mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 20:19:29 +00:00
27 lines
1.7 KiB
TOML
27 lines
1.7 KiB
TOML
|
# The k3s profile: the plane on the maintainer's production cluster (plane-on-kubernetes design section 1;
|
||
|
|
# requirements "Target Environment"). Documented values, not secrets: the kubeconfig for the context, the GHCR
|
||
|
|
# pull secret's content and the store's keys live outside this file. Every field is overridable by OUSAST_<FIELD>,
|
||
|
|
# a pool by OUSAST_POOL_<NAME>_<FIELD>. Nothing has been applied to a k3s cluster yet; docs/deployment.md says
|
||
|
|
# which items are planned.
|
||
|
|
|
||
|
|
exec = "remote" # the same CLI from a laptop or a CI job, through the cluster's kube context
|
||
|
|
kube_context = "ousast-k3s" # the maintainer's context name for the k3s cluster
|
||
|
|
registry = "ghcr.io/norandom" # images built by GitHub Actions from tagged commits (design section 8)
|
||
|
|
images = "images.json" # the release asset {"runner": "ghcr.io/norandom/ousast-runner@sha256:...", "engine": ...}
|
||
|
|
router_url = "" # empty: port-forward to atenet-router through the kube context (ax-tunnel)
|
||
|
|
ax_server = "" # empty: the ax CLI's own tunnel through the kube context (ax-tunnel)
|
||
|
|
memory = "s3://sast-memory" # the memory store; S3_ENDPOINT and the keys come from the CI secrets or .env
|
||
|
|
atespace = "default"
|
||
|
|
snapshots_bucket = "s3://ax-snapshots" # ax's AX_SNAPSHOTS_BUCKET, ours (rendered into the ax-server patch)
|
||
|
|
image_pull_secret = "ghcr-pull" # only needed while the GHCR packages are private
|
||
|
|
|
||
|
|
[pools.default] # production sizing: four verify-class workers; the HPA (design section 5) scales it
|
||
|
|
replicas = 4
|
||
|
|
cpu = "1"
|
||
|
|
memory = "1536Mi"
|
||
|
|
|
||
|
|
[pools.engine] # two engine workers sized from the measured 2.1 GiB peak under a 3 GiB limit
|
||
|
|
replicas = 2
|
||
|
|
cpu = "2"
|
||
|
|
memory = "4Gi"
|