Values File Settings for Containers Under Kubernetes

The cookieExpirationMinutes value determines the length of time the authentication cookie for the AnyCAGateway REST Portal browser session is considered valid. After half of the setting's duration, the AnyCAGateway REST will attempt to use a refresh token to update the cookie. If this fails, the user's session will be terminated. The cookie renewal is seamless from the user’s perspective (there is no prompt for credentials).

A unique authentication scheme (reference name) for the identity provider in the AnyCAGateway REST. Theauthentication Scheme should be entered without spaces. This is used in constructing URLs that reference the identity provider from AnyCAGateway REST.

For Keycloak, the authentication Scheme you enter here must match the name you used when configuring the redirect URLs of Keycloak (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

The unique identifier defined in Auth0 or a similar identity provider for the API.

This parameter is required if Auth0 is set as the type (see authentication > oauth > provider Type).

This value is not used for Keycloak.

The authorization endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

The Kubernetes secret key name given to the secret for the client application created in the identity provider for this AnyCAGateway REST to use.

The JWKS (JSON Web Key Set) URL of the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

The audience value for tokens issued from the identity provider.

This parameter is required.

The signout URL for the identity provider.

This parameter is required if Auth0 is set as the authentication > oauth > provider Type.

This value is not used for Keycloak.

The token endpoint URL of the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

The provider type defined for the identity provider in the AnyCAGateway REST. Supported values are:

• Generic

• Auth0

Most identity providers can be supported with the Generic type. For Auth0, use the Auth0 type.

This parameter is required.

The sessionExpirationMinutes value determines the length of time a AnyCAGateway REST browser session in the Portal will remain logged in before the user is prompted to re-authenticate regardless of whether the session is idle or in active use.

The displayName set by oauth > authenticationScheme (see displayName).

This parameter is required.

The value for the for the initial administrative user to be created in the AnyCAGateway REST.

For example, a GUID for a user account sub, a role name for a role, or a client ID for a client (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation for more information).

This parameter is required.

The Kubernetes secret key name given to the secret for the SQL connection string.

This parameter is required if plain text values are not provided.

The plain text name, IP address, or fully qualified domain name (FQDN) of the Microsoft SQL server.

This value is required if a Kubernetes secret is not used to provide this information as part of a connection string.

To provide the connection strings as a secret, see:

• connectionStrings > existingSecretName
• connectionStrings > existingSecretKey

The template for generating SQL connection strings using plain text values for the connection string.

This value is used if a Kubernetes secret is not used to provide a connection string.

To provide the connection strings as a secret, see:

• connectionStrings > existingSecretName
• connectionStrings > existingSecretKey

Specifies whether a process in a container can gain more privileges than its parent process. If set to true, processes in the container can escalate their privileges, potentially allowing them to gain additional system capabilities. If set to false, privilege escalation is prevented, which can improve security by limiting the container's ability to perform actions that require higher privileges than the container's default security context allows.

The maximum memory the database management container may use.

The Kubernetes secret name that contains the password for the SQL user that will create or update the database for the gateway in SQL.

Specifies whether to attach the generated HTTPRoute resources to an existing Gateway instead of creating a new Gateway.

When set to True, you must also specify gateway > existingGateway > name and gateway > existingGateway > sectionName.

The host name to use for the Ingress controller. This will be the name you use to access your AnyCAGateway REST portal.

This parameter is required.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

Labels are key-value pairs used to categorize and identify Kubernetes resources for easy selection and management. They are often used for grouping resources by application, environment, or version, enabling efficient querying and filtering. Labels are essential for resource selection and grouping in Kubernetes operations.

The runAsUser parameter specifies the user ID (UID) that the containers in the Pod should run as. By setting this value, you ensure that the containers run with the specified user privileges, rather than the default root user. This enhances security by limiting the container’s access to system resources and following the principle of least privilege. This value is used if runAsNonRoot is True.

An integer that sets the time between which modifications or additions to the CA configuration (in minutes) will be available to the AnyCAGateway REST portal. Any changes to the CA configuration will not appear in the portal for this amount of time, but caching may improve performance during CA sync and enrollment.

In the case of a High Availability implementation, the three Lock settings will set the lockout intervals (in milliseconds) during CA sync so multiple CA syncs are not running at the same time. It is unlikely these would need to be modified.

The lock heartbeat interval.

Create a new service account (True or False).

For more information on service accounts, see:

https://kubernetes.io/docs/concepts/security/service-accounts/

Additional containers that run alongside the main application container within a pod are known as sidecarContainers. These containers typically provide supporting functionality, such as logging, monitoring, or proxying, without modifying the primary application's behavior. These sidecarContainers share the same network Namespace and storage volumes as the main container, enabling close integration.

For more information on this data structure, see:

https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/

No sidecarContainers are included by default.

An array of volume mounts. This parameter specifies the name of the volume mount. The value should match the value set by volumes > -name.

The example values file (see Helm Chart Customization) includes a volume mount for the config map ca-roots to mount trusted CA certificates.

For more information on this data structure, see:

The subPath value identifies the specific file or directory within the volume to mount at mountPath. The volume itself is defined separately (for example, from a ConfigMap or Secret). Use subPath when you want to mount a single item from that volume instead of the entire directory.

Specifies the name of the data entry in the referenced ConfigMap to include in the volume. In the example values file, Kubernetes reads the value stored under the ca-certificates.crt key in the ca-roots ConfigMap and makes it available in the root-ca volume. The path value controls the file name used for that data in the volume.

Specifies the name of the Kubernetes ConfigMap whose data should be made available through the volume. In the example values file, the root-ca volume is populated from the ca-roots ConfigMap. The items settings select which ConfigMap keys are included and how they appear in the volume.

The Kubernetes secret name given to the credentials used to authenticate to the Keyfactor artifactory to retrieve the image.

This parameter is required.

The container logging level output. Supported values are:

• OFF: Turns off logging.

• FATAL: Logs severe errors that cause early termination.

• ERROR: Logs severe errors and other runtime errors or unexpected conditions that do not cause early termination.

• WARN: Logs warnings such as deprecated API usage, poor API usage, and other undesirable or unexpected runtime conditions.

• INFO: Logs all the above, plus general runtime events such as startup and shutdown.

• DEBUG: Logs all the above, plus detailed information about system behavior and execution flow.

• TRACE: Logs all available information. This level can result in significant log volume.

If desired, this may be set on an application container basis using appConfig.

The maximum memory each of the application containers may use.

If desired, this may be set uniquely on the database management container basis using dbmanagement.