Values File Settings for Universal Orchestrator Containers Under Kubernetes

Specifies whether a process in a container can gain more privileges than its parent process. If set to true, processes in the container can escalate their privileges, potentially allowing them to gain additional system capabilities. If set to false, privilege escalation is prevented, which can improve security by limiting the container's ability to perform actions that require higher privileges than the container's default security context allows.

The pullPolicy defines when the container image should be pulled from the Keyfactor artifactory. It can be set to Always (pull the image every time the container starts), IfNotPresent (pull only if the image is not already present locally), or Never (never pull the image, only use the locally available version). This helps control image pulling behavior and optimize deployments.

The tag specifies the version or variant of the container image to be used. For the Universal Orchestrator, the default value is set to the chart's appVersion, ensuring that the container image corresponds to the version of the application defined in the Helm chart. This provides consistency between the chart version and the deployed application version, ensuring predictable deployments.

Specify a version number to deploy a release of the Universal Orchestrator other than that specified in the Helm chart.

This structure is used to add extensions. Examples of use are shown with the example values file (see Kubernetes with Helm).

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

Labels are key-value pairs used to categorize and identify Kubernetes resources for easy selection and management. They are often used for grouping resources by application, environment, or version, enabling efficient querying and filtering. Labels are essential for resource selection and grouping in Kubernetes operations.

The container logging level output. Supported values are:

• OFF: Turns off logging.

• FATAL: Logs severe errors that cause early termination.

• ERROR: Logs severe errors and other runtime errors or unexpected conditions that do not cause early termination.

• WARN: Logs warnings such as deprecated API usage, poor API usage, and other undesirable or unexpected runtime conditions.

• INFO: Logs all the above, plus general runtime events such as startup and shutdown.

• DEBUG: Logs all the above, plus detailed information about system behavior and execution flow.

• TRACE: Logs all available information. This level can result in significant log volume.

The runAsNonRoot parameter specifies whether the Pod's containers should be run as a non-root user. When set to True, the containers must run as a user other than root, improving security by adhering to the principle of least privilege. If set to False (or not specified), containers may run as the root user, which could increase security risks.

Defines how many identical instances of an orchestrator run at the same time. Kubernetes ensures that the specified number of instances is maintained, starting new instances if one stops. Increasing replicas can improve availability and distribute workload across multiple instances.

If replicas is greater than 1, a custom orchestrator name cannot be specified using orchestrator > name. In this case, use the Kubernetes fullnameOverride parameter instead.

Create a new service account (True or False).

For more information on service accounts, see:

https://kubernetes.io/docs/concepts/security/service-accounts/

Additional containers that run alongside the main application container within a pod are known as sidecarContainers. These containers typically provide supporting functionality, such as logging, monitoring, or proxying, without modifying the primary application's behavior. These sidecarContainers share the same network Namespace and storage volumes as the main container, enabling close integration.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

No sidecarContainers are included by default.

An array of volume mounts. This parameter specifies the name of the volume mount. The value should match the value set by volumes > -name.

The example values file (see Kubernetes with Helm) includes a volume mount for the config map ca-roots to mount trusted CA certificates.

For more information on this data structure, see:

The subPath value identifies the specific file or directory within the volume to mount at mountPath. The volume itself is defined separately (for example, from a ConfigMap or Secret). Use subPath when you want to mount a single item from that volume instead of the entire directory.

Specifies the name of the data entry in the referenced ConfigMap to include in the volume. In the example values file, Kubernetes reads the value stored under the ca-certificates.crt key in the ca-roots ConfigMap and makes it available in the root-ca volume. The path value controls the file name used for that data in the volume.