diff --git a/deploy/concierge/values.yaml b/deploy/concierge/values.yaml index 2721e27d0..7bbfbfcd7 100644 --- a/deploy/concierge/values.yaml +++ b/deploy/concierge/values.yaml @@ -3,135 +3,207 @@ #@data/values-schema --- +#@schema/title "App name" #@schema/desc "Used to help determine the names of various resources and labels." +#@schema/validation min_len=1 app_name: pinniped-concierge +#@schema/title "Namespace" #@schema/desc "Creates a new namespace statically in yaml with the given name and installs the app into that namespace." +#@schema/validation min_len=1 namespace: pinniped-concierge + +#@schema/title "Into namespace" #@ into_namespace_desc = "If specified, assumes that a namespace of the given name already exists and installs the app into that namespace. \ #@ If both `namespace` and `into_namespace` are specified, then only `into_namespace` is used." #@schema/desc into_namespace_desc +#@schema/examples ("The name of an existing namespace", "my-preexisting-namespace") #@schema/nullable -into_namespace: my-preexisting-namespace +#@schema/validation min_len=1 +into_namespace: "" +#@schema/title "Custom labels" #@ custom_labels_desc = "All resources created statically by yaml at install-time and all resources created dynamically \ -#@ by controllers at runtime will be labelled with `app: $app_name` and also with the labels \ -#@ specified here. The value of `custom_labels` must be a map of string keys to string values. \ -#@ The app can be uninstalled either by: \ -#@ 1. Deleting the static install-time yaml resources including the static namespace, which will cascade and also delete \ -#@ resources that were dynamically created by controllers at runtime \ -#@ 2. Or, deleting all resources by label, which does not assume that there was a static install-time yaml namespace." +#@ by controllers at runtime will be labelled with `app: $app_name` and also with the labels specified here. The value of \ +#@ `custom_labels` must be a map of string keys to string values. The app can be uninstalled either by: 1.) deleting the \ +#@ static install-time yaml resources including the static namespace, which will cascade and also delete \ +#@ resources that were dynamically created by controllers at runtime, or 2.) deleting all resources by label, which does \ +#@ not assume that there was a static install-time yaml namespace." #@schema/desc custom_labels_desc +#@schema/examples ("Example set of labels", {"myCustomLabelName": "myCustomLabelValue", "otherCustomLabelName": "otherCustomLabelValue"}) #@schema/type any=True -custom_labels: {} #! {myCustomLabelName: myCustomLabelValue, otherCustomLabelName: otherCustomLabelValue} +#@schema/validation ("a map of keys and values", lambda v: type(v) in ["yamlfragment"]) +custom_labels: {} +#@schema/title "Replicas" #@schema/desc "Specify how many replicas of the Pinniped server to run." replicas: 2 -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." +#@schema/title "Image repo" +#@schema/desc "The repository for the Concierge container image." +#@schema/validation min_len=1 image_repo: projects.registry.vmware.com/pinniped/pinniped-server -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." + +#@schema/title "Image digest" +#@schema/desc "The image digest for the Concierge container image. If both image_digest or an image_tag are given, only image_digest will be used." +#@schema/examples ("Digest", "sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8") #@schema/nullable -image_digest: sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8 -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." +#@schema/validation min_len=1, when=lambda _, ctx: ctx.parent["image_tag"] == None +image_digest: "" + +#@schema/title "Image tag" +#@schema/desc "The image tag for the Concierge container image. If both image_digest or an image_tag are given, only image_digest will be used." +#@schema/examples ("Tag", "v0.25.0") +#@schema/validation min_len=1, when=lambda _, ctx: ctx.parent["image_digest"] == None image_tag: latest +#@schema/title "Kube Cert Agent image" #@ kube_cert_agent_image = "Optionally specify a different image for the 'kube-cert-agent' pod which is scheduled \ #@ on the control plane. This image needs only to include `sleep` and `cat` binaries. \ #@ By default, the same image specified for image_repo/image_digest/image_tag will be re-used." #@schema/desc kube_cert_agent_image +#@schema/examples ("Image including tag or digest", "projects.registry.vmware.com/pinniped/pinniped-server:latest") #@schema/nullable -kube_cert_agent_image: projects.registry.vmware.com/pinniped/pinniped-server +#@schema/validation min_len=1 +kube_cert_agent_image: "" -#@ image_pull_dockerconfigjson_desc = "Specifies a secret to be used when pulling the above `image_repo` container image. \ -#@ Can be used when the above image_repo is a private registry. \ -#@ Typically the value would be the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username=\"USERNAME\" --docker-password=\"PASSWORD\" --dry-run=client -o json | jq -r '.data[\".dockerconfigjson\"]' \ -#@ Optional." -#! base64 encoded: {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}} -#! result: eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUuaW8iOnsidXNlcm5hbWUiOiJVU0VSTkFNRSIsInBhc3N3b3JkIjoiUEFTU1dPUkQiLCJhdXRoIjoiVlZORlVrNUJUVVU2VUVGVFUxZFBVa1E9In19fQ== +#@schema/title "Image pull dockerconfigjson" +#@ image_pull_dockerconfigjson_desc = "A base64 encoded secret to be used when pulling the `image_repo` container image. \ +#@ Can be used when the image_repo is a private registry. Typically, the value would be the output of: \ +#@ kubectl create secret docker-registry x --docker-server=https://example.io --docker-username='USERNAME' --docker-password='PASSWORD' --dry-run=client -o json | jq -r '.data[\".dockerconfigjson\"]'" #@schema/desc image_pull_dockerconfigjson_desc +#@ example_desc = 'base64 encoding of: {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}' +#@ example_value = "eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUuaW8iOnsidXNlcm5hbWUiOiJVU0VSTkFNRSIsInBhc3N3b3JkIjoiUEFTU1dPUkQiLCJhdXRoIjoiVlZORlVrNUJUVVU2VUVGVFUxZFBVa1E9In19fQ==" +#@schema/examples (example_desc, example_value) #@schema/nullable -image_pull_dockerconfigjson: "eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUuaW8iOnsidXNlcm5hbWUiOiJVU0VSTkFNRSIsInBhc3N3b3JkIjoiUEFTU1dPUkQiLCJhdXRoIjoiVlZORlVrNUJUVVU2VUVGVFUxZFBVa1E9In19fQ==" +#@schema/validation min_len=1 +image_pull_dockerconfigjson: "" +#@schema/title "Discovery URL" #@schema/desc "Pinniped will try to guess the right K8s API URL for sharing that information with potential clients. This setting allows the guess to be overridden." +#@schema/examples ("Kubernetes API URL","https://example.com") #@schema/nullable -discovery_url: https://example.com +#@schema/validation min_len=1 +discovery_url: "" -#@ api_serving_certificate_desc = "Specify the duration and renewal interval for the API serving certificate. \ -#@ The defaults are set to expire the cert about every 30 days, and to rotate it \ -#@ about every 25 days. Specify this as an integer or as a string which contains an integer value." -#@schema/desc api_serving_certificate_desc +#@schema/title "API serving certificate duration seconds" +#@ api_serving_certificate_duration_seconds_desc = "Specify the duration for the API serving certificate. \ +#@ The default is set to expire the cert about every 30 days. \ +#@ Specify this as an integer or as a string which contains an integer value." +#@schema/desc api_serving_certificate_duration_seconds_desc #@schema/type any=True +#@schema/validation ("an int or string", lambda v: type(v) in ["int", "string"]) api_serving_certificate_duration_seconds: 2592000 -#@schema/desc api_serving_certificate_desc + +#@schema/title "API serving certificate renew before seconds" +#@ api_serving_certificate_renew_before_seconds_desc = "Specify the renewal interval for the API serving certificate. \ +#@ The default is set to rotate it about every 25 days. \ +#@ Specify this as an integer or as a string which contains an integer value." +#@schema/desc api_serving_certificate_renew_before_seconds_desc #@schema/type any=True +#@schema/validation ("an int or string", lambda v: type(v) in ["int", "string"]) api_serving_certificate_renew_before_seconds: 2160000 -#! Specify the verbosity of logging: info ("nice to know" information), debug (developer information), trace (timing information), -#! or all (kitchen sink). Do not use trace or all on production systems, as credentials may get logged. -#@schema/desc "default, when this value is left unset, only warnings and errors are printed. There is no way to suppress warning and error logs." +#@schema/title "Log level" +#@ log_level_desc = "Specify the verbosity of logging: info (\"nice to know\" information), debug (developer information), trace (timing information), \ +#@ or all (kitchen sink). Do not use trace or all on production systems, as credentials may get logged. \ +#@ When this value is left unset, only warnings and errors are printed. There is no way to suppress warning and error logs." +#@schema/desc log_level_desc +#@schema/examples ("Developer logging information","debug") #@schema/nullable -log_level: info +#@schema/validation one_of=["info", "debug", "trace", "all"] +log_level: "" + +#@schema/title "Log format" #@ deprecated_log_format_desc = "Specify the format of logging: json (for machine parsable logs) and text (for legacy klog formatted logs). \ #@ By default, when this value is left unset, logs are formatted in json. \ #@ This configuration is deprecated and will be removed in a future release at which point logs will always be formatted as json." #@schema/desc deprecated_log_format_desc +#@schema/examples ("Set logs to JSON format","json") #@schema/nullable -deprecated_log_format: json +#@schema/validation one_of=["json", "text"] +#@schema/deprecated "This configuration is deprecated and will be removed in a future release at which point logs will always be formatted as json." +deprecated_log_format: "" -#@schema/desc "run_as_user specifies the user ID that will own the process, see the Dockerfile for the reasoning behind this choice" +#@schema/title "Run as user" +#@schema/desc "The user ID that will own the process." +#! See the Dockerfile for the reasoning behind this default value. run_as_user: 65532 -#@schema/desc "run_as_group specifies the group ID that will own the process, see the Dockerfile for the reasoning behind this choice" + +#@schema/title "Run as group" +#@schema/desc "The group ID that will own the process." +#! See the Dockerfile for the reasoning behind this default value. run_as_group: 65532 +#@schema/title "API group suffix" #@ api_group_suffix_desc = "Specify the API group suffix for all Pinniped API groups. By default, this is set to \ #@ pinniped.dev, so Pinniped API groups will look like foo.pinniped.dev, \ #@ authentication.concierge.pinniped.dev, etc. As an example, if this is set to tuna.io, then \ #@ Pinniped API groups will look like foo.tuna.io. authentication.concierge.tuna.io, etc." #@schema/desc api_group_suffix_desc +#@schema/validation min_len=1 api_group_suffix: pinniped.dev +#@schema/title "Impersonation proxy spec" #@schema/desc "Customize CredentialIssuer.spec.impersonationProxy to change how the concierge handles impersonation." impersonation_proxy_spec: - #! options are "auto", "disabled" or "enabled". - #! If auto, the impersonation proxy will run only if the cluster signing key is not available - #! and the other strategy does not work. - #! If disabled, the impersonation proxy will never run, which could mean that the concierge - #! doesn't work at all. - #! If enabled, the impersonation proxy will always run regardless of other strategies available. - #@schema/desc "If enabled, the impersonation proxy will always run regardless of other strategies available." + + #@schema/title "Mode" + #@ impersonation_mode_desc = "If enabled, the impersonation proxy will always run regardless of other strategies available. \ + #@ Options are 'auto', 'disabled' or 'enabled'. If auto, the impersonation proxy will run only if the cluster signing key is \ + #@ not available and the other strategy does not work. If disabled, the impersonation proxy will never run, which could mean \ + #@ that the concierge doesn't work at all." + #@schema/desc impersonation_mode_desc + #@schema/examples ("Always run, regardless of available strategies", "enabled"),("Detect if cluster signing key is available for use","auto") mode: auto + + #@schema/title "External endpoint" #@ external_endpoint_desc = "The endpoint which the client should use to connect to the impersonation proxy. \ #@ If left unset, the client will default to connecting based on the ClusterIP or LoadBalancer endpoint." #@schema/desc external_endpoint_desc + #@schema/examples ("Specified impersonation proxy endpoint", "1.2.3.4:5678") #@schema/nullable - external_endpoint: 1.2.3.4:5678 + #@schema/validation min_len=1 + external_endpoint: "" + + #@schema/title "Service" #@schema/desc "The impersonation proxy service configuration" service: - #! Options are "LoadBalancer", "ClusterIP" and "None". - #! LoadBalancer automatically provisions a Service of type LoadBalancer pointing at - #! the impersonation proxy. Some cloud providers will allocate - #! a public IP address by default even on private clusters. - #! ClusterIP automatically provisions a Service of type ClusterIP pointing at the - #! impersonation proxy. - #! None does not provision either and assumes that you have set the external_endpoint - #! and set up your own ingress to connect to the impersonation proxy. - #@schema/desc "Options are 'LoadBalancer', 'ClusterIP' and 'None'." + + #@schema/title "Type" + #@ impersonation_service_type_desc = "Service backing the impersonation proxy. Options are 'LoadBalancer', 'ClusterIP' \ + #@ and 'None'. LoadBalancer automatically provisions a Service of type LoadBalancer pointing at the impersonation \ + #@ proxy. Some cloud providers will allocate a public IP address by default even on private clusters. ClusterIP \ + #@ automatically provisions a Service of type ClusterIP pointing at the impersonation proxy. None does not provision \ + #@ either and assumes that you have set the external_endpoint and set up your own ingress to connect to the impersonation proxy." + #@schema/desc impersonation_service_type_desc + #@schema/examples ("Fall back to ClusterIP", "ClusterIP") + #@schema/validation one_of=["LoadBalancer", "ClusterIP", "None"] type: LoadBalancer + + #@schema/title "Annotations" #@schema/desc "The annotations that should be set on the ClusterIP or LoadBalancer Service." annotations: {service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "4000"} - #@schema/desc "When mode LoadBalancer is set, this will set the LoadBalancer Service's Spec.LoadBalancerIP." - #@schema/nullable - load_balancer_ip: 1.2.3.4:5678 + #@schema/title "Load balancer IP" + #@schema/desc "When mode LoadBalancer is set, this will set the LoadBalancer Service's Spec.LoadBalancerIP." + #@schema/examples ("Specified IP with port", "1.2.3.4:5678") + #@schema/nullable + #@schema/validation min_len=1 + load_balancer_ip: "" + +#@schema/title "HTTPS proxy" #@ https_proxy_desc = "Set the standard golang HTTPS_PROXY and NO_PROXY environment variables on the Supervisor containers. \ #@ These will be used when the Supervisor makes backend-to-backend calls to upstream identity providers using HTTPS, \ #@ e.g. when the Supervisor fetches discovery documents, JWKS keys, and tokens from an upstream OIDC Provider. \ #@ The Supervisor never makes insecure HTTP calls, so there is no reason to set HTTP_PROXY. \ #@ Optional." #@schema/desc https_proxy_desc +#@schema/examples ("Provide a proxy endpoint","http://proxy.example.com") #@schema/nullable -https_proxy: http://proxy.example.com -#@schema/desc "do not proxy Kubernetes endpoints" +https_proxy: "" + +#@schema/title "No proxy" +#@schema/desc "Endpoints that should not be proxied. Defaults to some sensible known values on public cloud providers." no_proxy: "$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost,.svc,.cluster.local" #! do not proxy Kubernetes endpoints diff --git a/deploy/local-user-authenticator/values.yaml b/deploy/local-user-authenticator/values.yaml index df991aa7b..7341cd889 100644 --- a/deploy/local-user-authenticator/values.yaml +++ b/deploy/local-user-authenticator/values.yaml @@ -3,23 +3,41 @@ #@data/values-schema --- -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." +#@schema/title "Image repo" +#@schema/desc "The repository for the local-user-authenticator container image." +#@schema/validation min_len=1 image_repo: projects.registry.vmware.com/pinniped/pinniped-server -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." + +#@schema/title "Image digest" +#@schema/desc "The image digest for the local-user-authenticator container image. If both image_digest or an image_tag are given, only image_digest will be used." +#@schema/examples ("Digest", "sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8") #@schema/nullable -image_digest: sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8 -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." +#@schema/validation min_len=1, when=lambda _, ctx: ctx.parent["image_tag"] == None +image_digest: "" + +#@schema/title "Image tag" +#@schema/desc "The image tag for the local-user-authenticator container image. If both image_digest or an image_tag are given, only image_digest will be used." +#@schema/examples ("Tag", "v0.25.0") +#@schema/validation min_len=1, when=lambda _, ctx: ctx.parent["image_digest"] == None image_tag: latest -#@ image_pull_dockerconfigjson_desc = "Specifies a secret to be used when pulling the above `image_repo` container image. \ -#@ Can be used when the above image_repo is a private registry. \ -#@ Typically the value would be the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username='USERNAME' --docker-password='PASSWORD' --dry-run=client -o json | jq -r '.data['.dockerconfigjson']' \ -#@ Optional." +#@schema/title "Image pull dockerconfigjson" +#@ image_pull_dockerconfigjson_desc = "A base64 encoded secret to be used when pulling the `image_repo` container image. \ +#@ Can be used when the image_repo is a private registry. Typically, the value would be the output of: \ +#@ kubectl create secret docker-registry x --docker-server=https://example.io --docker-username='USERNAME' --docker-password='PASSWORD' --dry-run=client -o json | jq -r '.data[\".dockerconfigjson\"]'" #@schema/desc image_pull_dockerconfigjson_desc +#@ example_desc = 'base64 encoding of: {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}' +#@ example_value = "eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUuaW8iOnsidXNlcm5hbWUiOiJVU0VSTkFNRSIsInBhc3N3b3JkIjoiUEFTU1dPUkQiLCJhdXRoIjoiVlZORlVrNUJUVVU2VUVGVFUxZFBVa1E9In19fQ==" +#@schema/examples (example_desc, example_value) #@schema/nullable -image_pull_dockerconfigjson: {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}} +image_pull_dockerconfigjson: "" -#@schema/desc "run_as_user specifies the user ID that will own the process, see the Dockerfile for the reasoning behind this choice" +#@schema/title "Run as user" +#@schema/desc "The user ID that will own the process." +#! See the Dockerfile for the reasoning behind this default value. run_as_user: 65532 -#@schema/desc "run_as_group specifies the group ID that will own the process, see the Dockerfile for the reasoning behind this choice" + +#@schema/title "Run as group" +#@schema/desc "The group ID that will own the process." +#! See the Dockerfile for the reasoning behind this default value. run_as_group: 65532 diff --git a/deploy/supervisor/values.yaml b/deploy/supervisor/values.yaml index 217f8680a..8cf5e928f 100644 --- a/deploy/supervisor/values.yaml +++ b/deploy/supervisor/values.yaml @@ -3,175 +3,220 @@ #@data/values-schema --- +#@schema/title "App name" #@schema/desc "Used to help determine the names of various resources and labels." +#@schema/validation min_len=1 app_name: pinniped-supervisor +#@schema/title "Namespace" #@schema/desc "Creates a new namespace statically in yaml with the given name and installs the app into that namespace." +#@schema/validation min_len=1 namespace: pinniped-supervisor + +#@schema/title "Into namespace" #@ into_namespace_desc = "If specified, assumes that a namespace of the given name already exists and installs the app into that namespace. \ #@ If both `namespace` and `into_namespace` are specified, then only `into_namespace` is used." #@schema/desc into_namespace_desc +#@schema/examples ("The name of an existing namespace", "my-preexisting-namespace") #@schema/nullable -into_namespace: my-preexisting-namespace +#@schema/validation min_len=1 +into_namespace: "" +#@schema/title "Custom labels" #@ custom_labels_desc = "All resources created statically by yaml at install-time and all resources created dynamically \ -#@ by controllers at runtime will be labelled with `app: $app_name` and also with the labels \ -#@ specified here. The value of `custom_labels` must be a map of string keys to string values. \ -#@ The app can be uninstalled either by: \ -#@ 1.) deleting the static install-time yaml resources including the static namespace, which will cascade and also delete \ -#@ resources that were dynamically created by controllers at runtime, \ -#@ or, 2.) deleting all resources by label, which does not assume that there was a static install-time yaml namespace." +#@ by controllers at runtime will be labelled with `app: $app_name` and also with the labels specified here. The value of \ +#@ `custom_labels` must be a map of string keys to string values. The app can be uninstalled either by: 1.) deleting the \ +#@ static install-time yaml resources including the static namespace, which will cascade and also delete \ +#@ resources that were dynamically created by controllers at runtime, or 2.) deleting all resources by label, which does \ +#@ not assume that there was a static install-time yaml namespace." #@schema/desc custom_labels_desc +#@schema/examples ("Example set of labels", {"myCustomLabelName": "myCustomLabelValue", "otherCustomLabelName": "otherCustomLabelValue"}) #@schema/type any=True -custom_labels: {} #! {myCustomLabelName: myCustomLabelValue, otherCustomLabelName: otherCustomLabelValue} +#@schema/validation ("a map of keys and values", lambda v: type(v) in ["yamlfragment"]) +custom_labels: {} +#@schema/title "Replicas" #@schema/desc "Specify how many replicas of the Pinniped server to run." replicas: 2 -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." +#@schema/title "Image repo" +#@schema/desc "The repository for the Concierge container image." +#@schema/validation min_len=1 image_repo: projects.registry.vmware.com/pinniped/pinniped-server -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." + +#@schema/title "Image digest" +#@schema/desc "The image digest for the Concierge container image. If both image_digest or an image_tag are given, only image_digest will be used." +#@schema/examples ("Digest", "sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8") #@schema/nullable -image_digest: sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8 -#@schema/desc "Specify either an image_digest or an image_tag. If both are given, only image_digest will be used." +#@schema/validation min_len=1, when=lambda _, ctx: ctx.parent["image_tag"] == None +image_digest: "" + +#@schema/title "Image tag" +#@schema/desc "The image tag for the Concierge container image. If both image_digest or an image_tag are given, only image_digest will be used." +#@schema/examples ("Tag", "v0.25.0") +#@schema/validation min_len=1, when=lambda _, ctx: ctx.parent["image_digest"] == None image_tag: latest -#@ image_pull_dockerconfigjson_desc = "Specifies a secret to be used when pulling the above `image_repo` container image. \ -#@ Can be used when the above image_repo is a private registry. \ -#@ Typically the value would be the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username=\"USERNAME\" --docker-password=\"PASSWORD\" --dry-run=client -o json | jq -r '.data[\".dockerconfigjson\"]' \ -#@ Optional." -#! base64 encoded: {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}} -#! result: eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUuaW8iOnsidXNlcm5hbWUiOiJVU0VSTkFNRSIsInBhc3N3b3JkIjoiUEFTU1dPUkQiLCJhdXRoIjoiVlZORlVrNUJUVVU2VUVGVFUxZFBVa1E9In19fQ== +#@schema/title "Image pull dockerconfigjson" +#@ image_pull_dockerconfigjson_desc = "A base64 encoded secret to be used when pulling the `image_repo` container image. \ +#@ Can be used when the image_repo is a private registry. Typically, the value would be the output of: \ +#@ kubectl create secret docker-registry x --docker-server=https://example.io --docker-username='USERNAME' --docker-password='PASSWORD' --dry-run=client -o json | jq -r '.data[\".dockerconfigjson\"]'" #@schema/desc image_pull_dockerconfigjson_desc +#@ example_desc = 'base64 encoding of: {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}' +#@ example_value = "eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUuaW8iOnsidXNlcm5hbWUiOiJVU0VSTkFNRSIsInBhc3N3b3JkIjoiUEFTU1dPUkQiLCJhdXRoIjoiVlZORlVrNUJUVVU2VUVGVFUxZFBVa1E9In19fQ==" +#@schema/examples (example_desc, example_value) #@schema/nullable -image_pull_dockerconfigjson: "eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUuaW8iOnsidXNlcm5hbWUiOiJVU0VSTkFNRSIsInBhc3N3b3JkIjoiUEFTU1dPUkQiLCJhdXRoIjoiVlZORlVrNUJUVVU2VUVGVFUxZFBVa1E9In19fQ==" +#@schema/validation min_len=1 +image_pull_dockerconfigjson: "" -#! Specify how to expose the Supervisor app's HTTPS port as a Service. -#! Typically, you would set a value for only one of the following service types. -#! Setting any of these values means that a Service of that type will be created. They are all optional. -#! Note that all port numbers should be numbers (not strings), i.e. use ytt's `--data-value-yaml` instead of `--data-value`. -#! Several of these values have been deprecated and will be removed in a future release. Their names have been changed to -#! mark them as deprecated and to make it obvious upon upgrade to anyone who was using them that they have been deprecated. -#@schema/desc "will be removed in a future release; when specified, creates a NodePort Service with this `port` value, with port 8080 as its `targetPort`" +#@schema/title "Deprecated service HTTP nodeport port" +#@schema/desc "When specified, creates a NodePort Service with this `port` value, with port 8080 as its `targetPort`" +#@schema/examples ("Specify port","31234") #@schema/nullable -deprecated_service_http_nodeport_port: 31234 -#@schema/desc "will be removed in a future release; the `nodePort` value of the NodePort Service, optional when `deprecated_service_http_nodeport_port` is specified" -#@schema/nullable -deprecated_service_http_nodeport_nodeport: 31234 -#@schema/desc "will be removed in a future release; when specified, creates a LoadBalancer Service with this `port` value, with port 8080 as its `targetPort`" -#@schema/nullable -deprecated_service_http_loadbalancer_port: 8443 -#@schema/desc "will be removed in a future release; when specified, creates a ClusterIP Service with this `port` value, with port 8080 as its `targetPort`" -#@schema/nullable -deprecated_service_http_clusterip_port: 8443 -#@schema/desc "when specified, creates a NodePort Service with this `port` value, with port 8443 as its `targetPort`" -#@schema/nullable -service_https_nodeport_port: 31243 -#@schema/desc "the `nodePort` value of the NodePort Service, optional when `service_https_nodeport_port` is specified" -#@schema/nullable -service_https_nodeport_nodeport: 31243 -#@schema/desc "when specified, creates a LoadBalancer Service with this `port` value, with port 8443 as its `targetPort`" -#@schema/nullable -service_https_loadbalancer_port: 8443 -#@schema/desc "when specified, creates a ClusterIP Service with this `port` value, with port 8443 as its `targetPort`" -#@schema/nullable -service_https_clusterip_port: 8443 -#@ service_loadbalancer_ip_desc="The `loadBalancerIP` value of the LoadBalancer Service. \ -#@ Ignored unless service_https_loadbalancer_port is provided." -#@schema/desc service_loadbalancer_ip_desc -#@schema/nullable -service_loadbalancer_ip: 1.2.3.4 +#@schema/deprecated "This data value will be removed in a future release" +deprecated_service_http_nodeport_port: "" -#! Specify the verbosity of logging: info ("nice to know" information), debug (developer information), trace (timing information), -#! or all (kitchen sink). Do not use trace or all on production systems, as credentials may get logged. -#@schema/desc "default, when this value is left unset, only warnings and errors are printed. There is no way to suppress warning and error logs." +#@schema/title "Deprecated service http nodeport nodeport" +#@schema/desc "The `nodePort` value of the NodePort Service, optional when `deprecated_service_http_nodeport_port` is specified" +#@schema/examples ("Specify port","31234") #@schema/nullable -log_level: info +#@schema/deprecated "This data value will be removed in a future release" +deprecated_service_http_nodeport_nodeport: "" + +#@schema/title "Deprecated service http loadbalancer port" +#@schema/desc "When specified, creates a LoadBalancer Service with this `port` value, with port 8080 as its `targetPort`" +#@schema/examples ("Specify port","8443") +#@schema/nullable +#@schema/deprecated "This data value will be removed in a future release" +deprecated_service_http_loadbalancer_port: "" + +#@schema/title "Deprecated service http clusterip port" +#@schema/desc "Creates a ClusterIP Service with this `port` value, with port 8080 as its `targetPort`" +#@schema/examples ("Specify port","8443") +#@schema/nullable +#@schema/deprecated "This data value will be removed in a future release" +deprecated_service_http_clusterip_port: "" + +#@schema/title "Service https nodeport port" +#@schema/desc "When specified, creates a NodePort Service with this `port` value, with port 8443 as its `targetPort`" +#@schema/examples ("Specify port","31243") +#@schema/nullable +service_https_nodeport_port: "" + +#@schema/title "Service https nodeport nodeport" +#@schema/desc "The `nodePort` value of the NodePort Service, optional when `service_https_nodeport_port` is specified" +#@schema/examples ("Specify port","31243") +#@schema/nullable +service_https_nodeport_nodeport: "" + +#@schema/title "Service https loadbalancer port" +#@schema/desc "When specified, creates a LoadBalancer Service with this `port` value, with port 8443 as its `targetPort`" +#@schema/examples ("Specify port","8443") +#@schema/nullable +service_https_loadbalancer_port: "" + +#@schema/title "Service https clusterip port" +#@schema/desc "When specified, creates a ClusterIP Service with this `port` value, with port 8443 as its `targetPort`" +#@schema/examples ("Specify port","8443") +#@schema/nullable +service_https_clusterip_port: "" + +#@schema/title "Service loadbalancer ip" +#@schema/desc "The `loadBalancerIP` value of the LoadBalancer Service. Ignored unless service_https_loadbalancer_port is provided." +#@schema/examples ("Example IP address","1.2.3.4") +#@schema/nullable +service_loadbalancer_ip: "" + +#@schema/title "Log level" +#@ log_level_desc = "Specify the verbosity of logging: info (\"nice to know\" information), debug (developer information), trace (timing information), \ +#@ or all (kitchen sink). Do not use trace or all on production systems, as credentials may get logged. \ +#@ When this value is left unset, only warnings and errors are printed. There is no way to suppress warning and error logs." +#@schema/desc log_level_desc +#@schema/examples ("Developer logging information","debug") +#@schema/nullable +#@schema/validation one_of=["info", "debug", "trace", "all"] +log_level: "" + +#@schema/title "Log format" #@ deprecated_log_format_desc = "Specify the format of logging: json (for machine parsable logs) and text (for legacy klog formatted logs). \ #@ By default, when this value is left unset, logs are formatted in json. \ #@ This configuration is deprecated and will be removed in a future release at which point logs will always be formatted as json." #@schema/desc deprecated_log_format_desc +#@schema/examples ("Set logs to JSON format","json") #@schema/nullable -deprecated_log_format: json +#@schema/validation one_of=["json", "text"] +#@schema/deprecated "This configuration is deprecated and will be removed in a future release at which point logs will always be formatted as json." +deprecated_log_format: "" -#@schema/desc "specifies the user ID that will own the process, see the Dockerfile for the reasoning behind this choice" +#@schema/title "Run as user" +#@schema/desc "The user ID that will own the process." +#! See the Dockerfile for the reasoning behind this default value. run_as_user: 65532 -#@schema/desc "specifies the group ID that will own the process, see the Dockerfile for the reasoning behind this choice" + +#@schema/title "Run as group" +#@schema/desc "The group ID that will own the process." +#! See the Dockerfile for the reasoning behind this default value. run_as_group: 65532 +#@schema/title "API group suffix" #@ api_group_suffix_desc = "Specify the API group suffix for all Pinniped API groups. By default, this is set to \ #@ pinniped.dev, so Pinniped API groups will look like foo.pinniped.dev, \ #@ authentication.concierge.pinniped.dev, etc. As an example, if this is set to tuna.io, then \ #@ Pinniped API groups will look like foo.tuna.io. authentication.concierge.tuna.io, etc." #@schema/desc api_group_suffix_desc +#@schema/validation min_len=1 api_group_suffix: pinniped.dev +#@schema/title "HTTPS proxy" #@ https_proxy_desc = "Set the standard golang HTTPS_PROXY and NO_PROXY environment variables on the Supervisor containers. \ #@ These will be used when the Supervisor makes backend-to-backend calls to upstream identity providers using HTTPS, \ #@ e.g. when the Supervisor fetches discovery documents, JWKS keys, and tokens from an upstream OIDC Provider. \ #@ The Supervisor never makes insecure HTTP calls, so there is no reason to set HTTP_PROXY. \ #@ Optional." #@schema/desc https_proxy_desc +#@schema/examples ("Provide a proxy endpoint","http://proxy.example.com") #@schema/nullable -https_proxy: http://proxy.example.com -#@schema/desc "Endpoints that should not use the proxy." +https_proxy: "" + +#@schema/title "No proxy" +#@schema/desc "Endpoints that should not be proxied. Defaults to some sensible known values on public cloud providers." +#@schema/validation min_len=1 no_proxy: "$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost,.svc,.cluster.local" #! do not proxy Kubernetes endpoints -#! Control the HTTP and HTTPS listeners of the Supervisor. -#! -#! The schema of this config is as follows: -#! -#! endpoints: -#! https: -#! network: tcp | unix | disabled -#! address: host:port when network=tcp or /pinniped_socket/socketfile.sock when network=unix -#! http: -#! network: same as above -#! address: same as above, except that when network=tcp then the address is only allowed to bind to loopback interfaces -#! -#! Setting network to disabled turns off that particular listener. -#! See https://pkg.go.dev/net#Listen and https://pkg.go.dev/net#Dial for a description of what can be -#! specified in the address parameter based on the given network parameter. To aid in the use of unix -#! domain sockets, a writable empty dir volume is mounted at /pinniped_socket when network is set to "unix." -#! -#! The current defaults are: -#! -#! endpoints: -#! https: -#! network: tcp -#! address: :8443 -#! http: -#! network: disabled -#! -#! These defaults mean: For HTTPS listening, bind to all interfaces using TCP on port 8443. -#! Disable HTTP listening by default. -#! -#! The HTTP listener can only be bound to loopback interfaces. This allows the listener to accept -#! traffic from within the pod, e.g. from a service mesh sidecar. The HTTP listener should not be -#! used to accept traffic from outside the pod, since that would mean that the network traffic could be -#! transmitted unencrypted. The HTTPS listener should be used instead to accept traffic from outside the pod. -#! Ingresses and load balancers that terminate TLS connections should re-encrypt the data and route traffic -#! to the HTTPS listener. Unix domain sockets may also be used for integrations with service meshes. -#! -#! Changing the HTTPS port number must be accompanied by matching changes to the service and deployment -#! manifests. Changes to the HTTPS listener must be coordinated with the deployment health checks. -#! -#@schema/desc "Control the HTTP and HTTPS listeners of the Supervisor." +#@schema/title "Endpoints" +#@ endpoints_desc = "Control the HTTP and HTTPS listeners of the Supervisor. The current defaults are: \ +#@ {\"https\":{\"network\":\"tcp\",\"address\":\":8443\"},\"http\":\"disabled\"}. \ +#@ These defaults mean: 1.) For HTTPS listening, bind to all interfaces using TCP on port 8443 and \ +#@ 2.) Disable HTTP listening by default. \ +#@ The schema of this config is as follows: \ +#@ {'https':{'network':'tcp | unix | disabled','address':'host:port when network=tcp or /pinniped_socket/socketfile.sock when network=unix'},'http':{'network':'tcp | unix | disabled','address':'same as https, except that when network=tcp then the address is only allowed to bind to loopback interfaces'}} \ +#@ The HTTP listener can only be bound to loopback interfaces. This allows the listener to accept \ +#@ traffic from within the pod, e.g. from a service mesh sidecar. The HTTP listener should not be \ +#@ used to accept traffic from outside the pod, since that would mean that the network traffic could be \ +#@ transmitted unencrypted. The HTTPS listener should be used instead to accept traffic from outside the pod. \ +#@ Ingresses and load balancers that terminate TLS connections should re-encrypt the data and route traffic \ +#@ to the HTTPS listener. Unix domain sockets may also be used for integrations with service meshes. \ +#@ Changing the HTTPS port number must be accompanied by matching changes to the service and deployment \ +#@ manifests. Changes to the HTTPS listener must be coordinated with the deployment health checks." +#@schema/desc endpoints_desc +#@schema/examples ("Example matching default settings", '{"https":{"network":"tcp","address":":8443"},"http":"disabled"}') +#@schema/type any=True +#@schema/validation ("a map of keys and values", lambda v: type(v) in ["yamlfragment"]) #@schema/nullable -endpoints: - https: - network: tcp - address: 1.2.3.4:5678 +endpoints: {} -#! deprecated_insecure_accept_external_unencrypted_http_requests_desc = "Optionally override the validation on the endpoints. \ -#! http value which checks that only loopback interfaces are used. \ -#! When deprecated_insecure_accept_external_unencrypted_http_requests is true, the HTTP listener is allowed to bind to any \ -#! interface, including interfaces that are listening for traffic from outside the pod. This value is being introduced \ -#! to ease the transition to the new loopback interface validation for the HTTP port for any users who need more time \ -#! to change their ingress strategy to avoid using plain HTTP into the Supervisor pods. \ -#! This value is immediately deprecated upon its introduction. It will be removed in some future release, at which time \ -#! traffic from outside the pod will need to be sent to the HTTPS listener instead, with no simple workaround available. \ -#! Allowed values are true (boolean), "true" (string), false (boolean), and "false" (string). The default is false. \ -#! Optional." -#@schema/desc https_proxy_desc +#@ deprecated_insecure_accept_external_unencrypted_http_requests_desc = "Optionally override the validation on the endpoints.http \ +#@ value which checks that only loopback interfaces are used. \ +#@ When deprecated_insecure_accept_external_unencrypted_http_requests is true, the HTTP listener is allowed to bind to any \ +#@ interface, including interfaces that are listening for traffic from outside the pod. This value is being introduced \ +#@ to ease the transition to the new loopback interface validation for the HTTP port for any users who need more time \ +#@ to change their ingress strategy to avoid using plain HTTP into the Supervisor pods. \ +#@ This value is immediately deprecated upon its introduction. It will be removed in some future release, at which time \ +#@ traffic from outside the pod will need to be sent to the HTTPS listener instead, with no simple workaround available. \ +#@ Allowed values are true (boolean), 'true' (string), false (boolean), and 'false' (string). The default is false." +#@schema/desc deprecated_insecure_accept_external_unencrypted_http_requests_desc +#@schema/type any=True +#@schema/validation ("a boolean or string version of boolean", lambda v: type(v) in ["string", "boolean"]) +#@schema/validation one_of=["true", "false", True, False] +#@schema/deprecated "This data value will be removed in a future release" deprecated_insecure_accept_external_unencrypted_http_requests: false