authservice values.yaml¶
replicaCount¶
Type: int
1
Description: When setting this above 1, a redis configuration is required. See globals.redis_server_uri
istio.ambient.enabled¶
Type: bool
false
istio.enabled¶
Type: bool
false
istio.sidecar.enabled¶
Type: bool
false
istio.sidecar.outboundTrafficPolicyMode¶
Type: string
"REGISTRY_ONLY"
istio.serviceEntries.custom¶
Type: list
[]
istio.authorizationPolicies.enabled¶
Type: bool
false
istio.authorizationPolicies.custom¶
Type: list
[]
istio.mtls.mode¶
Type: string
"STRICT"
istio.hardened.enabled¶
Type: bool
false
istio.hardened.kiali.enabled¶
Type: bool
true
istio.hardened.kiali.namespaces[0]¶
Type: string
"kiali"
istio.hardened.kiali.principals[0]¶
Type: string
"cluster.local/ns/kiali/sa/kiali-service-account"
monitoring.enabled¶
Type: bool
false
networkPolicies.enabled¶
Type: bool
false
networkPolicies.additionalPolicies¶
Type: list
[]
networkPolicies.ingress.definitions.keycloak-protected.from.k8s.*/keycloak-protected.podSelector.matchLabels.protect¶
Type: string
"keycloak"
networkPolicies.ingress.to.authservice:10003.from.definition.keycloak-protected¶
Type: bool
false
networkPolicies.ingress.to.redis-bb:6379.from.k8s.monitoring/grafana¶
Type: bool
false
networkPolicies.ingress.to.haproxy:8080.from.k8s.istio-gateway/*¶
Type: bool
false
networkPolicies.ingress.to.redis-bb:9121.from.k8s.monitoring/prometheus¶
Type: bool
false
networkPolicies.egress.definitions.sso.to[0].ipBlock.cidr¶
Type: string
"0.0.0.0/0"
networkPolicies.egress.from.authservice.to.definition.sso¶
Type: bool
false
networkPolicies.egress.from.authservice.to.k8s.tempo/tempo:9411¶
Type: bool
false
networkPolicies.egress.from.haproxy.to.k8s.monitoring/alertmanager:9093¶
Type: bool
false
networkPolicies.egress.from.haproxy.to.k8s.monitoring/prometheus:9090¶
Type: bool
false
image.repository¶
Type: string
"registry1.dso.mil/ironbank/istio-ecosystem/authservice"
image.pullPolicy¶
Type: string
"IfNotPresent"
image.tag¶
Type: string
"1.1.8"
Description: Overrides the image tag whose default is the chart appVersion.
imagePullSecrets¶
Type: list
[]
issuer_uri¶
Type: string
""
Description: Issuer and jwks URIs if not using Keycloak
jwks_uri¶
Type: string
""
additionalIssuers¶
Type: list
[]
allow_unmatched_requests¶
Type: bool
true
Description: If true will allow the requests even no filter chain match is found
custom_authpolicy_rules¶
Type: list
- when:
- key: request.headers[authorization]
notValues:
- '*'
Description: Extra Ruleset for AuthorizationPolicy CUSTOM action to forward to Authservice. To enable allow_unmatched_requests must be false. These custom rules mean that only these requests will be routed and will break default BigBang setup for prometheus/alertmanager/tempo unless added. Path specific Operations are not supported, it is recommended to use only hosts, notHosts, & method operations. See reference: https://istio.io/latest/docs/reference/config/security/authorization-policy/
global.authorization_uri¶
Type: string
""
Description: Global Authorization URI value to set if not using Keycloak
global.token_uri¶
Type: string
""
Description: Global Token URI value to set if not using Keycloak
global.configuration_uri¶
Type: string
""
Description: Global OIDC discovery endpoint (.well-known/openid-configuration) to set if not using Keycloak. When set, authservice discovers authorization_uri, token_uri, and jwks_uri at runtime. Explicit authorization_uri and token_uri take precedence over this.
global.client_id¶
Type: string
"global_id"
Description: Default client_id to be used in each chain
global.client_secret¶
Type: string
"global_secret"
Description: default client_secret to be used in each chain
global.match.header¶
Type: string
":authority"
Description: Header to match. The value “:authority” is used to match the requested hostname
global.match.prefix¶
Type: string
"bigbang"
Description: value matches the start of the header value defined above
global.logout_path¶
Type: string
"/globallogout"
Description: Logout URL for the client
global.logout_redirect_uri¶
Type: string
""
Description: Logout Redirect URI for the client
global.absolute_session_timeout¶
Type: int
0
global.idle_session_timeout¶
Type: int
0
global.certificate_authority¶
Type: string
""
Description: CA signing the OIDC provider. Passed through as a Helm multi-line string. See README for example.
global.oidc¶
Type: object
host: login.dso.mil
realm: baby-yoda
Description: URI for Redis instance used for OIDC token storage/retrieval. This may also be specified per-chain. redis_server_uri: tcp://{{ .Release.Name }}-{{ .Release.Namespace }}-auth-redis-master:6379/
global.oidc.host¶
Type: string
"login.dso.mil"
Description: OpenID Connect hostname. Assumption of Keycloak based on URL construction
global.oidc.realm¶
Type: string
"baby-yoda"
Description: Realm for OpenID Connect
global.jwks¶
Type: string
""
Description: escaped json for the JWKS
global.jwks_uri¶
Type: string
""
Description: Request URI that has the JWKs. If neither jwks or jwks_uri are specified the jwks_uri is computed based on the provided OIDC realm and and host”
global.periodic_fetch_interval_sec¶
Type: int
60
Description: Request interval to check whether new JWKs are available.
global.skip_verify_peer_cert¶
Type: bool
false
Description: If set to true, the verification of the destination certificate will be skipped when making a request to the JWKs URI and the token endpoint. This option is useful when you want to use a self-signed certificate for testing purposes, but basically should not be set to true in any other cases.
chains¶
Type: object
local:
callback_uri: https://localhost/login
client_id: local_id
client_secret: local_secret
logout_path: /local
match:
header: :local
prefix: localhost
Description: Individual chains. Must have a name value and a callback_uri NOTE: if using “match” can only specify prefix OR equality, not both
nameOverride¶
Type: string
"authservice"
fullnameOverride¶
Type: string
"authservice"
serviceAccount.create¶
Type: bool
true
Description: Specifies whether a service account should be created
serviceAccount.annotations¶
Type: object
{}
Description: Annotations to add to the service account
serviceAccount.name¶
Type: string
""
Description: The name of the service account to use. If not set and create is true, a name is generated using the fullname template
podAnnotations¶
Type: object
{}
podLabels¶
Type: object
{}
podSecurityContext.runAsUser¶
Type: int
1000
podSecurityContext.runAsGroup¶
Type: int
1000
podSecurityContext.runAsNonRoot¶
Type: bool
true
securityContext.capabilities.drop[0]¶
Type: string
"ALL"
securityContext.readOnlyRootFilesystem¶
Type: bool
true
securityContext.runAsNonRoot¶
Type: bool
true
securityContext.runAsUser¶
Type: int
1000
service.type¶
Type: string
"ClusterIP"
service.port¶
Type: int
10003
resources.limits¶
Type: object
cpu: 100m
memory: 512Mi
Description: We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after ‘resources:’.
resources.requests.cpu¶
Type: string
"100m"
resources.requests.memory¶
Type: string
"512Mi"
autoscaling.enabled¶
Type: bool
false
autoscaling.minReplicas¶
Type: int
1
autoscaling.maxReplicas¶
Type: int
3
autoscaling.targetCPUUtilizationPercentage¶
Type: int
80
nodeSelector¶
Type: object
{}
tolerations¶
Type: list
[]
affinity¶
Type: object
{}
config¶
Type: object
logLevel: trace
Description: Name of the secret to source authservices config.json from, created outside of helm chart TODO: Create this as part of the helmchart?
selector¶
Type: object
key: protect
value: keycloak
Description: Label to determine what workloads (pods/deployments) should be protected by authservice.
redis¶
Type: object
enabled: false
Description: Conditional for enabling Redis Subchart
redis-bb.istio.redis.enabled¶
Type: bool
false
redis-bb.networkPolicies.enabled¶
Type: bool
true
redis-bb.networkPolicies.controlPlaneCidr¶
Type: string
"0.0.0.0/0"
redis-bb.upstream.fullnameOverride¶
Type: string
"authservice-authservice-redis-bb"
redis-bb.upstream.image.tag¶
Type: string
"8.10.1"
redis-bb.upstream.global.imagePullSecrets[0]¶
Type: string
"private-registry"
redis-bb.upstream.auth.enabled¶
Type: bool
false
redis-bb.upstream.master.containerSecurityContext.runAsUser¶
Type: int
1001
redis-bb.upstream.master.containerSecurityContext.runAsGroup¶
Type: int
1001
redis-bb.upstream.master.containerSecurityContext.runAsNonRoot¶
Type: bool
true
redis-bb.upstream.master.containerSecurityContext.capabilities.drop[0]¶
Type: string
"ALL"
redis-bb.upstream.replica.containerSecurityContext.enabled¶
Type: bool
true
redis-bb.upstream.replica.containerSecurityContext.runAsUser¶
Type: int
1001
redis-bb.upstream.replica.containerSecurityContext.runAsGroup¶
Type: int
1001
redis-bb.upstream.replica.containerSecurityContext.runAsNonRoot¶
Type: bool
true
redis-bb.upstream.replica.containerSecurityContext.capabilities.drop[0]¶
Type: string
"ALL"
redis-bb.upstream.metrics.enabled¶
Type: bool
false
redis-bb.upstream.metrics.containerSecurityContext.enabled¶
Type: bool
true
redis-bb.upstream.metrics.containerSecurityContext.runAsUser¶
Type: int
1001
redis-bb.upstream.metrics.containerSecurityContext.runAsGroup¶
Type: int
1001
redis-bb.upstream.commonConfiguration¶
Type: string
"# Enable AOF https://redis.io/topics/persistence#append-only-file\nappendonly no\nmaxmemory 200mb\nmaxmemory-policy allkeys-lru\nsave \"\""
openshift¶
Type: bool
false
trigger_rules¶
Type: list
[]
Description: Values to bypass OIDC chains in favor or using istio authorizationpolicies.security.istio.io and requestauthentications.security.istio.io for certain endpoints.
bbtests.enabled¶
Type: bool
false
bbtests.cypress.artifacts¶
Type: bool
true
bbtests.cypress.envs.cypress_prometheus_url¶
Type: string
"https://prometheus.dev.bigbang.mil"
bbtests.cypress.envs.cypress_tnr_username¶
Type: string
"cypress"
bbtests.cypress.envs.cypress_tnr_password¶
Type: string
"tnr_w!G33ZyAt@C8"