Values File Settings for Keyfactor Command Containers Under Kubernetes

The Logi Analytics Platform is the engine used for the legacy dashboard and reports. Set this to true to use the legacy dashboard and reports. If this is not turned on, the legacy dashboard and reports will not be available. The new dashboard and reports will be shown by default, and there will be no option to switch to the legacy dashboard.

The URL to which traffic is directed for the Analysis application.

Determines whether the Command BFF container is deployed. Command BFF is a backend service for the Modernized Management Portal that handles user authentication and securely proxies requests to the Keyfactor API.

This setting is included in preparation for a future release.

The version of the Command BFF image to retrieve from the Keyfactor artifactory.

This setting is included in preparation for a future release.

Determines whether the Modernized Management Portal container is deployed. Additional configuration is required to route users to the Modernized Management Portal.

This setting is included in preparation for a future release.

The version of the Modernized Management Portal image to retrieve from the Keyfactor artifactory.

This setting is included in preparation for a future release.

The number of seconds to wait before firing the first health check probe.

Clear this value to unset probes.

The port to which Kubernetes should attempt to establish a TCP connection for health checks. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

The number of seconds to wait before firing the first readiness probe.

Clear this value to unset probes.

The port to which Kubernetes should attempt to establish a TCP connection for readiness checks. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

The plain text name of the database in SQL server for Keyfactor Command.

The database will be created if it does not already exist.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connectionStrings > existingSecretName

• connectionStrings > existingSqlDirectKey

The Kubernetes secret key name given to the secret for the SQL connection string.

This parameter is required if plain text values are not provided.

The plain text password for the SQL user (see connectionStrings > username).

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connectionStrings > existingSecretName

• connectionStrings > existingSecretSqlDirectKey

The plain text username for a SQL user with sufficient permissions to complete the install (see Grant Permissions in SQL).

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connectionStrings > existingSecretName

• connectionStrings > existingSecretSqlDirectKey

The claim type for the initial administrative user or group to be created in Keyfactor Command. The supported values are:

• OAuthOid

  An open authorization claim of a type not covered by client, role, or subject.

• OAuthRole

  An open authorization group claim.

• OAuthSubject

  An open authorization user claim.

• OAuthClientId

  An open authorization client application claim.

This parameter is required.

The sessionExpiration value determines the length of time a Keyfactor Command browser session in the Management Portal will remain logged in before the user is prompted to re-authenticate regardless of whether the session is idle or in active use.

The name of the PAM provider to use to store the password for the RabbitMQ user.

The plain text password for the RabbitMQ user.

The name of the Kubernetes secret containing the password for the RabbitMQ user.

The name of the Kubernetes secret containing the username of the RabbitMQ user.

The plain text username for the RabbitMQ user.

Turn on the CA connector option (True or False).

One or more scopes that should be included in token requests delivered to your identity provider.

This is not required when using Keycloak.

The key within the Kubernetes secret named by secretName referencing the ID for the RabbitMQ client.

The source for the RabbitMQ client. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientIdSecretKey fields.

• Plaintext: A plain text value will be specified in the clientId field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required if a CA connector with OAuth authentication will be used. See dbupgradetool > caConnector > jobQueueUseOAuth is and dbupgradetool > caConnector > configureCAConnector.

The key within the Kubernetes secret named by secretName referencing the secret value for the RabbitMQ client.

Parameters for the PAM provider specified as name/value pairs. These will vary depending on the PAM provider.

For example, a secret stored as a Delinea PAM secret might look like (where the SecretId and SecretFieldName are the parameter names from the PAM parameter type and the values contain the information created in the Delinea secret server for this purpose):

pamProviderParameters:
  - name: SecretId
    value: MyID
  - name: SecretFieldName
    value: MyReferenceName

The source for the secret for the RabbitMQ client. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required if a CA connector with OAuth authentication will be used. See dbupgradetool > caConnector > jobQueueUseOAuth is and dbupgradetool > caConnector > configureCAConnector.

Rotate the application-level encryption keys and re-encrypt the data identified for application-level encryption in the Keyfactor Command database (True or False).

Application-level encryption is used to encrypt select sensitive data stored in the Keyfactor Command database using a separate encryption methodology on top of standard SQL server encryption. This additional layer of encryption protects the data in cases where the SQL Server master keys cannot be adequately protected.

If you turn on application-level encryption, you must configure an encryption methodology (see Application-Level Encryption).

The key within the Kubernetes secret named by secretName referencing the ID for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself.

The source for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientIdSecretKey fields.

• Plaintext: A plain text value will be specified in the clientId field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

The key within the Kubernetes secret named by secretName referencing the secret value for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself.

Parameters for the PAM provider specified as name/value pairs. These will vary depending on the PAM provider.

For example, a secret stored as a Delinea PAM secret might look like (where the SecretId and SecretFieldName are the parameter names from the PAM parameter type and the values contain the information created in the Delinea secret server for this purpose):

pamProviderParameters:
  - name: SecretId
    value: MyID
  - name: SecretFieldName
    value: MyReferenceName

The source for the secret for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

The unique identifier defined in Auth0 or a similar identity provider for the API.

This parameter is required if Auth0 is set as the type (see dbupgrade tool > idp > provider Type).

This value is not used for Keycloak.

The issuer/authority endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required. If the discovery document endpoint (see dbupgradetool > idp > discoveryDocumentEndpoint) is provided in the values file, the authority will automatically be retrieved and does not need to be provided.

The plain text ID of the client application created in the identity provider for primary application use.

The name of the Kubernetes secret containing the ID of the client application created in the identity provider for primary application use.

The plain text secret value for the client application created in the identity provider for primary application use.

The name of the PAM provider to use to store the client secret for the client application created in the identity provider for primary application use.

The name of the Kubernetes secret containing the secret value for the client application created in the identity provider for primary application use.

The discovery URL for the identity provider.

For Keycloak, this is the link to the OpenID Endpoint Configuration page, which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

A type of user claim for the identity provider containing a backup unique name for the user. This is provided in case the primary referenced name (see dbupgradetool > idp > uniqueClaimType) does not contain a value. Some OAuth providers may provide one type of claim for users/clients of one type and another type of claim for users/clients of another type.

The cid (client ID) user claim type is commonly used by OAuth providers.

This parameter is required.

A type of user claim for the identity provider containing a friendly name for the user. Although the value for this field may not necessarily be unique within your identity provider (so might resolve to John Smith and the organization might have two users called John Smith), this can be confusing in Keyfactor Command, since the value is used as the user’s display name in areas such as the requester of a certificate, actors in audit logs, and users referenced in workflow instances. It is best to avoid duplicates.

For Okta, this might be preferred_names (for example, john.smith@ keyexample.com) or just name (for example, John Smith). For Auth0 this might be name (for example, johnsmith@ keyexample.com).

This parameter is required.

The provider type defined for the identity provider in Keyfactor Command. Supported values are:

• Generic

• Auth0

Most identity providers can be supported with the Generic type. For Auth0, use the Auth0 type.

Custom OIDC request URL parameters for the identity provider given as name/value pairs.

Parameters configured in this value are added to the URL queryString parameter when Keyfactor Command sends an OIDC request to the OAuth server for the following request types:

• SignIn

• SignOut

If this parameter is added, the -name is required.

One or more scopes that are requested during the OIDC protocol when Keyfactor Command is the relying party. Multiple scopes should be separated by spaces.

This value is not used for Keycloak.

The token endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required. If the discovery document endpoint (see dbupgradetool > idp > discoveryDocumentEndpoint) is provided in the values file, the tokenEndpoint will automatically be retrieved and does not need to be provided.

A type of user claim for the identity provider containing a unique name for the user.

The sub (subject) user claim type is commonly used by OAuth providers.

In Keycloak, the sub is a GUID uniquely identifying the user.

See also dbupgradetool > idp > fallbackUniqueClaimType.

This parameter is required.

The plain text Keyfactor Command license. This is provided as the raw XML content of the license file

One of the following is required:

• dbupgradetool > license > plaintext
• dbupgrade tool > license > secretName and dbupgradetool > license > secretKey

The Kubernetes secret name given to the secret for the Keyfactor Command license.

One of the following is required:

• dbupgradetool > license > plaintext
• dbupgrade tool > license > secretName and dbupgradetool > license > secretKey

The maximum CPU the database setup and configuration container may use.

The baseline amount of CPU allocated for use by the database setup and configuration container.

An object containing the PAM providers and provider types to include in the configuration and a Boolean that indicates whether these should update to the Keyfactor Command database (overwriting anything already there).

• Overwrite: If set to true, new providers will be added and existing providers will be updated with the information given in PamProviderTypes and PamProviders. See example for PamProviderTypes.

• PamProviderTypes: A JSON string indicating the PAM provider type information to add or update in the database for each PAM provider type in the format shown in the example.

• PamProviders: A JSON string indicating the PAM provider information to add or update in the database for each PAM provider in the format shown in the example for PamProviderTypes.

Important notes:

• The Name in the PamProviderTypes section must match the ProviderType in the PamProviders section.

• The parameters you define in the PamProviderTypes section with an InstanceLevel of false are used to define the underlying PAM provider.

• The parameters you define in the PamProviderTypes section with an InstanceLevel of true are fields that need to be set to a value when configuring a record (for example, a certificate store) to use the PAM provider.

• When configuring the PamProviders section, the Name for the parameters should match the Name given to the parameters in the PamProviderTypes section.

• Only parameters with an InstanceLevel of false should be configured in the PamProviders section.

• The | given after seededConfig defines the following information as a multi-line string preserving line breaks exactly as they appear, which allows the JSON string to be interpreted in the YAML file.

Specifies one or more TLS certificate references for the Gateway HTTPS listener. Each entry references a Kubernetes TLS secret by name.

The referenced secret must exist in the same Namespace as the Gateway. When using an existing Gateway, TLS is typically configured on that Gateway, and this setting may not be used by the generated HTTPRoute resources.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

By default, one init container is included that polls the database to check whether it is online and in an operational state before allowing any deployments to begin.

The maximum CPU the database setup and configuration container may use.

The database upgrade mode for the installation. Supported values are:

• InstallAllowUpgrade

  The database will be installed or upgraded.

• NoUpgrade

  Verifies the database version and determines whether an upgrade is required:

  • If the database does not exist, it is initialized and the schema is installed.
  • If the database is empty (contains no tables), it is initialized and the schema is installed.
  • If the database contains data that does not match the expected schema, the Pod start fails. Log messages indicate the database is incompatible.
  • If the database version is earlier than the tool version, the Pod start fails. Log messages indicate an upgrade is required and displays both versions.
  • If the versions match, the Pod starts since no upgrade is needed.
  If an upgrade is needed, the job fails. The failed Pod will not be cleaned up, allowing users to review any errors.

Labels are key-value pairs used to categorize and identify Kubernetes resources for easy selection and management. They are often used for grouping resources by application, environment, or version, enabling efficient querying and filtering. Labels are essential for resource selection and grouping in Kubernetes operations.

ServiceAccount annotations are key-value pairs used to attach non-identifying metadata to the service account resource. These annotations are typically used for integration with external tools, documenting configurations, or adding extra information relevant to the service account's usage. Like other annotations, they don't affect the resource's functionality and aren't used for selection.

The name of an existing service account to use, or the name to give to a service account to be created.

If create is True but the name is not provided, the default name will be used.

The thumbprint for the root (not issuing) CA to which the SSL certificate on the SQL certificate chains.

This parameter is required if Encrypt=true is set in the connection string.

The thumbprint should be provided with colons between each octet.

The name of the image to retrieve from the Keyfactor artifactory.

The pullPolicy defines when the container images should be pulled from the Keyfactor artifactory. It can be set to Always (pull the images every time the containers start), IfNotPresent (pull only if the images are not already present locally), or Never (never pull the images, only use the locally available versions). This helps control image pulling behavior and optimize deployments.

The path to the network service.

This should only have a value if workloadDefaults > service > enabled is true.

The minimum number of Pods that must remain available at any time.

Either maxUnavailable or minUnavailable should be set, but not both.

The runAsNonRoot parameter specifies whether the Pod's containers should be run as a non-root user. When set to True, the containers must run as a user other than root, improving security by adhering to the principle of least privilege. If set to False (or not specified), containers may run as the root user, which could increase security risks.

The number of failures allowed in a liveness health check before an unhealthy state is declared for the container. If the liveness probe fails, Kubernetes assumes the container is stuck or crashed and will restart it.

Clear this value to unset probes.

The port which Kubernetes should use to attempt to perform an HTTP GET request to check the health of the container. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

The number of seconds between runs of the health check probe.

Clear this value to unset probes.

The path which Kubernetes should use to attempt to perform an HTTP GET request to check the readiness of the container. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

The number of seconds to wait before firing the first readiness probe.

Clear this value to unset probes.

The maximum memory each of the application containers may use.

If desired, this may be set on an application container basis using appConfig.

The baseline amount of memory allocated for use by each of the application containers.

If desired, this may be set on an application container basis using appConfig.

The service type to use for the network service for each of the application containers.

For information about the service types, see:

https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

An array of volume mounts. This parameter specifies the name of the volume mount. The value should match the value set by volumes > -name.

The example values file (see Helm Chart Customization) includes a volume mount for the config map ca-roots to mount trusted CA certificates.

For more information on this data structure, see:

The mounts specified apply to all containers.

The subPath value identifies the specific file or directory within the volume to mount at mountPath. The volume itself is defined separately (for example, from a ConfigMap or Secret). Use subPath when you want to mount a single item from that volume instead of the entire directory.

Specifies the name of the data entry in the referenced ConfigMap to include in the volume. In the example values file, Kubernetes reads the value stored under the ca-certificates.crt key in the ca-roots ConfigMap and makes it available in the root-ca volume. The path value controls the file name used for that data in the volume.