Values File Settings for Keyfactor Command Containers Under Kubernetes

Liveness and readiness probe settings used to identify whether the container is operating as expected. Liveness probes are health checks while the readiness probes determine when the pod is considered ready and can start serving requests.

Clear this value to unset probes.

No probes are set for the Analysis container by default.

The URL to which traffic is directed for the Keyfactor API application.

The URL to which traffic is directed for the CA Connector API application.

The URL to which traffic is directed for the Claims Proxy application.

The URL to which traffic is directed for the Orchestrator API application.

The URL to which traffic is directed for the Management Portal application.

The number of failures allowed in a liveness health check before an unhealthy state is declared for the container. If the liveness probe fails, Kubernetes assumes the container is stuck or crashed and will restart it.

Clear this value to unset probes.

The number of seconds in between runs of the health check probe.

Clear this value to unset probes.

The number of failures allowed in a readiness check before the container is declared unready. If the readiness probe fails, Kubernetes removes the pod from the service’s load balancer until it becomes available again. It does not restart it.

Clear this value to unset probes.

The number of seconds in between runs of the readiness probe.

Clear this value to unset probes.

The template for generating entity framework connection strings using plain text values.

This value is used if a Kubernetes secret is not used to provide a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

The Kubernetes secret name that contains the connection string values.

This parameter is required if plain text values are not provided.

The plain text name, IP address, or fully qualified domain name (FQDN) of the Microsoft SQL server.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

The template for generating SQL connection strings using plain text values for the connection string.

This value is used if a Kubernetes secret is not used to provide a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

The value for the for the initial administrative user or group to be created in Keyfactor Command.

For example, a GUID for a user account sub, a role name for a role, or a client ID for a client (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation for more information).

This parameter is required.

The name set by dbupgrade tool > idp > display Name for the initial administrative user or group to be created in Keyfactor Command.

This parameter is required.

The sessionExpiration value determines the length of time a Keyfactor Command browser session in the Management Portal will remain logged in before the user is prompted to re-authenticate regardless of whether the session is idle or in active use.

The name of the PAM provider to use to store the password for the RabbitMQ user.

The plain text password for the RabbitMQ user.

The name of the Kubernetes secret containing the password for the RabbitMQ user.

The name of the Kubernetes secret containing the username of the RabbitMQ user.

The plain text username for the RabbitMQ user.

One or more scopes that should be included in token requests delivered to your identity provider.

This is not required when using Keycloak.

The key within the Kubernetes secret named by secretName referencing the ID for the RabbitMQ client.

The source for the RabbitMQ client. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientIdSecretKey fields.

• Plaintext: A plain text value will be specified in the clientId field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required if a CA connector with OAuth authentication will be used. See dbupgradetool > caConnector > jobQueueUseOAuth is and dbupgradetool > caConnector > configureCAConnector.

The key within the Kubernetes secret named by secretName referencing the secret value for the RabbitMQ client.

Parameters for the PAM provider specified as name/value pairs. These will vary depending on the PAM provider.

For example, a secret stored as a Delinea PAM secret might look like (where the SecretId and SecretFieldName are the parameter names from the PAM parameter type and the values contain the information created in the Delinea secret server for this purpose):

pamProviderParameters:
  - name: SecretId
    value: MyID
  - name: SecretFieldName
    value: MyReferenceName

The source for the secret for the RabbitMQ client. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required if a CA connector with OAuth authentication will be used. See dbupgradetool > caConnector > jobQueueUseOAuth is and dbupgradetool > caConnector > configureCAConnector.

Rotate the application-level encryption keys and re-encrypt the data identified for application-level encryption in the Keyfactor Command database (true) or not (false).

Application-level encryption is used to encrypt select sensitive data stored in the Keyfactor Command database using a separate encryption methodology on top of standard SQL server encryption. This additional layer of encryption protects the data in cases where the SQL Server master keys cannot be adequately protected.

If you enable application-level encryption, you must configure an encryption methodology (see Application-Level Encryption).

The key within the Kubernetes secret named by secretName referencing the ID for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself.

The source for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientIdSecretKey fields.

• Plaintext: A plain text value will be specified in the clientId field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

The key within the Kubernetes secret named by secretName referencing the secret value for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself.

Parameters for the PAM provider specified as name/value pairs. These will vary depending on the PAM provider.

For example, a secret stored as a Delinea PAM secret might look like (where the SecretId and SecretFieldName are the parameter names from the PAM parameter type and the values contain the information created in the Delinea secret server for this purpose):

pamProviderParameters:
  - name: SecretId
    value: MyID
  - name: SecretFieldName
    value: MyReferenceName

The source for the secret for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

The unique identifier defined in Auth0 or a similar identity provider for the API.

This parameter is required if Auth0 is set as the type (see dbupgrade tool > idp > provider Type).

This value is not used for Keycloak.

The issuer/authority endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required. If the discovery document endpoint (see dbupgrade tool > idp > discovery Document Endpoint) is provided in the values file, the authority will automatically be retrieved and does not need to be provided separately.

The plain text ID of the client application created in the identity provider for primary application use.

The name of the Kubernetes secret containing the ID of the client application created in the identity provider for primary application use.

The source for the secret for the client application created for primary application use. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

The key within the Kubernetes secret named by secretName referencing the secret value for the client application created in the identity provider for primary application use.

Parameters for the PAM provider specified as name/value pairs. These will vary depending on the PAM provider.

For example, a secret stored as a Delinea PAM secret might look like (where the SecretId and SecretFieldName are the parameter names from the PAM parameter type and the values contain the information created in the Delinea secret server for this purpose):

pamProviderParameters:
  - name: SecretId
    value: MyID
  - name: SecretFieldName
    value: MyReferenceName

The discovery URL for the identity provider.

For Keycloak, this is the link to the OpenID Endpoint Configuration page, which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

A type of user claim for the identity provider containing a backup unique name for the user. This is provided in case the primary referenced name (see dbupgrade tool > idp > unique Claim Type) does not contain a value. Some OAuth providers may provide one type of claim for users/clients of one type and another type of claim for users/clients of another type.

The cid (client ID) user claim type is commonly used by OAuth providers.

This parameter is required.

A type of user claim for the identity provider containing a friendly name for the user. Although the value for this field may not necessarily be unique within your identity provider (so might resolve to John Smith and the organization might have two users called John Smith), this can be confusing in Keyfactor Command, since the value is used as the user’s display name in areas such as the requester of a certificate, actors in audit logs, and users referenced in workflow instances. It is best to avoid duplicates.

For Okta, this might be preferred_ names (e.g., john.smith@ keyexample.com) or just name (e.g., John Smith). For Auth0 this might be name (e.g., johnsmith@ keyexample.com).

This parameter is required.

The provider type defined for the identity provider in Keyfactor Command. Supported values are:

• Generic

• Auth0

Most identity providers can be supported with the Generic type. For Auth0, use the Auth0 type.

Custom OIDC request URL parameters for the identity provider given as name/value pairs.

Parameters configured in this value are added to the URL queryString parameter when Keyfactor Command sends an OIDC request to the OAuth server for the following request types:

• SignIn

• SignOut

If this parameter is added, the -name is required.

One or more scopes that are requested during the OIDC protocol when Keyfactor Command is the relying party. Multiple scopes should be separated by spaces.

This value is not used for Keycloak.

The token endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required. If the discovery document endpoint (see dbupgrade tool > idp > discovery Document Endpoint) is provided in the values file, the tokenEndpoint will automatically be retrieved and does not need to be provided separately.

A type of user claim for the identity provider containing a unique name for the user.

The sub (subject) user claim type is commonly used by OAuth providers.

In Keycloak, the sub is a GUID uniquely identifying the user.

See also dbupgradetool > idp > fallbackUniqueClaimType.

This parameter is required.

The plain text Keyfactor Command license. This is provided as the raw XML content of the license file

One of the following is required:

• dbupgrade tool > license > plaintext

• dbupgrade tool > license > secretName and dbupgrade tool > license > secretKey

The Kubernetes secret name given to the secret for the Keyfactor Command license.

One of the following is required:

• dbupgrade tool > license > plaintext

• dbupgrade tool > license > secretName and dbupgrade tool > license > secretKey

The maximum memory the database setup and configuration container may use.

The baseline amount of memory allocated for use by the database setup and configuration container.

The Keyfactor Command hostname parameter. Set this to a value that resolves in DNS to your Kubernetes server/cluster. This is the hostname that will make up part of the URL you will use to reach the Keyfactor Command Management Portal and Keyfactor API. The SSL certificate to secure connections to the server needs to contain this name.

This parameter is required.

The maximum memory the database setup and configuration container may use.

Labels are key-value pairs used to categorize and identify Kubernetes resources for easy selection and management. They are often used for grouping resources by application, environment, or version, enabling efficient querying and filtering. Labels are essential for resource selection and grouping in Kubernetes operations.

Create a new service account (true) or not (false).

For more information on service accounts, see:

https://kubernetes.io/docs/concepts/security/service-accounts/

Additional containers that run alongside the main application container within a pod are known as sidecarContainers. These containers typically provide supporting functionality, such as logging, monitoring, or proxying, without modifying the primary application's behavior. These sidecarContainers share the same network namespace and storage volumes as the main container, enabling close integration.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

No sidecarContainers are included by default. A PKCS#11 container may be utilized as a sidecarContainer.

Specifies whether a process in a container can gain more privileges than its parent process. If set to true, processes in the container can escalate their privileges, potentially allowing them to gain additional system capabilities. If set to false, privilege escalation is prevented, which can improve security by limiting the container's ability to perform actions that require higher privileges than the container's default security context allows.

Other environment variables that should be included for application containers.

See, for example:

• Keyfactor Command CA Connector API appsetting.json File

• Editing NLog

If desired, this may be set on an application container basis using appConfig and a job basis using JobConfig.

The Kubernetes secret name given to the credentials used to authenticate to the Keyfactor artifactory to retrieve the images.

This parameter is required.

The container logging level output. Supported values are:

• OFF

  No logging

• FATAL

  Log severe errors that cause early termination

• ERROR

  Log severe errors and other runtime errors or unexpected conditions that may not cause early termination

• WARN

  Log errors and use of deprecated APIs, poor use of APIs, almost errors, and other runtime situations that are undesirable or unexpected but not necessarily wrong

• INFO

  Log all of the above plus runtime events (startup/shutdown)

• DEBUG

  Log all of the above plus detailed information on the flow through the system

• TRACE

  Maximum log information—this option can generate VERY large log files

The level set here applies to all containers. If desired, this may be set on an application container basis using appConfig. See also Editing NLog.

The maximum number of pods that can be disrupted at the same time.

Either maxUnavailable or minUnavailable should be set, but not both.

A Pod Disruption Budget (PDB) ensures that a certain number of pods remain available during voluntary disruptions (e.g., draining a node for maintenance). It does not protect against node failures or crashes.

A PDB is only generated when the replicaCount is greater than 1.

The runAsUser parameter specifies the user ID (UID) that the containers in the pod should run as. By setting this value, you ensure that the containers run with the specified user privileges, rather than the default root user. This enhances security by limiting the container’s access to system resources and following the principle of least privilege. This value is used if runAsNonRoot is true.

The path which Kubernetes should use to attempt to perform an HTTP GET request to check the health of the container. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

The number of seconds to wait before firing the first health check probe.

Clear this value to unset probes.

The number of failures allowed in a readiness check before the container is declared unready. If the readiness probe fails, Kubernetes removes the pod from the service’s load balancer until it becomes available again. It does not restart it.

Clear this value to unset probes.

The port which Kubernetes should use to attempt to perform an HTTP GET request to check the readiness of the container. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

The number of seconds in between runs of the readiness probe.

Clear this value to unset probes.

The maximum CPU each of the application containers may use.

If desired, this may be set on an application container basis using appConfig.

The baseline amount of CPU allocated for use by each of the application containers.

If desired, this may be set on an application container basis using appConfig.

The topologySpreadConstraints parameter defines rules for distributing pods across nodes to ensure high availability and fault tolerance. It allows you to control how pods are spread across different failure domains, such as availability zones or regions, to prevent resource contention and ensure that the application remains functional even if one domain fails.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

No topology spread constraints are included by default.

The mountPath specifies the path within the container where a volume should be mounted. It can be a directory or a specific file, depending on the mount configuration, allowing the container to access the contents of the volume at that location.

An array of volumes. This parameter specifies the name of the volume. The value should match the value set by volumeMounts > -name.

The example values file (see Helm Chart Customization) includes a volume mount for the config map ca-roots to mount trusted CA certificates.

The volumes specified apply to all containers.

The name of the mounted file, referenced by the Kubernetes ConfigMap, as it will appear in the volume.

In the example values file, the data from the ConfigMap key ca-certificates.crt will be written to a file called ca-certificates.crt in the container volume.