Skip to content

keycloak values.yaml📜

fullnameOverride📜

Type: string

Default value
""

Description: Optionally override the fully qualified name

nameOverride📜

Type: string

Default value
""

Description: Optionally override the name

replicas📜

Type: int

Default value
1

Description: The number of replicas to create (has no effect if autoscaling enabled)

image.repository📜

Type: string

Default value
"registry1.dso.mil/ironbank/opensource/keycloak/keycloak"

Description: The Keycloak image repository

image.tag📜

Type: string

Default value
"25.0.6"

Description: Overrides the Keycloak image tag; default is the chart appVersion

image.digest📜

Type: string

Default value
""

Description: Overrides the Keycloak image tag with a specific digest

image.pullPolicy📜

Type: string

Default value
"IfNotPresent"

Description: The Keycloak image pull policy

imagePullSecrets📜

Type: list

Default value
- name: private-registry

Description: Image pull secrets for the Pod

hostAliases📜

Type: list

Default value
[]

Description: Mapping between IPs and hostnames that will be injected as entries in the Pod’s hosts files

Type: bool

Default value
true

Description: Indicates whether information about services should be injected into Pod’s environment variables, matching the syntax of Docker links

podManagementPolicy📜

Type: string

Default value
"Parallel"

Description: Pod management policy. One of Parallel or OrderedReady

updateStrategy📜

Type: string

Default value
"RollingUpdate"

Description: StatefulSet’s update strategy

restartPolicy📜

Type: string

Default value
"Always"

Description: Pod restart policy. One of Always, OnFailure, or Never

serviceAccount.create📜

Type: bool

Default value
true

Description: Specifies whether a ServiceAccount should be created

serviceAccount.allowReadPods📜

Type: bool

Default value
false

Description: Specifies whether the ServiceAccount can get and list pods

serviceAccount.name📜

Type: string

Default value
""

Description: The name of the service account to use. If not set and create is true, a name is generated using the fullname template

serviceAccount.annotations📜

Type: object

Default value
{}

Description: Additional annotations for the ServiceAccount

serviceAccount.labels📜

Type: object

Default value
{}

Description: Additional labels for the ServiceAccount

serviceAccount.imagePullSecrets📜

Type: list

Default value
[]

Description: Image pull secrets that are attached to the ServiceAccount

serviceAccount.automountServiceAccountToken📜

Type: bool

Default value
true

Description: Automount API credentials for the Service Account

rbac.create📜

Type: bool

Default value
false

rbac.rules📜

Type: list

Default value
[]

podSecurityContext📜

Type: object

Default value
fsGroup: 2000
runAsGroup: 2000
runAsNonRoot: true
runAsUser: 2000

Description: SecurityContext for the entire Pod. Every container running in the Pod will inherit this SecurityContext. This might be relevant when other components of the environment inject additional containers into running Pods (service meshes are the most prominent example for this)

securityContext📜

Type: object

Default value
capabilities:
  drop:
  - ALL
runAsGroup: 2000
runAsNonRoot: true
runAsUser: 2000

Description: SecurityContext for the Keycloak container

extraInitContainers📜

Type: string

Default value
""

Description: Additional init containers, e. g. for providing custom themes

skipInitContainers📜

Type: bool

Default value
false

Description: When using service meshes which rely on a sidecar, it may be necessary to skip init containers altogether, since the sidecar doesn’t start until the init containers are done, and the sidecar may be required for network access. For example, Istio in strict mTLS mode prevents the dbchecker init container from ever completing

extraContainers📜

Type: string

Default value
""

Description: Additional sidecar containers, e. g. for a database proxy, such as Google’s cloudsql-proxy

lifecycleHooks📜

Type: string

Default value
""

Description: Lifecycle hooks for the Keycloak container

terminationGracePeriodSeconds📜

Type: int

Default value
60

Description: Termination grace period in seconds for Keycloak shutdown. Clusters with a large cache might need to extend this to give Infinispan more time to rebalance

clusterDomain📜

Type: string

Default value
"cluster.local"

Description: The internal Kubernetes cluster domain

command📜

Type: list

Default value
[]

Description: Overrides the default entrypoint of the Keycloak container

args📜

Type: list

Default value
- start

Description: Overrides the default args for the Keycloak container arg: “start” needs to be set for the container to start up properly

extraEnv📜

Type: string

Default value
""

Description: Additional environment variables for Keycloak Any environment variables defined directly in the statefulset should be set with the appropriate values rather than set here, which will potentially produce duplicates and helm upgrade errors https://www.keycloak.org/server/all-config

extraEnvFrom📜

Type: string

Default value
"- secretRef:\n    name: '{{ include \"keycloak.fullname\" . }}-env'\n"

Description: Additional environment variables for Keycloak mapped from Secret or ConfigMap

priorityClassName📜

Type: string

Default value
""

Description: Pod priority class name

affinity📜

Type: string

Default value
"podAntiAffinity:\n  requiredDuringSchedulingIgnoredDuringExecution:\n    - labelSelector:\n        matchLabels:\n          {{- include \"keycloak.selectorLabels\" . | nindent 10 }}\n        matchExpressions:\n          - key: app.kubernetes.io/component\n            operator: NotIn\n            values:\n              - test\n      topologyKey: kubernetes.io/hostname\n  preferredDuringSchedulingIgnoredDuringExecution:\n    - weight: 100\n      podAffinityTerm:\n        labelSelector:\n          matchLabels:\n            {{- include \"keycloak.selectorLabels\" . | nindent 12 }}\n          matchExpressions:\n            - key: app.kubernetes.io/component\n              operator: NotIn\n              values:\n                - test\n        topologyKey: topology.kubernetes.io/zone\n"

Description: Pod affinity

topologySpreadConstraints📜

Type: string

Default value
nil

Description: Topology spread constraints template

nodeSelector📜

Type: object

Default value
{}

Description: Node labels for Pod assignment

tolerations📜

Type: list

Default value
[]

Description: Node taints to tolerate

podLabels📜

Type: object

Default value
{}

Description: Additional Pod labels

podAnnotations📜

Type: object

Default value
{}

Description: Additional Pod annotations

livenessProbe📜

Type: string

Default value
"httpGet:\n  path: /auth/realms/master\n  port: http\n  scheme: HTTP\nfailureThreshold: 15\ntimeoutSeconds: 2\nperiodSeconds: 15\ninitialDelaySeconds: 0\n"

Description: Liveness probe configuration

readinessProbe📜

Type: string

Default value
"httpGet:\n  path: /auth/realms/master\n  port: http\n  scheme: HTTP\nfailureThreshold: 15\ntimeoutSeconds: 2\ninitialDelaySeconds: 10\n"

Description: Readiness probe configuration

startupProbe📜

Type: string

Default value
"httpGet:\n  path: /auth/realms/master\n  port: http\ninitialDelaySeconds: 90\ntimeoutSeconds: 2\nfailureThreshold: 60\nperiodSeconds: 5\n"

Description: Startup probe configuration

resources📜

Type: object

Default value
limits:
  memory: 1Gi
requests:
  cpu: '1'
  memory: 1Gi

Description: Pod resource requests and limits

extraVolumes📜

Type: string

Default value
""

Description: Add additional volumes, e. g. for custom themes

extraVolumesBigBang📜

Type: object

Default value
{}

Description: This values key is reserved for integration with BigBang chart

extraVolumeMounts📜

Type: string

Default value
""

Description: Add additional volumes mounts, e. g. for custom themes

extraVolumeMountsBigBang📜

Type: object

Default value
{}

Description: This values key is reserved for integration with BigBang chart

extraPorts📜

Type: list

Default value
[]

Description: Add additional ports, e. g. for admin console or exposing JGroups ports

podDisruptionBudget📜

Type: object

Default value
{}

Description: Pod disruption budget

statefulsetAnnotations📜

Type: object

Default value
{}

Description: Annotations for the StatefulSet

statefulsetLabels📜

Type: object

Default value
{}

Description: Additional labels for the StatefulSet

secrets📜

Type: object

Default value
env:
  stringData:
    JAVA_OPTS_APPEND: -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless
    JAVA_TOOL_OPTIONS: -Dcom.redhat.fips=false
    KEYCLOAK_ADMIN: admin
    KEYCLOAK_ADMIN_PASSWORD: password

Description: Configuration for secrets that should be created The secrets can also be independently created separate from this helm chart. for example with a gitops tool like flux with a kustomize overlay.

secrets.env📜

Type: object

Default value
stringData:
  JAVA_OPTS_APPEND: -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless
  JAVA_TOOL_OPTIONS: -Dcom.redhat.fips=false
  KEYCLOAK_ADMIN: admin
  KEYCLOAK_ADMIN_PASSWORD: password

Description: Environmental variables

secrets.env.stringData.JAVA_TOOL_OPTIONS📜

Type: string

Default value
"-Dcom.redhat.fips=false"

Description: https://access.redhat.com/documentation/en-us/openjdk/11/html-single/configuring_openjdk_11_on_rhel_with_fips/index

secrets.env.stringData.KEYCLOAK_ADMIN📜

Type: string

Default value
"admin"

Description: default admin credentials. Override them for production deployments

secrets.env.stringData.JAVA_OPTS_APPEND📜

Type: string

Default value
"-Djgroups.dns.query={{ include \"keycloak.fullname\" . }}-headless"

Description: https://www.keycloak.org/server/caching

service.annotations📜

Type: object

Default value
{}

Description: Annotations for HTTP service

service.labels📜

Type: object

Default value
{}

Description: Additional labels for headless and HTTP Services

service.type📜

Type: string

Default value
"ClusterIP"

Description: The Service type

service.loadBalancerIP📜

Type: string

Default value
""

Description: Optional IP for the load balancer. Used for services of type LoadBalancer only

service.httpPort📜

Type: int

Default value
80

Description: The http Service port

service.httpNodePort📜

Type: string

Default value
nil

Description: The HTTP Service node port if type is NodePort

service.httpsPort📜

Type: int

Default value
8443

Description: The HTTPS Service port

service.httpsNodePort📜

Type: string

Default value
nil

Description: The HTTPS Service node port if type is NodePort

service.extraPorts📜

Type: list

Default value
[]

Description: Additional Service ports, e. g. for custom admin console

service.loadBalancerSourceRanges📜

Type: list

Default value
[]

Description: When using Service type LoadBalancer, you can restrict source ranges allowed to connect to the LoadBalancer, e. g. will result in Security Groups (or equivalent) with inbound source ranges allowed to connect

service.externalTrafficPolicy📜

Type: string

Default value
"Cluster"

Description: When using Service type LoadBalancer, you can preserve the source IP seen in the container by changing the default (Cluster) to be Local. See https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

service.sessionAffinity📜

Type: string

Default value
""

Description: Session affinity See https://kubernetes.io/docs/concepts/services-networking/service/#proxy-mode-userspace

service.sessionAffinityConfig📜

Type: object

Default value
{}

Description: Session affinity config

serviceHeadless.annotations📜

Type: object

Default value
{}

Description: Annotations for headless service

ingress.enabled📜

Type: bool

Default value
false

Description: If true, an Ingress is created

ingress.ingressClassName📜

Type: string

Default value
""

Description: The name of the Ingress Class associated with this ingress

ingress.servicePort📜

Type: string

Default value
"http"

Description: The Service port targeted by the Ingress

ingress.annotations📜

Type: object

Default value
{}

Description: Ingress annotations

ingress.labels📜

Type: object

Default value
{}

Description: Additional Ingress labels

ingress.rules📜

Type: list

Default value
- host: '{{ .Release.Name }}.keycloak.example.com'
  paths:
  - path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/'
    pathType: Prefix

Description: List of rules for the Ingress

ingress.rules[0]📜

Type: object

Default value
host: '{{ .Release.Name }}.keycloak.example.com'
paths:
- path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/'
  pathType: Prefix

Description: Ingress hostname

ingress.rules[0].paths📜

Type: list

Default value
- path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/'
  pathType: Prefix

Description: Paths for the host

ingress.console📜

Type: object

Default value
annotations: {}
enabled: false
ingressClassName: ''
rules:
- host: '{{ .Release.Name }}.keycloak.example.com'
  paths:
  - path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/admin'
    pathType: Prefix
tls: []

Description: ingress for console only (/auth/admin)

ingress.console.enabled📜

Type: bool

Default value
false

Description: If true, an Ingress is created for console path only

ingress.console.ingressClassName📜

Type: string

Default value
""

Description: The name of Ingress Class associated with the console ingress only

ingress.console.annotations📜

Type: object

Default value
{}

Description: Ingress annotations for console ingress only Useful to set nginx.ingress.kubernetes.io/whitelist-source-range particularly

ingress.console.rules[0].host📜

Type: string

Default value
"{{ .Release.Name }}.keycloak.example.com"

Description: Ingress host

ingress.console.rules[0].paths📜

Type: list

Default value
- path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/admin'
  pathType: Prefix

Description: Paths for the host

ingress.console.tls📜

Type: list

Default value
[]

Description: Console TLS configuration

networkPolicy📜

Type: object

Default value
egress: []
enabled: false
extraFrom: []
labels: {}

Description: Network policy configuration https://kubernetes.io/docs/concepts/services-networking/network-policies/

networkPolicy.enabled📜

Type: bool

Default value
false

Description: If true, the Network policies are deployed

networkPolicy.labels📜

Type: object

Default value
{}

Description: Additional Network policy labels

networkPolicy.extraFrom📜

Type: list

Default value
[]

Description: Define all other external allowed source See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#networkpolicypeer-v1-networking-k8s-io

networkPolicy.egress📜

Type: list

Default value
[]

Description: Define egress networkpolicies for the Keycloak pods (external database for example) See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#networkpolicyegressrule-v1-networking-k8s-io

route.enabled📜

Type: bool

Default value
false

Description: If true, an OpenShift Route is created

route.path📜

Type: string

Default value
"/"

Description: Path for the Route

route.annotations📜

Type: object

Default value
{}

Description: Route annotations

route.labels📜

Type: object

Default value
{}

Description: Additional Route labels

route.host📜

Type: string

Default value
""

Description: Host name for the Route

route.tls📜

Type: object

Default value
enabled: true
insecureEdgeTerminationPolicy: Redirect
termination: edge

Description: TLS configuration

route.tls.enabled📜

Type: bool

Default value
true

Description: If true, TLS is enabled for the Route

route.tls.insecureEdgeTerminationPolicy📜

Type: string

Default value
"Redirect"

Description: Insecure edge termination policy of the Route. Can be None, Redirect, or Allow

route.tls.termination📜

Type: string

Default value
"edge"

Description: TLS termination of the route. Can be edge, passthrough, or reencrypt

dbchecker.enabled📜

Type: bool

Default value
true

Description: If true, the dbchecker init container is enabled

dbchecker.image.repository📜

Type: string

Default value
"registry1.dso.mil/ironbank/opensource/postgres/postgresql-alpine"

Description: Docker image used to check Postgresql readiness at startup

dbchecker.image.tag📜

Type: string

Default value
"15.10"

Description: Image tag for the pgchecker image

dbchecker.image.pullPolicy📜

Type: string

Default value
"IfNotPresent"

Description: Image pull policy for the dbchecker image

dbchecker.securityContext📜

Type: object

Default value
allowPrivilegeEscalation: false
capabilities:
  drop:
  - ALL
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000

Description: SecurityContext for the dbchecker container

dbchecker.resources📜

Type: object

Default value
limits:
  memory: 256Mi
requests:
  cpu: 250m
  memory: 256Mi

Description: Resource requests and limits for the dbchecker container

postgresql.enabled📜

Type: bool

Default value
true

Description: If true, the Postgresql dependency is enabled

postgresql.auth.username📜

Type: string

Default value
"keycloak"

Description: PostgreSQL User to create

postgresql.auth.password📜

Type: string

Default value
"keycloak"

Description: PostgreSQL Password for the new user

postgresql.auth.database📜

Type: string

Default value
"keycloak"

Description: PostgreSQL Database to create

postgresql.networkPolicy📜

Type: object

Default value
enabled: false

Description: PostgreSQL network policy configuration

postgresql.global.imagePullSecrets[0]📜

Type: string

Default value
"private-registry"

postgresql.image.registry📜

Type: string

Default value
"registry1.dso.mil"

postgresql.image.repository📜

Type: string

Default value
"ironbank/opensource/postgres/postgresql-alpine"

postgresql.image.tag📜

Type: string

Default value
"15.10"

postgresql.service.port📜

Type: int

Default value
5432

postgresql.primary.podSecurityContext.enabled📜

Type: bool

Default value
true

postgresql.primary.podSecurityContext.fsGroup📜

Type: int

Default value
1001

postgresql.primary.containerSecurityContext.enabled📜

Type: bool

Default value
true

postgresql.primary.containerSecurityContext.runAsUser📜

Type: int

Default value
1001

postgresql.primary.containerSecurityContext.runAsGroup📜

Type: int

Default value
1001

postgresql.primary.containerSecurityContext.runAsNonRoot📜

Type: bool

Default value
true

postgresql.primary.containerSecurityContext.allowPrivilegeEscalation📜

Type: bool

Default value
false

postgresql.primary.containerSecurityContext.seccompProfile.type📜

Type: string

Default value
"RuntimeDefault"

postgresql.primary.containerSecurityContext.capabilities.drop[0]📜

Type: string

Default value
"ALL"

database📜

Type: object

Default value
database: null
existingSecret: ''
existingSecretKey: ''
hostname: null
password: null
port: null
username: null
vendor: null

Description: If the database is not managed by this chart, you can use these keys to configure the connection

database.existingSecret📜

Type: string

Default value
""

Description: name of the existing secret containing the database password

database.existingSecretKey📜

Type: string

Default value
""

Description: key in the existing secret containing the database password

database.vendor📜

Type: string

Default value
nil

Description: E.g. dev-file, dev-mem, mariadb, mssql, mysql, oracle or postgres

database.hostname📜

Type: string

Default value
nil

Description: The database host

database.port📜

Type: string

Default value
nil

Description: The database port

database.database📜

Type: string

Default value
nil

Description: The database name

database.username📜

Type: string

Default value
nil

Description: The database username

database.password📜

Type: string

Default value
nil

Description: The database password (ignored if existingSecret is set)

cache.stack📜

Type: string

Default value
"default"

Description: Use “custom” to disable automatic cache configuration

proxy.enabled📜

Type: bool

Default value
true

proxy.mode📜

Type: string

Default value
"forwarded"

proxy.http.enabled📜

Type: bool

Default value
true

metrics.enabled📜

Type: bool

Default value
true

health.enabled📜

Type: bool

Default value
true

http.relativePath📜

Type: string

Default value
"/auth"

Description: For backwards compatibility reasons we set this to the value used by previous Keycloak versions.

http.internalPort📜

Type: string

Default value
"http-internal"

http.internalScheme📜

Type: string

Default value
"HTTP"

serviceMonitor.enabled📜

Type: bool

Default value
false

Description: If true, a ServiceMonitor resource for the prometheus-operator is created

serviceMonitor.namespace📜

Type: string

Default value
""

Description: Optionally sets a target namespace in which to deploy the ServiceMonitor resource

serviceMonitor.namespaceSelector📜

Type: object

Default value
{}

Description: Optionally sets a namespace for the ServiceMonitor

serviceMonitor.annotations📜

Type: object

Default value
{}

Description: Annotations for the ServiceMonitor

serviceMonitor.labels📜

Type: object

Default value
{}

Description: Additional labels for the ServiceMonitor

serviceMonitor.interval📜

Type: string

Default value
"10s"

Description: Interval at which Prometheus scrapes metrics

serviceMonitor.scrapeTimeout📜

Type: string

Default value
"10s"

Description: Timeout for scraping

serviceMonitor.path📜

Type: string

Default value
"{{ tpl .Values.http.relativePath $ | trimSuffix \"/\" }}/metrics"

Description: The path at which metrics are served

serviceMonitor.port📜

Type: string

Default value
"{{ .Values.http.internalPort }}"

Description: The Service port at which metrics are served

serviceMonitor.scheme📜

Type: string

Default value
""

serviceMonitor.tlsConfig📜

Type: object

Default value
{}

extraServiceMonitor.enabled📜

Type: bool

Default value
false

Description: If true, a ServiceMonitor resource for the prometheus-operator is created

extraServiceMonitor.namespace📜

Type: string

Default value
""

Description: Optionally sets a target namespace in which to deploy the ServiceMonitor resource

extraServiceMonitor.namespaceSelector📜

Type: object

Default value
{}

Description: Optionally sets a namespace for the ServiceMonitor

extraServiceMonitor.annotations📜

Type: object

Default value
{}

Description: Annotations for the ServiceMonitor

extraServiceMonitor.labels📜

Type: object

Default value
{}

Description: Additional labels for the ServiceMonitor

extraServiceMonitor.interval📜

Type: string

Default value
"10s"

Description: Interval at which Prometheus scrapes metrics

extraServiceMonitor.scrapeTimeout📜

Type: string

Default value
"10s"

Description: Timeout for scraping

extraServiceMonitor.path📜

Type: string

Default value
"{{ tpl .Values.http.relativePath $ | trimSuffix \"/\" }}/metrics"

Description: The path at which metrics are served

extraServiceMonitor.port📜

Type: string

Default value
"{{ .Values.http.internalPort }}"

Description: The Service port at which metrics are served

extraServiceMonitor.scheme📜

Type: string

Default value
""

extraServiceMonitor.tlsConfig📜

Type: object

Default value
{}

prometheusRule.enabled📜

Type: bool

Default value
false

Description: If true, a PrometheusRule resource for the prometheus-operator is created

prometheusRule.namespace📜

Type: string

Default value
""

Description: Optionally sets a target namespace in which to deploy the ServiceMonitor resource

prometheusRule.annotations📜

Type: object

Default value
{}

Description: Annotations for the PrometheusRule

prometheusRule.labels📜

Type: object

Default value
{}

Description: Additional labels for the PrometheusRule

prometheusRule.rules📜

Type: list

Default value
[]

Description: List of rules for Prometheus

autoscaling.enabled📜

Type: bool

Default value
false

Description: If true, an autoscaling/v2 HorizontalPodAutoscaler resource is created (requires Kubernetes 1.23 or above) Autoscaling seems to be most reliable when using KUBE_PING service discovery (see README for details) This disables the replicas field in the StatefulSet

autoscaling.labels📜

Type: object

Default value
{}

Description: Additional HorizontalPodAutoscaler labels

autoscaling.minReplicas📜

Type: int

Default value
3

Description: The minimum and maximum number of replicas for the Keycloak StatefulSet

autoscaling.maxReplicas📜

Type: int

Default value
10

autoscaling.metrics📜

Type: list

Default value
- resource:
    name: cpu
    target:
      averageUtilization: 80
      type: Utilization
  type: Resource

Description: The metrics to use for scaling

autoscaling.behavior📜

Type: object

Default value
scaleDown:
  policies:
  - periodSeconds: 300
    type: Pods
    value: 1
  stabilizationWindowSeconds: 300

Description: The scaling policy to use. This will scale up quickly but only scale down a single Pod per 5 minutes. This is important because caches are usually only replicated to 2 Pods and if one of those Pods is terminated this will give the cluster time to recover.

test.enabled📜

Type: bool

Default value
false

Description: If true, test resources are created

test.image.repository📜

Type: string

Default value
"docker.io/seleniarm/standalone-chromium"

Description: The image for the test Pod

test.image.tag📜

Type: string

Default value
"117.0"

Description: The tag for the test Pod image

test.image.pullPolicy📜

Type: string

Default value
"IfNotPresent"

Description: The image pull policy for the test Pod image

test.podSecurityContext📜

Type: object

Default value
fsGroup: 1000

Description: SecurityContext for the entire test Pod

test.securityContext📜

Type: object

Default value
runAsNonRoot: true
runAsUser: 1000

Description: SecurityContext for the test container

test.deletionPolicy📜

Type: string

Default value
"before-hook-creation"

Description: See https://helm.sh/docs/topics/charts_hooks/#hook-deletion-policies

domain📜

Type: string

Default value
"dev.bigbang.mil"

Description: Your FQDN will be ${ .Values.subdomain }.${ .Values.domain }

istio.enabled📜

Type: bool

Default value
false

Description: Toggle istio integration

istio.hardened📜

Type: object

Default value
customAuthorizationPolicies: []
customServiceEntries: []
enabled: false
outboundTrafficPolicyMode: REGISTRY_ONLY

Description: Toggle istio hardening

istio.injection📜

Type: string

Default value
"disabled"

istio.mtls.mode📜

Type: string

Default value
"STRICT"

Description: PERMISSIVE = Allow both plain text and mutual TLS traffic

istio.keycloak.enabled📜

Type: bool

Default value
false

Description: Toggle vs creation

istio.keycloak.annotations📜

Type: object

Default value
{}

istio.keycloak.labels📜

Type: object

Default value
{}

istio.keycloak.gateways[0]📜

Type: string

Default value
"istio-system/main"

istio.keycloak.hosts[0]📜

Type: string

Default value
"keycloak.{{ .Values.domain }}"

monitoring.enabled📜

Type: bool

Default value
false

networkPolicies.enabled📜

Type: bool

Default value
false

networkPolicies.ingressLabels.app📜

Type: string

Default value
"istio-ingressgateway"

networkPolicies.ingressLabels.istio📜

Type: string

Default value
"ingressgateway"

networkPolicies.smtpPort📜

Type: int

Default value
587

networkPolicies.ldap.enabled📜

Type: bool

Default value
false

networkPolicies.ldap.cidr📜

Type: string

Default value
"X.X.X.X/X"

networkPolicies.ldap.port📜

Type: int

Default value
636

networkPolicies.additionalPolicies📜

Type: list

Default value
[]

openshift📜

Type: bool

Default value
false

bbtests.enabled📜

Type: bool

Default value
false

bbtests.image📜

Type: string

Default value
"registry1.dso.mil/ironbank/big-bang/base:2.1.0"

bbtests.cypress.artifacts📜

Type: bool

Default value
true

bbtests.cypress.envs.cypress_url📜

Type: string

Default value
"http://keycloak-http.keycloak.svc.cluster.local"

bbtests.cypress.envs.cypress_username📜

Type: string

Default value
"admin"

bbtests.cypress.envs.cypress_password📜

Type: string

Default value
"password"

bbtests.cypress.envs.cypress_tnr_username📜

Type: string

Default value
"cypress"

bbtests.cypress.envs.cypress_tnr_password📜

Type: string

Default value
"tnr_w!G33ZyAt@C8"

bbtests.cypress.envs.tnr_username📜

Type: string

Default value
"cypress"

bbtests.cypress.envs.tnr_password📜

Type: string

Default value
"tnr_w!G33ZyAt@C8"

bbtests.cypress.envs.tnr_firstName📜

Type: string

Default value
"Cypress"

bbtests.cypress.envs.tnr_lastName📜

Type: string

Default value
"TNR"

bbtests.cypress.envs.tnr_email📜

Type: string

Default value
"cypress@tnr.mil"