Values File Settings for Keyfactor Command Containers Under Kubernetes

Liveness and readiness probe settings used to identify whether the container is operating as expected. Liveness probes are health checks while the readiness probes determine when the pod is considered ready and can start serving requests.

Clear this value to unset probes.

No probes are set for the Analysis container by default.

The URL to which traffic is directed for the Keyfactor API application.

The URL to which traffic is directed for the CA Connector API application.

The URL to which traffic is directed for the Claims Proxy application.

The URL to which traffic is directed for the Orchestrator API application.

The URL to which traffic is directed for the Management Portal application.

The number of failures allowed in a liveness health check before an unhealthy state is declared for the container. If the liveness probe fails, Kubernetes assumes the container is stuck or crashed and will restart it.

Clear this value to unset probes.

The number of seconds in between runs of the health check probe.

Clear this value to unset probes.

The number of failures allowed in a readiness check before the container is declared unready. If the readiness probe fails, Kubernetes removes the pod from the service’s load balancer until it becomes available again. It does not restart it.

Clear this value to unset probes.

The number of seconds in between runs of the readiness probe.

Clear this value to unset probes.

The template for generating entity framework connection strings using plain text values.

This value is used if a Kubernetes secret is not used to provide a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

The Kubernetes secret name that contains the connection string values.

This parameter is required if plain text values are not provided.

The plain text name, IP address, or fully qualified domain name (FQDN) of the Microsoft SQL server.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

The template for generating SQL connection strings using plain text values for the connection string.

This value is used if a Kubernetes secret is not used to provide a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

The value for the for the initial administrative user or group to be created in Keyfactor Command.

For example, a GUID for a user account sub, a role name for a role, or a client ID for a client (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation for more information).

This parameter is required.

The name set by dbupgrade tool > idp > display Name for the initial administrative user or group to be created in Keyfactor Command.

This parameter is required.

The sessionExpiration value determines the length of time a Keyfactor Command browser session in the Management Portal will remain logged in before the user is prompted to re-authenticate regardless of whether the session is idle or in active use.

The plain text ID for the RabbitMQ user.

The name of the Kubernetes secret containing the ID of the RabbitMQ user.

The key within the Kubernetes secret named by secretName referencing the secret value for the RabbitMQ user.

The name of the Kubernetes secret containing the secret value for the RabbitMQ user.

One or more scopes that should be included in token requests delivered to your identity provider.

This is not required when using Keycloak.

The key within the Kubernetes secret named by secretName referencing the ID for the RabbitMQ client.

The source for the RabbitMQ client. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientIdSecretKey fields.

• Plaintext: A plain text value will be specified in the clientId field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required if a CA connector with OAuth authentication will be used. See dbupgradetool > caConnector > jobQueueUseOAuth is and dbupgradetool > caConnector > configureCAConnector.

The plain text secret value for the RabbitMQ client.

The source for the secret for the RabbitMQ client. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required if a CA connector with OAuth authentication will be used. See dbupgradetool > caConnector > jobQueueUseOAuth is and dbupgradetool > caConnector > configureCAConnector.

Rotate the application-level encryption keys and re-encrypt the data identified for application-level encryption in the Keyfactor Command database (true) or not (false).

Application-level encryption is used to encrypt select sensitive data stored in the Keyfactor Command database using a separate encryption methodology on top of standard SQL server encryption. This additional layer of encryption protects the data in cases where the SQL Server master keys cannot be adequately protected.

If you enable application-level encryption, you must configure an encryption methodology (see Application-Level Encryption).

The key within the Kubernetes secret named by secretName referencing the ID for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself.

The source for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientIdSecretKey fields.

• Plaintext: A plain text value will be specified in the clientId field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

The plain text secret value for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself.

The source for the secret for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

The unique identifier defined in Auth0 or a similar identity provider for the API.

This parameter is required if Auth0 is set as the type (see dbupgrade tool > idp > provider Type).

This value is not used for Keycloak.

The issuer/authority endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required. If the discovery document endpoint (see dbupgrade tool > idp > discovery Document Endpoint) is provided in the values file, the authority will automatically be retrieved and does not need to be provided separately.

The plain text ID of the client application created in the identity provider for primary application use.

The name of the Kubernetes secret containing the ID of the client application created in the identity provider for primary application use.

The key within the Kubernetes secret named by secretName referencing the secret value for the client application created in the identity provider for primary application use.

The name of the Kubernetes secret containing the secret value for the client application created in the identity provider for primary application use.

The discovery URL for the identity provider.

For Keycloak, this is the link to the OpenID Endpoint Configuration page, which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

A type of user claim for the identity provider containing a backup unique name for the user. This is provided in case the primary referenced name (see dbupgrade tool > idp > unique Claim Type) does not contain a value. Some OAuth providers may provide one type of claim for users/clients of one type and another type of claim for users/clients of another type.

The cid (client ID) user claim type is commonly used by OAuth providers.

This parameter is required.

A type of user claim for the identity provider containing a friendly name for the user. Although the value for this field may not necessarily be unique within your identity provider (so might resolve to John Smith and the organization might have two users called John Smith), this can be confusing in Keyfactor Command, since the value is used as the user’s display name in areas such as the requester of a certificate, actors in audit logs, and users referenced in workflow instances. It is best to avoid duplicates.

For Okta, this might be preferred_ names (e.g. john.smith@ keyexample.com) or just name (e.g. John Smith). For Auth0 this might be name (e.g. johnsmith@ keyexample.com).

This parameter is required.

The provider type defined for the identity provider in Keyfactor Command. Supported values are:

• Generic

• Auth0

Most identity providers can be supported with the Generic type. For Auth0, use the Auth0 type.

One or more scopes that are requested during the OIDC protocol when Keyfactor Command is the relying party. Multiple scopes should be separated by spaces.

This value is not used for Keycloak.

The token endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required. If the discovery document endpoint (see dbupgrade tool > idp > discovery Document Endpoint) is provided in the values file, the tokenEndpoint will automatically be retrieved and does not need to be provided separately.

A type of user claim for the identity provider containing a unique name for the user.

The sub (subject) user claim type is commonly used by OAuth providers.

In Keycloak, the sub is a GUID uniquely identifying the user.

See also dbupgradetool > idp > fallbackUniqueClaimType.

This parameter is required.

The plain text Keyfactor Command license. This is provided as the raw XML content of the license file

One of the following is required:

• dbupgrade tool > license > plaintext

• dbupgrade tool > license > secretName and dbupgrade tool > license > secretKey

The Kubernetes secret name given to the secret for the Keyfactor Command license.

One of the following is required:

• dbupgrade tool > license > plaintext

• dbupgrade tool > license > secretName and dbupgrade tool > license > secretKey

The maximum memory the database setup and configuration container may use.

The baseline amount of memory allocated for use by the database setup and configuration container.

A JSON string indicating the PAM provider type information to add or update in the database for each PAM provider type in the format shown in the example.

Important notes:

• The Name in the PamProviderTypes section must match the ProviderType in the PamProviders section.

• The parameters you define in the PamProviderTypes section with an InstanceLevel of false are used to define the underlying PAM provider.

• The parameters you define in the PamProviderTypes section with an InstanceLevel of true are fields that need to be set to a value when configuring a record (e.g. a certificate store) to use the PAM provider.

• When configuring the PamProviders section, the Name for the parameters should match the Name given to the parameters in the PamProviderTypes section.

• Only parameters with an InstanceLevel of false should be configured in the PamProviders section.

• The | given after seededConfig defines the following information as a multi-line string preserving line breaks exactly as they appear, which allows the JSON string to be interpreted in the YAML file.

dbupgradetool:
  seededConfig: |
    {
      "Overwrite": true,
      "PamProviderTypes": [
        {
          "Name":"DelineaExample",
          "Parameters": [
            {
              "Name": "Host",
              "DisplayName":"Secret Server URL",
              "InstanceLevel": false,
              "DataType": "1"
            },
            {
              "Name": "Username",
              "DisplayName": "Secret Server Username",
              "DataType": "2",
              "InstanceLevel": false
            },
            {
              "Name": "Password",
              "DisplayName": "Secret Server Password",
              "DataType": "2",
              "InstanceLevel": false
            },
            {
              "Name": "SecretId",
              "DisplayName": "Secret Server Secret ID",
              "DataType": "1",
              "InstanceLevel": true
            },
            {
              "Name": "SecretFieldName",
              "DisplayName": "Secret Field Name",
              "DataType": "1",
              "InstanceLevel": true
            }
          ]
        },
        { 
          // If desired, provider two type info goes here
        }
      ],
      "PamProviders": [
        {
          "Name": "DelineaProvider",
          "ProviderType":"DelineaExample",
          "Parameters": [
            {
              "Name":"Host",
              "Value":"https://MyDelineaURL"
            },
            {
              "Name":"Username",
              "Value":"MyDelineaServiceAccountUser"
            },
            {
              "Name":"Password",
              "Value":"MySuperSecretPasswordtoAccessDelinea"
            }
          ]
        },
        {
          // If desired, provider two info goes here
        }
      ]
    }

The Keyfactor Command hostname parameter. Set this to a value that resolves in DNS to your Kubernetes server/cluster. This is the hostname that will make up part of the URL you will use to reach the Keyfactor Command Management Portal and Keyfactor API. The SSL certificate to secure connections to the server needs to contain this name.

This parameter is required.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

By default, one init container is included that polls the database to check whether it is online and in an operational state before allowing any deployments to begin.

The maximum CPU the database setup and configuration container may use.

Annotations are key-value pairs used to store arbitrary, non-identifying metadata on Kubernetes resources. They are typically used for integration with external tools, storing build information, or documenting deployment details. Annotations do not affect the resource’s behavior and are not used for selection.

ServiceAccount annotations are key-value pairs used to attach non-identifying metadata to the service account resource. These annotations are typically used for integration with external tools, documenting configurations, or adding extra information relevant to the service account's usage. Like other annotations, they don't affect the resource's functionality and aren't used for selection.

The name of an existing service account to use, or the name to give to a service account to be created.

If create is true but the name is not provided, the default name will be used.

The thumbprint for the root (not issuing) CA to which the SSL certificate on the SQL certificate chains.

This parameter is required if Encrypt=true is set in the connection string.

The thumbprint should be provided with colons between each octet.

An array of volume mounts. This parameter specifies the name of the volume mount. The value should match the value set by volumes > -name.

The example values file (see Helm Chart Customization) includes a volume mount for the config map ca-roots to mount trusted CA certificates.

For more information on this data structure, see:

The mounts specified apply to all containers.

The subPath specifies a subdirectory or file within the volume to mount at the mountPath. This allows you to mount only a specific part of the volume, rather than the entire volume, giving more fine-grained control over which data is exposed to the container.

The Kubernetes ConfigMap key name given to the referenced value in the ConfigMap.

The name given to the Kubernetes ConfigMap for the volume.

The name of the image to retrieve from the Keyfactor artifactory.

The pullPolicy defines when the container images should be pulled from the Keyfactor artifactory. It can be set to Always (pull the images every time the containers start), IfNotPresent (pull only if the images are not already present locally), or Never (never pull the images, only use the locally available version(s)). This helps control image pulling behavior and optimize deployments.

The path to the network service.

This should only have a value if workloadDefaults > service > enabled is true.

The minimum number of pods that must remain available at any time.

Either maxUnavailable or minUnavailable should be set, but not both.

The runAsUser parameter specifies the user ID (UID) that the containers in the pod should run as. By setting this value, you ensure that the containers run with the specified user privileges, rather than the default root user. This enhances security by limiting the container’s access to system resources and following the principle of least privilege. This value is used if runAsNonRoot is true.

The number of failures allowed in a liveness health check before an unhealthy state is declared for the container. If the liveness probe fails, Kubernetes assumes the container is stuck or crashed and will restart it.

Clear this value to unset probes.

The port which Kubernetes should use to attempt to perform an HTTP GET request to check the health of the container. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

The number of seconds in between runs of the health check probe.

Clear this value to unset probes.

The path which Kubernetes should use to attempt to perform an HTTP GET request to check the readiness of the container. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

The number of seconds to wait before firing the first readiness probe.

Clear this value to unset probes.

The maximum memory each of the application containers may use.

If desired, this may be set on an application container basis using appConfig.

The baseline amount of memory allocated for use by each of the application containers.

If desired, this may be set on an application container basis using appConfig.