Project: VMClarity (Provisioning / Security & Compliance)
File: configuration.md

| Environment Variable | Required | Default | Values | Description | | - | | -- | - | - | | `VMCLARITYAPISERVERLISTENADDRESS` | | `0.0.0.0:8888` | | Address of the API Server_ to send requests to. Example: `localhost:8890` | | `VMCLARITYAPISERVERHEALTHCHECKADDRESS` | | `0.0.0.0:8081` | | Bind address to used by the API Server_ for `healthz` endpoint. Example: `localhost:8082` which will make the health endpoints be available at `localhost:8082/healthz/live` and `localhost:8082/healthz/ready`. | | `VMCLARITYAPISERVERDATABASE_DRIVER` | yes | `LOCAL` | `LOCAL`, `POSTGRES` | Database driver type. `LOCAL` = SQLite, `POSTGRES` = PostgreSQL. | | `VMCLARITYAPISERVERDBNAME` | If `VMCLARITYAPISERVERDATABASEDRIVER` is `POSTGRES` | | | Database name. | | `VMCLARITYAPISERVERDBUSER` | If `VMCLARITYAPISERVERDATABASEDRIVER` is `POSTGRES` | | | Database user. | | `VMCLARITYAPISERVERDBPASS` | If `VMCLARITYAPISERVERDATABASEDRIVER` is `POSTGRES` | | | Database user password. | | `VMCLARITYAPISERVERDBHOST` | If `VMCLARITYAPISERVERDATABASEDRIVER` is `POSTGRES` | | | Database host, e.g. `postgresql`. | | `VMCLARITYAPISERVERDBPORT` | If `VMCLARITYAPISERVERDATABASEDRIVER` is `POSTGRES` | | | Database port, e.g. `5432`. | | `VMCLARITYAPISERVERENABLEDBINFO_LOGS` | | `false` | | Boolean value whether to enable info logs of the database or not. | | `VMCLARITYAPISERVERLOCALDBPATH` | If `VMCLARITYAPISERVERDATABASE_DRIVER` is `LOCAL` | | | Path of the database, if `LOCAL` is used as databse driver, e.g. `/data/vmclarity.db`. | | Environment Variable | Required | Default | Values | Description | |--| -- | -- | - |-| | `VMCLARITYORCHESTRATORPROVIDER` | yes | `aws` | `aws`, `azure`, `gcp`, `docker` | Provider used for Asset discovery and scans. | | `VMCLARITYORCHESTRATORAPISERVERADDRESS` | **yes** | | | The URL for the API Server used by the Orchestrator_ to interact with the API. Example: `https://apiserver.example.com:8888/api` | | `VMCLARITYORCHESTRATORHEALTHCHECKADDRESS` | | `:8082` | | Bind address to used by the Orchestrator_ for `healthz` endpoint. Example: `localhost:8082` which will make the health endpoints be available at `localhost:8082/healthz/live` and `localhost:8082/healthz/ready`. | | `VMCLARITYORCHESTRATORDISCOVERYINTERVAL` | | `2m` | | How frequently the Discovery perform discovery of Assets_. | | `VMCLARITYORCHESTRATORCONTROLLERSTARTUPDELAY` | | `7s` | | The time interval to wait between controller startups. Do NOT change this parameter unless you know what you are doing. | | `VMCLARITYORCHESTRATORASSETSCANWATCHERPOLLPERIOD` | | `15s` | | How frequently poll the API for events related AssetScan_ objects. | | `VMCLARITYORCHESTRATORASSETSCANWATCHERRECONCILETIMEOUT` | | `5m` | | Time period for reconciling a AssetScan_ event is allowed to run. | | `VMCLARITYORCHESTRATORASSETSCANWATCHERABORTTIMEOUT` | | `10m` | | Time period to wait for the Scanner to gracefully stop on-going scan for AssetScan_ before setting the state of the AssetScan to `Failed`. | | `VMCLARITYORCHESTRATORASSETSCANWATCHERDELETEPOLICY` | | `Always` | `Always`, `Never`, `OnSuccess` | Whether to delete resources (disk snapshot, container snapshot/images) or not based on the status of the AssetScan. `Always` means the AssetScan is deleted no matter if it failed or not. `Never` skip cleaning up the resources created for scanning. `OnSuccess` means that cleanup is happening only iun case the AssetScan_ was successful. | | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNERCONTAINERIMAGE` | yes | | | The Scanner container image used for running

| | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNERFRESHCLAMMIRROR` | | | | | | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNERAPISERVERADDRESS` | | | | The URL for the API Server used by the Scanner to interact with the API. Example: `https://apiserver.example.com:8888/api` | | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNEREXPLOITSDBADDRESS` | | | | The URL for the ExploitsDB Server used by the Scanner. | | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNERTRIVYSERVERADDRESS` | | | | The URL for the Trivy Server used by the Scanner_. | | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNERTRIVYSERVER_TIMEOUT` | | `5m` | | | | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNERGRYPESERVERADDRESS` | | | | The URL for the Grype Server used by the Scanner_. | | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNERGRYPESERVER_TIMEOUT` | | `2m` | | | | `VMCLARITYORCHESTRATORASSETSCANWATCHERSCANNERYARARULESERVERADDRESS` | | | | The URL for the Yara Rule Server used by the Scanner. | | `VMCLARITYORCHESTRATORSCANCONFIGWATCHERPOLLPERIOD` | | | | How frequently the ScanConfig Watcher poll the API for events related ScanConfig_ objects. | | `VMCLARITYORCHESTRATORSCANCONFIGWATCHERRECONCILETIMEOUT` | | | | Time period which a reconciliation for a ScanConfig_ event is allowed to run. | | `VMCLARITYORCHESTRATORSCANWATCHERPOLLPERIOD` | | | | How frequently the AssetScan Watcher poll the API for events related Scan_ objects. | | `VMCLARITYORCHESTRATORSCANWATCHERRECONCILETIMEOUT` | | | | Time period for reconciling a Scan_ event is allowed to run. | | `VMCLARITYORCHESTRATORSCANWATCHERSCANTIMEOUT` | | | | Time period to wait for the Scan_ finish before marked it's state as `Failed` with `Timeout` as a reason. | | `VMCLARITYORCHESTRATORASSETSCANPROCESSORPOLLPERIOD` | | | | How frequently the AssetScan Processor poll the API for events related AssetScan_ objects. | | `VMCLARITYORCHESTRATORASSETSCANPROCESSORRECONCILETIMEOUT` | | | | Time period for processing for a AssetScan_ result is allowed to run. | | `VMCLARITYORCHESTRATORASSETSCANESTIMATIONWATCHERPOLLPERIOD` | | `5s` | | | | `VMCLARITYORCHESTRATORASSETSCANESTIMATIONWATCHERRECONCILETIMEOUT` | | `15s` | | | | `VMCLARITYORCHESTRATORSCANESTIMATIONWATCHERPOLLPERIOD` | | `5s` | | | | `VMCLARITYORCHESTRATORSCANESTIMATIONWATCHERRECONCILETIMEOUT` | | `2m` | | | | `VMCLARITYORCHESTRATORSCANESTIMATIONWATCHERESTIMATIONTIMEOUT` | | `48h` | | | | Environment Variable | Required | Default | Description | |-|-|--|-| | `VMCLARITYAWSREGION` | yes | | Region where the Scanner instance needs to be created | | `VMCLARITYAWSSUBNET_ID` | yes | | SubnetID where the Scanner instance needs to be created | | `VMCLARITYAWSSECURITYGROUPID` | yes | | SecurityGroupId which needs to be attached to the Scanner instance | | `VMCLARITYAWSKEYPAIR_NAME` | | | Name of the SSH KeyPair to use for Scanner instance launch | | `VMCLARITYAWSSCANNERAMIID` | yes | | The AMI image used for creating Scanner instance | | `VMCLARITYAWSSCANNERINSTANCETYPE` | | `t2.large` | The instance type used for Scanner instance | | `VMCLARITYAWSBLOCKDEVICENAME` | | `xvdh` | Block device name used for attaching Scanner volume to the Scanner instance | | Environment Variable | Required | Default | Values | Description | |-| -- | -- | - |-| | `VMCLARITYUIBACKENDAPISERVERADDRESS` | **yes** | | | The URL for the API Server used by the UI backend_ to interact with the API. Example: `https://apiserver.example.com:8888/api` | | `VMCLARITYUIBACKENDLISTENADDRESS` | | `0.0.0.0:8890` | | Address of the UI backend_ to send requests to. Example: `localhost:8890` | | `VMCLARITYUIBACKENDHEALTHCHECKADDRESS` | | `0.0.0.0:8083` | | Bind address to used by the UI backend_ for `healthz` endpoint. Example: `localhost:8082` which will make the health endpoints be available at `localhost:8083/healthz/live` and `localhost:8083/healthz/ready`. |