: mysecret
  #     optional: false

  # Additional volumeMounts on the output Deployment definition.
  volumeMounts: []
  # - name: foo
  #   mountPath: "/etc/foo"
  #   readOnly: true

  nodeSelector: {}

  tolerations: []

  affinity: {}

  # KEDA ScaledObject configuration
  keda:
    # -- Set to `true` to enable KEDA for the worker pods
    # Note: When both KEDA and HPA are enabled, the deployment will fail.
    enabled: false
    # -- The minimum number of replicas to use for the worker pods
    minReplicas: 1
    # -- The maximum number of replicas to use for the worker pods
    maxReplicas: 2
    # -- The polling interval in seconds for checking metrics
    pollingInterval: 30
    # -- The cooldown period in seconds for scaling
    cooldownPeriod: 120
    # -- The KEDA scaler type. Only `postgresql` is supported by the default query below.
    triggerType: "postgresql"
    # PostgreSQL connection used by the scaler query. The KEDA operator opens this
    # connection from its own namespace, so `host` must resolve from there. The
    # defaults target the bundled postgresql subchart; set them explicitly when
    # using an external database (postgresql.enabled: false).
    postgresql:
      # -- Scaler database host. Defaults to the bundled "<release>-postgresql.<namespace>.svc.cluster.local" service.
      host: ""
      # -- Scaler database port.
      port: "5432"
      # -- Scaler database name. Defaults to `postgresql.auth.database`.
      database: ""
      # -- User the scaler authenticates as.
      userName: "postgres"
      # -- Name of an env var on the worker container holding the password.
      passwordFromEnv: "POSTGRES_ADMIN_PASSWORD"
      # -- sslmode for the scaler connection.
      sslmode: "disable"
    # -- The scaler divides the query result by this value to get the desired replica count.
    targetQueryValue: "1"
    # -- Query the scaler runs to measure pending work. It replaces the previous
    # 2-hour scheduled-only window, which missed manual scans, older backlogs and
    # in-progress scans. Override to tune scaling for your workload.
    #
    # The default sums three signals:
    #   1. Scans executing or available, bounded to rows updated in the last 24h so
    #      orphaned rows do not pin the worker up, plus scheduled scans that are due
    #      (no lower bound, so an overdue backlog still scales up).
    #   2. Scan tasks published in the last 48h that no worker has finished. A PENDING
    #      TaskResult is written at publish time (before_task_publish in api/signals.py),
    #      so Beat's daily publishes are visible even with zero workers. Signal 1 alone
    #      deadlocks with minReplicas 0: every scan row after the first is created by
    #      the worker, so once the initial row ages out of the 24h bound there is
    #      nothing to count and nothing to create more.
    #   3. Non-scan tasks pending in the last hour. Provider connection checks,
    #      deletions, reports and backfills never touch the scans table, so without
    #      this they are never picked up while the worker is scaled to zero.
    #      This includes reconcile-orphan-tasks, a Beat watchdog that runs every two
    #      minutes, so with minReplicas 0 the worker is woken about that often. Add
    #      it to the excluded task names below, or raise cooldownPeriod, if you would
    #      rather trade watchdog latency for longer idle periods.
    query: >-
      SELECT
      (SELECT COUNT(*) FROM scans
      WHERE (state IN ('executing', 'available') AND updated_at > NOW() - INTERVAL '24 hours')
      OR (state = 'scheduled' AND scheduled_at < NOW()))
      + (SELECT COUNT(*) FROM django_celery_results_taskresult
      WHERE task_name IN ('scan-perform', 'scan-perform-scheduled')
      AND status IN ('PENDING', 'RECEIVED', 'STARTED')
      AND date_created > NOW() - INTERVAL '48 hours')
      + (SELECT COUNT(*) FROM django_celery_results_taskresult
      WHERE task_name NOT IN ('scan-perform', 'scan-perform-scheduled')
      AND status IN ('PENDING', 'RECEIVED', 'STARTED')
      AND date_created > NOW() - INTERVAL '1 hour')

worker_beat:
  # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
  replicaCount: 1

  # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
  image:
    repository: prowlercloud/prowler-api
    # This sets the pull policy for images.
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: ""

  command:
    - /home/prowler/docker-entrypoint.sh
  args:
    - beat

  # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  imagePullSecrets: []

  # This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
  serviceAccount:
    # Specifies whether a service account should be created
    create: true
    # Automatically mount a ServiceAccount's API credentials?
    automount: true
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  # This is for setting Kubernetes Annotations to a Pod.
  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  podAnnotations: {}
  # This is for setting Kubernetes Labels to a Pod.
  # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  podLabels: {}

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  # This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
  livenessProbe: {}
  readinessProbe: {}

  # Additional volumes on the output Deployment definition.
  volumes: []
  # - name: foo
  #   secret:
  #     secretName: mysecret
  #     optional: false

  # Additional volumeMounts on the output Deployment definition.
  volumeMounts: []
  # - name: foo
  #   mountPath: "/etc/foo"
  #   readOnly: true

  nodeSelector: {}

  tolerations: []

  affinity: {}

postgresql:
  # -- Enable PostgreSQL deployment (via Bitnami Helm Chart). If you want to use an external Postgres server (or a managed one), set this to false
  # If enabled, it will create a Secret with the credentials.
  # Otherwise, create a secret with the following and add it to the api deployment:
  # - POSTGRES_HOST
  # - POSTGRES_PORT
  # - POSTGRES_ADMIN_USER     - Existing user in charge of migrations, tables, permissions, RLS
  # - POSTGRES_ADMIN_PASSWORD
  # - POSTGRES_USER           - Will be created by ADMIN_USER
  # - POSTGRES_PASSWORD
  # - POSTGRES_DB             - Existing DB
  enabled: true
  image:
    repository: "bitnami/postgresql"
  auth:
    database: prowler_db
    username: prowler

valkey:
  # If enabled, it will create a Secret with the following.
  # Otherwise, create a secret with
  # - VALKEY_SCHEME
  # - VALKEY_USERNAME
  # - VALKEY_PASSWORD
  # - VALKEY_HOST
  # - VALKEY_PORT
  # - VALKEY_DB
  enabled: true

neo4j:
  enabled: true

  neo4j:
    name: prowler-neo4j
    edition: community

    # The name of the secret containing the Neo4j password with the key NEO4J_PASSWORD
    passwordFromSecret: prowler-secret

  # Disable lookups during helm template rendering (required for ArgoCD)
  disableLookups: true

  volumes:
    data:
      mode: defaultStorageClass

  services:
    neo4j:
      enabled: false

  # Neo4j Configuration (yaml format)
  config:
    dbms_security_procedures_allowlist: "apoc.*"
    dbms_security_procedures_unrestricted: ""

  apoc_config:
    apoc.export.file.enabled: "false"
    apoc.import.file.enabled: "false"
    apoc.import.file.use_neo4j_config: "true"