Values File Settings for Keyfactor Command Containers Under Kubernetes

appConfig

analysis

image

name

appConfig

analysis

probeSettings

Liveness and readiness probe settings used to identify whether the container is operating as expected. Liveness probes are health checks while the readiness probes determine when the pod is considered ready and can start serving requests.

Clear this value to unset probes.

No probes are set for the Analysis container by default.

appConfig

analysis

resources

limits

memory

appConfig

analysis

resources

requests

memory

appConfig

api

path

The URL to which traffic is directed for the Keyfactor API application.

appConfig

ca connector api

path

The URL to which traffic is directed for the CA Connector API application.

appConfig

claims proxy

path

The URL to which traffic is directed for the Claims Proxy application.

appConfig

orchestrator api

path

The URL to which traffic is directed for the Orchestrator API application.

appConfig

portal

image

path

The URL to which traffic is directed for the Management Portal application.

appConfig

timer service

probe Settings

liveness Probe

failure Threshold

The number of failures allowed in a liveness health check before an unhealthy state is declared for the container. If the liveness probe fails, Kubernetes assumes the container is stuck or crashed and will restart it.

Clear this value to unset probes.

appConfig

timer service

probe Settings

liveness Probe

period Seconds

The number of seconds in between runs of the health check probe.

Clear this value to unset probes.

appConfig

timer service

probe Settings

readiness Probe

failure Threshold

The number of failures allowed in a readiness check before the container is declared unready. If the readiness probe fails, Kubernetes removes the pod from the service’s load balancer until it becomes available again. It does not restart it.

Clear this value to unset probes.

appConfig

timer service

probe Settings

readiness Probe

period Seconds

The number of seconds in between runs of the readiness probe.

Clear this value to unset probes.

appConfig

timer service

resources

limits

cpu

appConfig

timer service

service

enabled

connection Strings

ef Template

The template for generating entity framework connection strings using plain text values.

This value is used if a Kubernetes secret is not used to provide a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

connection Strings

existing Secret Name

The Kubernetes secret name that contains the connection string values.

This parameter is required if plain text values are not provided.

connection Strings

hostname

The plain text name, IP address, or fully qualified domain name (FQDN) of the Microsoft SQL server.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

connection Strings

sql Direct Template

The template for generating SQL connection strings using plain text values for the connection string.

This value is used if a Kubernetes secret is not used to provide a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret EFKey

• connection Strings > existing Sql DirectKey

dbPoller

polling Interval

dbupgrade tool

admin User

claim Value

The value for the for the initial administrative user or group to be created in Keyfactor Command.

For example, a GUID for a user account sub, a role name for a role, or a client ID for a client (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation for more information).

This parameter is required.

dbupgrade tool

admin User

identity Provider

The name set by dbupgrade tool > idp > display Name for the initial administrative user or group to be created in Keyfactor Command.

This parameter is required.

dbupgrade tool

api

use SSL

dbupgrade tool

app Settings

console

general

session Expiration

The sessionExpiration value determines the length of time a Keyfactor Command browser session in the Management Portal will remain logged in before the user is prompted to re-authenticate regardless of whether the session is idle or in active use.

dbupgrade tool

ca Connector

basicAuth

client Credentials

client Id

clientId

The plain text ID for the RabbitMQ user.

dbupgrade tool

ca Connector

basicAuth

client Credentials

client Id

secretName

The name of the Kubernetes secret containing the ID of the RabbitMQ user.

dbupgrade tool

ca Connector

basicAuth

client Credentials

client Secret

client Secret Secret Key

The key within the Kubernetes secret named by secretName referencing the secret value for the RabbitMQ user.

dbupgrade tool

ca Connector

basicAuth

client Credentials

client Secret

secretName

The name of the Kubernetes secret containing the secret value for the RabbitMQ user.

dbupgrade tool

ca Connector

configure CA Connector

dbupgrade tool

ca Connector

job Queue Scope

One or more scopes that should be included in token requests delivered to your identity provider.

This is not required when using Keyfactor Identity Provider.

dbupgrade tool

ca Connector

job Queue Url

dbupgrade tool

ca Connector

job Queue Validate On Save

dbupgrade tool

ca Connector

oAuth

client Credentials

client Id

clientIdSecretKey

The key within the Kubernetes secret named by secretName referencing the ID for the RabbitMQ client.

dbupgrade tool

ca Connector

oAuth

client Credentials

client Id

source

The source for the RabbitMQ client. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientIdSecretKey fields.

• Plaintext: A plain text value will be specified in the clientId field.

For more information, see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required if a CA connector with OAuth authentication will be used. See dbupgradetool > caConnector > jobQueueUseOAuth is and dbupgradetool > caConnector > configureCAConnector.

dbupgrade tool

ca Connector

oAuth

client Credentials

client Secret

clientSecret

The plain text secret value for the RabbitMQ client.

dbupgrade tool

ca Connector

oAuth

client Credentials

client Secret

source

The source for the secret for the RabbitMQ client. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required if a CA connector with OAuth authentication will be used. See dbupgradetool > caConnector > jobQueueUseOAuth is and dbupgradetool > caConnector > configureCAConnector.

dbupgrade tool

ca Connector

use SSL

dbupgrade tool

force Secret Reencryption

Rotate the application-level encryption keys and re-encrypt the data identified for application-level encryption in the Keyfactor Command database (true) or not (false).

Application-level encryption is used to encrypt select sensitive data stored in the Keyfactor Command database using a separate encryption methodology on top of standard SQL server encryption. This additional layer of encryption protects the data in cases where the SQL Server master keys cannot be adequately protected.

If you enable application-level encryption, you must configure an encryption methodology (see Application-Level Encryption).

dbupgrade tool

idp

api

client Credentials

client Id

clientIdSecretKey

The key within the Kubernetes secret named by secretName referencing the ID for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself.

dbupgrade tool

idp

api

client Credentials

client Id

source

The source for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientIdSecretKey fields.

• Plaintext: A plain text value will be specified in the clientId field.

For more information, see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

dbupgrade tool

idp

api

client Credentials

client Secret

clientSecret

The plain text secret value for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself.

dbupgrade tool

idp

api

client Credentials

client Secret

source

The source for the secret for the service account (client) you have created in one of your identity providers to allow Keyfactor Command to make API requests to itself. Supported options are:

• SecretRef: A Kubernetes secret will be referenced in the SecretName and ClientSecretSecretKey fields.

• PAM: A PAM secret will be referenced in the pamProviderName and pamProviderParameters fields.

• Plaintext: A plain text value will be specified in the clientSecret field.

For more information, see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation.

This value and the selected option’s associated settings are required.

dbupgrade tool

idp

auth0 Api Url

The unique identifier defined in Auth0 or a similar identity provider for the API.

This parameter is required if Auth0 is set as the type (see dbupgrade tool > idp > provider Type).

This value is not used for Keyfactor Identity Provider.

dbupgrade tool

idp

authority

The issuer/authority endpoint URL for the identity provider.

For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation).

This parameter is required. If the discovery document endpoint (see dbupgrade tool > idp > discovery Document Endpoint) is provided in the values file, the authority will automatically be retrieved and does not need to be provided separately.

idp

client Credentials

client Id

clientId

The plain text ID of the client application created in the identity provider for primary application use.

idp

client Credentials

client Id

secretName

The name of the Kubernetes secret containing the ID of the client application created in the identity provider for primary application use.

idp

client Credentials

client Secret

client Secret Secret Key

The key within the Kubernetes secret named by secretName referencing the secret value for the client application created in the identity provider for primary application use.

idp

client Credentials

client Secret

secretName

The name of the Kubernetes secret containing the secret value for the client application created in the identity provider for primary application use.

dbupgrade tool

idp

discovery Document Endpoint

The discovery URL for the identity provider.

For Keyfactor Identity Provider, this is the link to the OpenID Endpoint Configuration page, which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation).

dbupgrade tool

idp

fallback Unique Claim Type

A type of user claim for the identity provider containing a backup unique name for the user. This is provided in case the primary referenced name (see dbupgrade tool > idp > unique Claim Type) does not contain a value. Some OAuth providers may provide one type of claim for users/clients of one type and another type of claim for users/clients of another type.

The cid (client ID) user claim type is commonly used by OAuth providers.

This parameter is required.

dbupgrade tool

idp

name Claim Type

A type of user claim for the identity provider containing a friendly name for the user. Although the value for this field may not necessarily be unique within your identity provider (so might resolve to John Smith and the organization might have two users called John Smith), this can be confusing in Keyfactor Command, since the value is used as the user’s display name in areas such as the requester of a certificate, actors in audit logs, and users referenced in workflow instances. It is best to avoid duplicates.

For Okta, this might be preferred_ names (e.g. john.smith@ keyexample.com) or just name (e.g. John Smith). For Auth0 this might be name (e.g. johnsmith@ keyexample.com).

This parameter is required.

dbupgrade tool

idp

provider Type

The provider type defined for the identity provider in Keyfactor Command. Supported values are:

• Generic

• Auth0

Most identity providers can be supported with the Generic type. For Auth0, use the Auth0 type.

dbupgrade tool

idp

scope

One or more scopes that are requested during the OIDC protocol when Keyfactor Command is the relying party. Multiple scopes should be separated by spaces.

This value is not used for Keyfactor Identity Provider.

dbupgrade tool

idp

timeout

dbupgrade tool

idp

token Endpoint

The token endpoint URL for the identity provider.

For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation).

This parameter is required. If the discovery document endpoint (see dbupgrade tool > idp > discovery Document Endpoint) is provided in the values file, the tokenEndpoint will automatically be retrieved and does not need to be provided separately.

dbupgrade tool

idp

unique Claim Type

A type of user claim for the identity provider containing a unique name for the user.

The sub (subject) user claim type is commonly used by OAuth providers.

In Keyfactor Identity Provider, the sub is a GUID uniquely identifying the user.

See also dbupgradetool > idp > fallbackUniqueClaimType.

This parameter is required.

dbupgrade tool

license

plain text

The plain text Keyfactor Command license. This is provided as the raw XML content of the license file

One of the following is required:

• dbupgrade tool > license > plaintext

• dbupgrade tool > license > secretName and dbupgrade tool > license > secretKey

dbupgrade tool

license

secret Name

The Kubernetes secret name given to the secret for the Keyfactor Command license.

One of the following is required:

• dbupgrade tool > license > plaintext

• dbupgrade tool > license > secretName and dbupgrade tool > license > secretKey

dbupgrade tool

proxy

use SSL

dbupgrade tool

resources

limits

memory

The maximum memory the database setup and configuration container may use.

dbupgrade tool

resources

requests

memory

The baseline amount of memory allocated for use by the database setup and configuration container.

seeded Config

Pam Provider Types

A JSON string indicating the PAM provider type information to add or update in the database for each PAM provider type in the format shown in the example.

Important notes:

• The Name in the PamProviderTypes section must match the ProviderType in the PamProviders section.

• The parameters you define in the PamProviderTypes section with an InstanceLevel of false are used to define the underlying PAM provider.

• The parameters you define in the PamProviderTypes section with an InstanceLevel of true are fields that need to be set to a value when configuring a record (e.g. a certificate store) to use the PAM provider.

• When configuring the PamProviders section, the Name for the parameters should match the Name given to the parameters in the PamProviderTypes section.

• Only parameters with an InstanceLevel of false should be configured in the PamProviders section.

• The | given after seededConfig defines the following information as a multi-line string preserving line breaks exactly as they appear, which allows the JSON string to be interpreted in the YAML file.

dbupgradetool:
  seededConfig: |
    {
      "Overwrite": true,
      "PamProviderTypes": [
        {
          "Name":"DelineaExample",
          "Parameters": [
            {
              "Name": "Host",
              "DisplayName":"Secret Server URL",
              "InstanceLevel": false,
              "DataType": "1"
            },
            {
              "Name": "Username",
              "DisplayName": "Secret Server Username",
              "DataType": "2",
              "InstanceLevel": false
            },
            {
              "Name": "Password",
              "DisplayName": "Secret Server Password",
              "DataType": "2",
              "InstanceLevel": false
            },
            {
              "Name": "SecretId",
              "DisplayName": "Secret Server Secret ID",
              "DataType": "1",
              "InstanceLevel": true
            },
            {
              "Name": "SecretFieldName",
              "DisplayName": "Secret Field Name",
              "DataType": "1",
              "InstanceLevel": true
            }
          ]
        },
        { 
          // If desired, provider two type info goes here
        }
      ],
      "PamProviders": [
        {
          "Name": "DelineaProvider",
          "ProviderType":"DelineaExample",
          "Parameters": [
            {
              "Name":"Host",
              "Value":"https://MyDelineaURL"
            },
            {
              "Name":"Username",
              "Value":"MyDelineaServiceAccountUser"
            },
            {
              "Name":"Password",
              "Value":"MySuperSecretPasswordtoAccessDelinea"
            }
          ]
        },
        {
          // If desired, provider two info goes here
        }
      ]
    }

dbupgrade tool

ttlSecondsAfterFinished

hostName

The Keyfactor Command hostname parameter. Set this to a value that resolves in DNS to your Kubernetes server/cluster. This is the hostname that will make up part of the URL you will use to reach the Keyfactor Command Management Portal and Keyfactor API. The SSL certificate to secure connections to the server needs to contain this name.

This parameter is required.

ingress

enabled

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

By default, one init container is included that polls the database to check whether it is online and in an operational state before allowing any deployments to begin.

jobConfig

dbupgrade tool

limits

cpu

The maximum CPU the database setup and configuration container may use.

metadata

annotations

service Account

annotations

service Account

name

The name of an existing service account to use, or the name to give to a service account to be created.

If create is true but the name is not provided, the default name will be used.

The thumbprint for the root (not issuing) CA to which the SSL certificate on the SQL certificate chains.

This parameter is required if Encrypt=true is set in the connection string.

The thumbprint should be provided with colons between each octet.

volume Mounts

- name

An array of volume mounts to use on all deployments. This parameter specifies the name of the volume mount. This value should match the value set by volumes > -name.

The example values file (see Helm Chart Customization) includes a volume mount for the config map ca-roots to mount trusted CA certificates.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/storage/volumes/

volume Mounts

sub Path

volumes

config Map

items

- key

The Kubernetes config map key name given to the reference value in the config map.

volumes

config Map

name

workload Defaults

enabled

workload Defaults

image

name

The name of the image to retrieve from the Keyfactor artifactory.

workload Defaults

image

pull Policy

workload Defaults

image

repo

workload Defaults

labels

workload Defaults

path

The path to the network service.

This should only have a value if workloadDefaults > service > enabled is true.

workload Defaults

pod Disruption Budget

min Unavailable

The minimum number of pods that must remain available at any time.

Either maxUnavailable or minUnavailable should be set, but not both.

workload Defaults

pod Security Context

run As User

workload Defaults

probe Settings

liveness Probe

failure Threshold

The number of failures allowed in a liveness health check before an unhealthy state is declared for the container. If the liveness probe fails, Kubernetes assumes the container is stuck or crashed and will restart it.

Clear this value to unset probes.

workload Defaults

probe Settings

liveness Probe

http Get

port

The port which Kubernetes should use to attempt to perform an HTTP GET request to check the health of the container. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

workload Defaults

probe Settings

liveness Probe

period Seconds

The number of seconds in between runs of the health check probe.

Clear this value to unset probes.

workload Defaults

probe Settings

readiness Probe

http Get

path

The path which Kubernetes should use to attempt to perform an HTTP GET request to check the readiness of the container. If the connection is successful, the probe is considered a success.

Clear this value to unset probes.

workload Defaults

probe Settings

readiness Probe

initial Delay Seconds

The number of seconds to wait before firing the first readiness probe.

Clear this value to unset probes.

workload Defaults

replica Count

workload Defaults

resources

limits

memory

The maximum memory each of the application containers may use.

If desired, this may be set on an application container basis using appConfig.

workload Defaults

resources

requests

memory

The baseline amount of memory allocated for use by each of the application containers.

If desired, this may be set on an application container basis using appConfig.

workload Defaults

service

enabled