Values File Settings for Containers Under Kubernetes

Other environment variables that should be included for all containers.

The authentication scheme of the default identity provider used for login. For example, Keycloak.

The default Identity Provider AuthScheme value is not required if only one identity provider will be used. If more than one identity provider is configured and the default Identity Provider AuthScheme is not specified, the first configured authentication Scheme will be used if no hint is provided at login. Additional identity providers can be added using the AnyCAGateway REST API endpoints (see Managing Multiple Identity Providers via API Endpoints).

A display name for the identity provider in AnyCAGateway REST. The display name may contain spaces.

This parameter is required.

The issuer/authority endpoint URL for the identity provider.

For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

The Kubernetes secret key name given to the ID of the client application created in the identity provider for this AnyCAGateway REST to use.

Optional. If true, the scope will not be required when using OAuth token authentication with the AnyCAGateway REST.

A type of user claim for the identity provider containing a friendly name for the user. Although the value for this field may not necessarily be unique within your identity provider (so might resolve to John Smith and the organization might have two users called John Smith), this can be confusing in AnyCAGateway REST, since the value is used as the user’s display name. It is best to avoid duplicates.

For Okta, this might be preferred_ names (e.g. john.smith@ keyexample.com) or just name (e.g. John Smith). For Auth0 this might be name (e.g. johnsmith@ keyexample.com).

This parameter is required.

The Kubernetes secret name that contains the credential values for the client application created in the identity provider for this AnyCAGateway REST to use.

The number of seconds a request to the OAuth identity provider is allowed to process before timing out with an error.

The user info endpoint URL for the identity provider.

For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

Overwrite existing settings for the named authentication Scheme on run.

The claim type for the initial administrative user to be created in AnyCAGateway REST. Values are provided as OAuth_ followed by the claim type. For example:

• OAuth_aud

  An open authorization audience claim.

• OAuth_azp

  An open authorization authorized party claim.

• OAuth_client_id

  An open authorization client application claim.

• OAuth_sub

  An open authorization user claim.

The plain text name of the database in SQL server for AnyCAGateway REST.

The database will be created if it does not already exist.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret Key

The Kubernetes secret name that contains the connection string values.

This parameter is required if plain text values are not provided.

The plain text password for the SQL user (see connection Strings > username).

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret Key

The plain text username for a SQL user with sufficient permissions to complete the install.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing SecretKey

The maximum CPU the database management container may use.

The hostname to use for the ingress controller. This will be the name you use to access your AnyCAGateway REST portal.

This parameter is required.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

By default, one init container is included that polls the database to check whether it is online and in an operational state before allowing any deployments to begin.

An integer that sets the time between which modifications or additions to the CA configuration (in minutes) will be available to the AnyCAGateway REST portal. Any changes to the CA configuration will not appear in the portal for this amount of time, but caching may improve performance during CA sync and enrollment.

In the case of a High Availability implementation, the three Lock settings will set the lockout intervals (in milliseconds) during CA sync so multiple CA syncs are not running at the same time. It is unlikely these would need to be modified.

The lock heartbeat interval.

Create a new service account (true) or not (false).

For more information on service accounts, see:

https://kubernetes.io/docs/concepts/security/service-accounts/

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

No sidecar containers are included by default. A PKCS#11 container may be utilized as a sidecar container.

An array of volume mounts to use on all deployments. This parameter specifies the name of the volume mount. This value should match the value set by volumes > -name.

The example values file (see Helm Chart Customization) includes a volume mount for the config map ca-roots to mount trusted CA certificates.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/storage/volumes/

The Kubernetes config map key name given to the reference value in the config map.

The Kubernetes secret name given to the credentials used to authenticate to the Keyfactor artifactory to retrieve the AnyCAGateway REST components.

This parameter is required.

The level of logging output for all containers.

Supported values are:

• OFF

  No logging

• FATAL

  Log severe errors that cause early termination

• ERROR

  Log severe errors and other runtime errors or unexpected conditions that may not cause early termination

• WARN

  Log errors and use of deprecated APIs, poor use of APIs, almost errors, and other runtime situations that are undesirable or unexpected but not necessarily wrong

• INFO

  Log all of the above plus runtime events (startup/shutdown)

• DEBUG

  Log all of the above plus detailed information on the flow through the system

• TRACE

  Maximum log information—this option can generate VERY large log files

If desired, this may be set on an application container basis using appConfig.

The maximum memory each of the application containers may use.

If desired, this may be set uniquely on the database management container basis using dbmanagement.