Values File Settings for Containers Under Kubernetes

Other environment variables that should be included for all containers.

The authentication scheme of the default identity provider used for login. For example, Keycloak.

The default Identity Provider AuthScheme value is not required if only one identity provider will be used. If more than one identity provider is configured and the default Identity Provider AuthScheme is not specified, the first configured authentication Scheme will be used if no hint is provided at login. Additional identity providers can be added using the AnyCAGateway REST API endpoints (see Managing Multiple Identity Providers via API Endpoints).

A display name for the identity provider in AnyCAGateway REST. The display name may contain spaces.

This parameter is required.

The issuer/authority endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

The Kubernetes secret key name given to the ID of the client application created in the identity provider for this AnyCAGateway REST to use.

Optional. If true, the scope will not be required when using OAuth token authentication with the AnyCAGateway REST.

A type of user claim for the identity provider containing a friendly name for the user. Although the value for this field may not necessarily be unique within your identity provider (so might resolve to John Smith and the organization might have two users called John Smith), this can be confusing in AnyCAGateway REST, since the value is used as the user’s display name. It is best to avoid duplicates.

For Okta, this might be preferred_ names (e.g. john.smith@ keyexample.com) or just name (e.g. John Smith). For Auth0 this might be name (e.g. johnsmith@ keyexample.com).

This parameter is required.

The Kubernetes secret name that contains the credential values for the client application created in the identity provider for this AnyCAGateway REST to use.

The number of seconds a request to the OAuth identity provider is allowed to process before timing out with an error.

The user info endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

Overwrite existing settings for the named authentication Scheme on run.

The claim type for the initial administrative user to be created in AnyCAGateway REST. Values are provided as OAuth_ followed by the claim type. For example:

• OAuth_aud

  An open authorization audience claim.

• OAuth_azp

  An open authorization authorized party claim.

• OAuth_client_id

  An open authorization client application claim.

• OAuth_sub

  An open authorization user claim.

The plain text name of the database in SQL server for AnyCAGateway REST.

The database will be created if it does not already exist.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret Key

The Kubernetes secret name that contains the connection string values.

This parameter is required if plain text values are not provided.

The plain text password for the SQL user (see connection Strings > username).

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing Secret Key

The plain text username for a SQL user with sufficient permissions to complete the install.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connection Strings > existing Secret Name

• connection Strings > existing SecretKey

The maximum CPU the database management container may use.

The hostname to use for the ingress controller. This will be the name you use to access your AnyCAGateway REST portal.

This parameter is required.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

Labels are key-value pairs used to categorize and identify Kubernetes resources for easy selection and management. They are often used for grouping resources by application, environment, or version, enabling efficient querying and filtering. Labels are essential for resource selection and grouping in Kubernetes operations.

The runAsUser parameter specifies the user ID (UID) that the containers in the pod should run as. By setting this value, you ensure that the containers run with the specified user privileges, rather than the default root user. This enhances security by limiting the container’s access to system resources and following the principle of least privilege. This value is used if runAsNonRoot is true.

An integer that sets the time between which modifications or additions to the CA configuration (in minutes) will be available to the AnyCAGateway REST portal. Any changes to the CA configuration will not appear in the portal for this amount of time, but caching may improve performance during CA sync and enrollment.

In the case of a High Availability implementation, the three Lock settings will set the lockout intervals (in milliseconds) during CA sync so multiple CA syncs are not running at the same time. It is unlikely these would need to be modified.

The lock heartbeat interval.

Create a new service account (true) or not (false).

For more information on service accounts, see:

https://kubernetes.io/docs/concepts/security/service-accounts/

Additional containers that run alongside the main application container within a pod are known as sidecarContainers. These containers typically provide supporting functionality, such as logging, monitoring, or proxying, without modifying the primary application's behavior. These sidecarContainers share the same network namespace and storage volumes as the main container, enabling close integration.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

No sidecarContainers are included by default.

An array of volume mounts. This parameter specifies the name of the volume mount. The value should match the value set by volumes > -name.

The example values file (see Helm Chart Customization) includes a volume mount for the config map ca-roots to mount trusted CA certificates.

For more information on this data structure, see:

The subPath specifies a subdirectory or file within the volume to mount at the mountPath. This allows you to mount only a specific part of the volume, rather than the entire volume, giving more fine-grained control over which data is exposed to the container.

The Kubernetes ConfigMap key name given to the referenced value in the ConfigMap.

The name given to the Kubernetes ConfigMap for the volume.

The Kubernetes secret name given to the credentials used to authenticate to the Keyfactor artifactory to retrieve the image.

This parameter is required.

The container logging level output. Supported values are:

• OFF

  No logging

• FATAL

  Log severe errors that cause early termination

• ERROR

  Log severe errors and other runtime errors or unexpected conditions that may not cause early termination

• WARN

  Log errors and use of deprecated APIs, poor use of APIs, almost errors, and other runtime situations that are undesirable or unexpected but not necessarily wrong

• INFO

  Log all of the above plus runtime events (startup/shutdown)

• DEBUG

  Log all of the above plus detailed information on the flow through the system

• TRACE

  Maximum log information—this option can generate VERY large log files

If desired, this may be set on an application container basis using appConfig.

The maximum memory each of the application containers may use.

If desired, this may be set uniquely on the database management container basis using dbmanagement.