authservice values.yaml📜
replicaCount📜
Type: int
1
Description: When setting this above 1, a redis configuration is required. See globals.redis_server_uri
istio.namespace📜
Type: string
"istio-system"
istio.mtls📜
Type: object
{"mode":"STRICT"}
Default value (formatted)
{
"mode": "STRICT"
}
Description: Default authservice peer authentication
istio.mtls.mode📜
Type: string
"STRICT"
Description: Two mtls modes allowed STRICT = Allow only mutual TLS traffic PERMISSIVE = Allow both plain text and mutual TLS traffic
monitoring.enabled📜
Type: bool
false
networkPolicies.enabled📜
Type: bool
false
networkPolicies.ingressLabels.app📜
Type: string
"istio-ingressgateway"
networkPolicies.ingressLabels.istio📜
Type: string
"ingressgateway"
image.repository📜
Type: string
"registry1.dso.mil/ironbank/istio-ecosystem/authservice"
image.pullPolicy📜
Type: string
"IfNotPresent"
image.tag📜
Type: string
"0.5.3"
Description: Overrides the image tag whose default is the chart appVersion.
imagePullSecrets📜
Type: list
[]
Default value (formatted)
[]
issuer_uri📜
Type: string
""
Description: Issuer and jwks URIs if not using Keycloak
jwks_uri📜
Type: string
""
allow_unmatched_requests📜
Type: bool
true
Description: If true will allow the requests even no filter chain match is found
custom_authpolicy_rules📜
Type: list
[{"when":[{"key":"request.headers[authorization]","notValues":["*"]}]}]
Default value (formatted)
[
{
"when": [
{
"key": "request.headers[authorization]",
"notValues": [
"*"
]
}
]
}
]
Description: Extra Ruleset for AuthorizationPolicy CUSTOM action to forward to Authservice. To enable allow_unmatched_requests must be false. These custom rules mean that only these requests will be routed and will break default BigBang setup for prometheus/alertmanager/tempo unless added. Path specific Operations are not supported, it is recommended to use only hosts, notHosts, & method operations. See reference: https://istio.io/latest/docs/reference/config/security/authorization-policy/
global.client_id📜
Type: string
"global_id"
Description: Global Authorization URI value to set if not using Keycloak authorization_uri: “” Global Token URI Value to set if not using Keycloak token_uri: “” Default client_id to be used in each chain
global.client_secret📜
Type: string
"global_secret"
Description: default client_secret to be used in each chain
global.match.header📜
Type: string
":authority"
Description: Header to match. The value “:authority” is used to match the requested hostname
global.match.prefix📜
Type: string
"bigbang"
Description: value matches the start of the header value defined above
global.logout_path📜
Type: string
"/globallogout"
Description: Logout URL for the client
global.logout_redirect_uri📜
Type: string
""
Description: Logout Redirect URI for the client
global.absolute_session_timeout📜
Type: int
0
global.idle_session_timeout📜
Type: int
0
global.certificate_authority📜
Type: string
""
Description: CA signing the OIDC provider. Passed through as a Helm multi-line string. See README for example.
global.oidc📜
Type: object
{"host":"login.dso.mil","realm":"baby-yoda"}
Default value (formatted)
{
"host": "login.dso.mil",
"realm": "baby-yoda"
}
Description: URI for Redis instance used for OIDC token storage/retrieval. This may also be specified per-chain. redis_server_uri: tcp://{{ .Release.Name }}-{{ .Release.Namespace }}-auth-redis-master:6379/
global.oidc.host📜
Type: string
"login.dso.mil"
Description: OpenID Connect hostname. Assumption of Keycloak based on URL construction
global.oidc.realm📜
Type: string
"baby-yoda"
Description: Realm for OpenID Connect
global.jwks📜
Type: string
""
Description: escaped json for the JWKS
global.jwks_uri📜
Type: string
""
Description: Request URI that has the JWKs. If neither jwks or jwks_uri are specified the jwks_uri is computed based on the provided OIDC realm and and host”
global.periodic_fetch_interval_sec📜
Type: int
60
Description: Request interval to check whether new JWKs are available.
global.skip_verify_peer_cert📜
Type: bool
false
Description: If set to true, the verification of the destination certificate will be skipped when making a request to the JWKs URI and the token endpoint. This option is useful when you want to use a self-signed certificate for testing purposes, but basically should not be set to true in any other cases.
chains📜
Type: object
{"local":{"callback_uri":"https://localhost/login","client_id":"local_id","client_secret":"local_secret","logout_path":"/local","match":{"header":":local","prefix":"localhost"}}}
Default value (formatted)
{
"local": {
"callback_uri": "https://localhost/login",
"client_id": "local_id",
"client_secret": "local_secret",
"logout_path": "/local",
"match": {
"header": ":local",
"prefix": "localhost"
}
}
}
Description: Individual chains. Must have a name value and a callback_uri NOTE: if using “match” can only specify prefix OR equality, not both
nameOverride📜
Type: string
"authservice"
fullnameOverride📜
Type: string
"authservice"
serviceAccount.create📜
Type: bool
true
Description: Specifies whether a service account should be created
serviceAccount.annotations📜
Type: object
{}
Default value (formatted)
{}
Description: Annotations to add to the service account
serviceAccount.name📜
Type: string
""
Description: The name of the service account to use. If not set and create is true, a name is generated using the fullname template
podAnnotations📜
Type: object
{}
Default value (formatted)
{}
podSecurityContext.runAsUser📜
Type: int
1000
podSecurityContext.runAsGroup📜
Type: int
1000
podSecurityContext.runAsNonRoot📜
Type: bool
true
securityContext.capabilities.drop[0]📜
Type: string
"ALL"
securityContext.readOnlyRootFilesystem📜
Type: bool
true
securityContext.runAsNonRoot📜
Type: bool
true
securityContext.runAsUser📜
Type: int
1000
service.type📜
Type: string
"ClusterIP"
service.port📜
Type: int
10003
resources.limits📜
Type: object
{"cpu":"100m","memory":"512Mi"}
Default value (formatted)
{
"cpu": "100m",
"memory": "512Mi"
}
Description: We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after ‘resources:’.
resources.requests.cpu📜
Type: string
"100m"
resources.requests.memory📜
Type: string
"512Mi"
autoscaling.enabled📜
Type: bool
false
autoscaling.minReplicas📜
Type: int
1
autoscaling.maxReplicas📜
Type: int
3
autoscaling.targetCPUUtilizationPercentage📜
Type: int
80
nodeSelector📜
Type: object
{}
Default value (formatted)
{}
tolerations📜
Type: list
[]
Default value (formatted)
[]
affinity📜
Type: object
{}
Default value (formatted)
{}
config📜
Type: object
{"logLevel":"trace"}
Default value (formatted)
{
"logLevel": "trace"
}
Description: Name of the secret to source authservices config.json from, created outside of helm chart TODO: Create this as part of the helmchart?
selector📜
Type: object
{"key":"protect","value":"keycloak"}
Default value (formatted)
{
"key": "protect",
"value": "keycloak"
}
Description: Label to determine what workloads (pods/deployments) should be protected by authservice.
redis📜
Type: object
{"enabled":false,"image":{"tag":"7.2.2"}}
Default value (formatted)
{
"enabled": false,
"image": {
"tag": "7.2.2"
}
}
Description: Conditional for enabling Redis Subchart
redis.image📜
Type: object
{"tag":"7.2.2"}
Default value (formatted)
{
"tag": "7.2.2"
}
Description: Values passthrough for redis Subchart
redis-bb.auth.enabled📜
Type: bool
false
redis-bb.istio.redis.enabled📜
Type: bool
false
redis-bb.image.pullSecrets[0]📜
Type: string
"private-registry"
redis-bb.networkPolicies.enabled📜
Type: bool
true
redis-bb.networkPolicies.controlPlaneCidr📜
Type: string
"0.0.0.0/0"
redis-bb.master.containerSecurityContext.enabled📜
Type: bool
true
redis-bb.master.containerSecurityContext.runAsUser📜
Type: int
1001
redis-bb.master.containerSecurityContext.runAsGroup📜
Type: int
1001
redis-bb.master.containerSecurityContext.runAsNonRoot📜
Type: bool
true
redis-bb.master.containerSecurityContext.capabilities.drop[0]📜
Type: string
"ALL"
redis-bb.replica.containerSecurityContext.enabled📜
Type: bool
true
redis-bb.replica.containerSecurityContext.runAsUser📜
Type: int
1001
redis-bb.replica.containerSecurityContext.runAsGroup📜
Type: int
1001
redis-bb.replica.containerSecurityContext.runAsNonRoot📜
Type: bool
true
redis-bb.replica.containerSecurityContext.capabilities.drop[0]📜
Type: string
"ALL"
redis-bb.metrics.enabled📜
Type: bool
false
redis-bb.metrics.containerSecurityContext.enabled📜
Type: bool
true
redis-bb.metrics.containerSecurityContext.runAsUser📜
Type: int
1001
redis-bb.metrics.containerSecurityContext.runAsGroup📜
Type: int
1001
redis-bb.commonConfiguration📜
Type: string
"# Enable AOF https://redis.io/topics/persistence#append-only-file\nappendonly no\nmaxmemory 200mb\nmaxmemory-policy allkeys-lru\nsave \"\""
Default value (formatted)
# Enable AOF https://redis.io/topics/persistence#append-only-file
appendonly no
maxmemory 200mb
maxmemory-policy allkeys-lru
save \"\
openshift📜
Type: bool
false
trigger_rules📜
Type: list
[]
Default value (formatted)
[]
Description: Values to bypass OIDC chains in favor or using istio authorizationpolicies.security.istio.io and requestauthentications.security.istio.io for certain endpoints.