values.yaml

# -- Deployment mode: "combo" runs all components in one process; "distributed" runs
# separate Deployments for indexer, matcher, and notifier.
mode: combo

# -- Override the chart name (used in resource names and labels).
nameOverride: ""
# -- Override the full release name instead of "<release>-<chart>".
fullnameOverride: ""

# ──────────────────────────────────────────────
# Clair image (shared across all modes)
# ──────────────────────────────────────────────
image:
  # -- Clair container image repository.
  repository: quay.io/projectquay/clair
  # -- Image tag. Defaults to the chart's appVersion when empty.
  tag: "4.9.0"
  # -- Image pull policy.
  pullPolicy: IfNotPresent

# -- List of image pull secrets for private registries.
# @default -- `[]`
imagePullSecrets: []

serviceAccount:
  # -- Create a ServiceAccount for Clair pods.
  create: true
  # -- Annotations to add to the ServiceAccount.
  annotations: {}
  # -- Override the ServiceAccount name. Defaults to the full release name.
  name: ""

# -- Annotations added to every Clair pod.
podAnnotations: {}
# -- Labels added to every Clair pod.
podLabels: {}

# -- Pod-level security context applied to all Clair pods.
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 65534
  fsGroup: 65534

# -- Container-level security context applied to all Clair containers.
securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]

# -- Extra environment variables injected into all Clair containers (combo, notifier, indexer, matcher).
# Useful for feature flags, proxy settings, or any Clair env-based config.
# @default -- `[]`
extraEnv: []
# - name: HTTP_PROXY
#   value: "http://proxy.example.com:3128"
# - name: MY_SECRET
#   valueFrom:
#     secretKeyRef:
#       name: my-secret
#       key: value

# -- Node selector for all Clair pods.
nodeSelector: {}
# -- Tolerations for all Clair pods.
tolerations: []
# -- Affinity rules for all Clair pods.
affinity: {}

# ──────────────────────────────────────────────
# Clair configuration (applied to all modes)
# ──────────────────────────────────────────────
config:
  # -- Clair log level. One of: debug, info, warn, error.
  logLevel: info
  # -- Address Clair listens on for the HTTP API.
  httpListenAddr: "0.0.0.0:6060"
  # -- Address Clair listens on for introspection (metrics, health).
  introspectionAddr: "0.0.0.0:8089"

  indexer:
    # -- Seconds between retries when acquiring a scan lock.
    scanLockRetry: 10
    # -- Number of layers scanned concurrently per manifest.
    layerScanConcurrency: 5
    # -- Run database migrations on indexer startup.
    migrations: true
    # -- Disable external network access (air-gapped environments).
    airgap: false

  matcher:
    # -- Maximum number of database connections in the matcher pool.
    maxConnPool: 100
    # -- Run database migrations on matcher startup.
    migrations: true
    # -- How often the matcher syncs vulnerability feeds (e.g. "6h", "24h").
    period: "6h"
    # -- Disable vulnerability feed updaters (useful for air-gapped installs).
    disableUpdaters: false
    # -- Number of previous update operations to retain for diffing.
    updateRetention: 2

  notifier:
    # -- Run database migrations on notifier startup.
    migrations: true
    # -- How often the notifier polls for new vulnerability matches.
    pollInterval: "6h"
    # -- How often the notifier attempts to deliver pending notifications.
    deliveryInterval: "1h"
    webhook:
      # -- Webhook target URL. Leave empty to disable webhook delivery.
      target: ""
      # -- Callback URL Clair uses to reference notifications in the webhook payload.
      callback: ""
      # -- Sign webhook payloads with the PSK from config.auth.
      signed: false
    # amqp: {}   # See https://quay.github.io/clair/reference/config.html
    # stomp: {}  # See https://quay.github.io/clair/reference/config.html

  # -- Pre-shared key authentication between Clair components.
  # @default -- `{}`
  auth: {}
    # psk:
    #   key: "changeme"
    #   iss: ["indexer", "matcher"]

# ──────────────────────────────────────────────
# Database
# ──────────────────────────────────────────────
database:
  # -- Full PostgreSQL DSN. When set, the bundled postgresql is ignored.
  # Example: "host=mydb port=5432 dbname=clair user=clair password=s3cr3t sslmode=require"
  externalConnString: ""
  # -- Database name (used when postgresql.enabled=true).
  name: clair
  # -- Database user (used when postgresql.enabled=true).
  user: clair
  # -- Database password. Auto-generated and persisted across upgrades when empty.
  password: ""

# ──────────────────────────────────────────────
# Bundled PostgreSQL (used by both modes)
# ──────────────────────────────────────────────
postgresql:
  # -- Deploy a bundled PostgreSQL instance. Set to false and configure
  # database.externalConnString to use an external database.
  enabled: true

  image:
    repository: postgres
    tag: "17-alpine"
    pullPolicy: IfNotPresent

  persistence:
    # -- Enable a PersistentVolumeClaim for PostgreSQL data.
    enabled: true
    # -- Name of an existing PVC to use. When set, the chart will not create a new PVC
    # and will use this claim instead. Requires persistence.enabled=true.
    existingClaim: ""
    # -- PVC size. Ignored when existingClaim is set.
    size: 10Gi
    # -- Storage class. Uses the cluster default when empty. Ignored when existingClaim is set.
    storageClass: ""
    # -- PVC access mode. Ignored when existingClaim is set.
    accessMode: ReadWriteOnce

  # -- Resource requests and limits for the PostgreSQL container.
  resources: {}

  service:
    # -- PostgreSQL service port.
    port: 5432

  # -- Pod-level security context for the PostgreSQL pod.
  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 999
    fsGroup: 999

  # -- Container-level security context for the PostgreSQL container.
  securityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: false

# ──────────────────────────────────────────────
# Combo mode  (mode: combo)
# Single process running indexer + matcher + optional separate notifier.
# ──────────────────────────────────────────────
combo:
  # -- Number of Clair combo replicas.
  replicaCount: 1
  # -- Resource requests and limits for the Clair combo container.
  resources: {}

  service:
    # -- Service type for the Clair API.
    type: ClusterIP
    # -- HTTP API port exposed by the Service.
    port: 6060
    # -- Introspection (metrics/health) port exposed by the Service.
    introspectionPort: 8089

  ingress:
    # -- Enable an Ingress for the Clair API.
    enabled: false
    # -- Ingress class name (e.g. "nginx", "traefik").
    className: ""
    # -- Ingress annotations.
    annotations: {}
    # -- Ingress host rules.
    hosts:
      - host: clair.example.com
        paths:
          - path: /
            pathType: Prefix
    # -- TLS configuration for the Ingress.
    tls: []

  autoscaling:
    # -- Enable a HorizontalPodAutoscaler for the Clair combo Deployment.
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80

  pdb:
    # -- Enable a PodDisruptionBudget for the Clair combo Deployment.
    enabled: false
    # -- Minimum number (or percentage) of pods that must be available during disruptions.
    minAvailable: 1

  # -- Deploy a separate notifier pod (CLAIR_MODE=notifier).
  # Requires at least one delivery mechanism configured under config.notifier.webhook,
  # config.notifier.amqp, or config.notifier.stomp — otherwise the pod will fail to start.
  # When disabled, the notifier logic runs inside the main combo process but self-disables
  # if no delivery mechanism is configured.
  notifier:
    # -- Enable the dedicated notifier Deployment.
    enabled: false
    # -- Number of notifier replicas.
    replicaCount: 1
    # -- Resource requests and limits for the notifier container.
    resources: {}
    service:
      # -- Service type for the notifier.
      type: ClusterIP
      # -- Port exposed by the notifier Service.
      port: 6060

# ──────────────────────────────────────────────
# Distributed mode  (mode: distributed)
# Separate Deployment per component with path-based Ingress routing.
# Requires a Layer 7 ingress controller.
# ──────────────────────────────────────────────
distributed:
  ingress:
    # -- Enable the path-based Ingress. Strongly recommended in distributed mode.
    enabled: true
    # -- Ingress class name (e.g. "nginx", "traefik").
    className: ""
    # -- Ingress annotations.
    annotations: {}
    # -- Hostname for all distributed components.
    host: clair.example.com
    # -- TLS configuration for the Ingress.
    tls: []

  indexer:
    # -- Number of indexer replicas.
    replicaCount: 2
    # -- Resource requests and limits for the indexer container.
    resources: {}
    autoscaling:
      # -- Enable HPA for the indexer Deployment.
      enabled: false
      minReplicas: 2
      maxReplicas: 10
      targetCPUUtilizationPercentage: 80

  matcher:
    # -- Number of matcher replicas.
    replicaCount: 2
    # -- Resource requests and limits for the matcher container.
    resources: {}
    autoscaling:
      # -- Enable HPA for the matcher Deployment.
      enabled: false
      minReplicas: 2
      maxReplicas: 10
      targetCPUUtilizationPercentage: 80

  notifier:
    # -- Enable the notifier Deployment in distributed mode.
    enabled: true
    # -- Number of notifier replicas.
    replicaCount: 1
    # -- Resource requests and limits for the notifier container.
    resources: {}