mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-01-07 05:57:02 +00:00
235 lines
13 KiB
YAML
235 lines
13 KiB
YAML
#! Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
|
|
#! SPDX-License-Identifier: Apache-2.0
|
|
|
|
#@data/values-schema
|
|
---
|
|
#@schema/title "App name"
|
|
#@schema/desc "Used to help determine the names of various resources and labels."
|
|
#@schema/validation min_len=1
|
|
app_name: pinniped-supervisor
|
|
|
|
#@schema/title "Namespace"
|
|
#@schema/desc "Creates a new namespace statically in yaml with the given name and installs the app into that namespace."
|
|
#@schema/validation min_len=1
|
|
namespace: pinniped-supervisor
|
|
|
|
#@schema/title "Into namespace"
|
|
#@ into_namespace_desc = "If specified, assumes that a namespace of the given name already exists and installs the app into that namespace. \
|
|
#@ If both `namespace` and `into_namespace` are specified, then only `into_namespace` is used."
|
|
#@schema/desc into_namespace_desc
|
|
#@schema/examples ("The name of an existing namespace", "my-preexisting-namespace")
|
|
#@schema/nullable
|
|
#@schema/validation min_len=1
|
|
into_namespace: ""
|
|
|
|
#@schema/title "Custom labels"
|
|
#@ custom_labels_desc = "All resources created statically by yaml at install-time and all resources created dynamically \
|
|
#@ by controllers at runtime will be labelled with `app: $app_name` and also with the labels specified here. The value of \
|
|
#@ `custom_labels` must be a map of string keys to string values. The app can be uninstalled either by: 1.) deleting the \
|
|
#@ static install-time yaml resources including the static namespace, which will cascade and also delete \
|
|
#@ resources that were dynamically created by controllers at runtime, or 2.) deleting all resources by label, which does \
|
|
#@ not assume that there was a static install-time yaml namespace."
|
|
#@schema/desc custom_labels_desc
|
|
#@schema/examples ("Example set of labels", {"myCustomLabelName": "myCustomLabelValue", "otherCustomLabelName": "otherCustomLabelValue"})
|
|
#@ def validate_labels(labels):
|
|
#@ """
|
|
#@ Returns True if labels is an associative data structure string→string,
|
|
#@ and False otherwise.
|
|
#@ """
|
|
#@ for label in labels:
|
|
#@ if type(label) != "string" or type(labels[label]) != "string":
|
|
#@ return False
|
|
#@ end
|
|
#@ end
|
|
#@ return True
|
|
#@ end
|
|
#@schema/type any=True
|
|
#@schema/validation ("a map of keys and values", validate_labels)
|
|
custom_labels: {}
|
|
|
|
#@schema/title "Replicas"
|
|
#@schema/desc "Specify how many replicas of the Pinniped server to run."
|
|
replicas: 2
|
|
|
|
#@schema/title "Image repo"
|
|
#@schema/desc "The repository for the Concierge container image."
|
|
#@schema/validation min_len=1
|
|
image_repo: projects.registry.vmware.com/pinniped/pinniped-server
|
|
|
|
#@schema/title "Image digest"
|
|
#@schema/desc "The image digest for the Concierge container image. If both image_digest or an image_tag are given, only image_digest will be used."
|
|
#@schema/examples ("Digest", "sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8")
|
|
#@schema/nullable
|
|
#@schema/validation min_len=1, when=lambda _, ctx: ctx.parent["image_tag"] == None
|
|
image_digest: ""
|
|
|
|
#@schema/title "Image tag"
|
|
#@schema/desc "The image tag for the Concierge container image. If both image_digest or an image_tag are given, only image_digest will be used."
|
|
#@schema/examples ("Tag", "v0.25.0")
|
|
#@schema/validation min_len=1, when=lambda _, ctx: ctx.parent["image_digest"] == None
|
|
image_tag: latest
|
|
|
|
#@schema/title "Image pull dockerconfigjson"
|
|
#@ image_pull_dockerconfigjson_desc = "A base64 encoded secret to be used when pulling the `image_repo` container image. \
|
|
#@ Can be used when the image_repo is a private registry. Typically, the value would be the output of: \
|
|
#@ kubectl create secret docker-registry x --docker-server=https://example.io --docker-username='USERNAME' --docker-password='PASSWORD' --dry-run=client -o json | jq -r '.data[\".dockerconfigjson\"]'"
|
|
#@schema/desc image_pull_dockerconfigjson_desc
|
|
#@ example_desc = 'base64 encoding of: {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}'
|
|
#@ example_value = "eyJhdXRocyI6eyJodHRwczovL2V4YW1wbGUuaW8iOnsidXNlcm5hbWUiOiJVU0VSTkFNRSIsInBhc3N3b3JkIjoiUEFTU1dPUkQiLCJhdXRoIjoiVlZORlVrNUJUVVU2VUVGVFUxZFBVa1E9In19fQ=="
|
|
#@schema/examples (example_desc, example_value)
|
|
#@schema/nullable
|
|
#@schema/validation min_len=1
|
|
image_pull_dockerconfigjson: ""
|
|
|
|
#@schema/title "Deprecated service HTTP nodeport port"
|
|
#@schema/desc "When specified, creates a NodePort Service with this `port` value, with port 8080 as its `targetPort`"
|
|
#@schema/examples ("Specify port","31234")
|
|
#@schema/nullable
|
|
#@schema/deprecated "This data value will be removed in a future release"
|
|
deprecated_service_http_nodeport_port: ""
|
|
|
|
#@schema/title "Deprecated service http nodeport nodeport"
|
|
#@schema/desc "The `nodePort` value of the NodePort Service, optional when `deprecated_service_http_nodeport_port` is specified"
|
|
#@schema/examples ("Specify port","31234")
|
|
#@schema/nullable
|
|
#@schema/deprecated "This data value will be removed in a future release"
|
|
deprecated_service_http_nodeport_nodeport: ""
|
|
|
|
#@schema/title "Deprecated service http loadbalancer port"
|
|
#@schema/desc "When specified, creates a LoadBalancer Service with this `port` value, with port 8080 as its `targetPort`"
|
|
#@schema/examples ("Specify port","8443")
|
|
#@schema/nullable
|
|
#@schema/deprecated "This data value will be removed in a future release"
|
|
deprecated_service_http_loadbalancer_port: ""
|
|
|
|
#@schema/title "Deprecated service http clusterip port"
|
|
#@schema/desc "Creates a ClusterIP Service with this `port` value, with port 8080 as its `targetPort`"
|
|
#@schema/examples ("Specify port","8443")
|
|
#@schema/nullable
|
|
#@schema/deprecated "This data value will be removed in a future release"
|
|
deprecated_service_http_clusterip_port: ""
|
|
|
|
#@schema/title "Service https nodeport port"
|
|
#@schema/desc "When specified, creates a NodePort Service with this `port` value, with port 8443 as its `targetPort`"
|
|
#@schema/examples ("Specify port","31243")
|
|
#@schema/nullable
|
|
service_https_nodeport_port: ""
|
|
|
|
#@schema/title "Service https nodeport nodeport"
|
|
#@schema/desc "The `nodePort` value of the NodePort Service, optional when `service_https_nodeport_port` is specified"
|
|
#@schema/examples ("Specify port","31243")
|
|
#@schema/nullable
|
|
service_https_nodeport_nodeport: ""
|
|
|
|
#@schema/title "Service https loadbalancer port"
|
|
#@schema/desc "When specified, creates a LoadBalancer Service with this `port` value, with port 8443 as its `targetPort`"
|
|
#@schema/examples ("Specify port","8443")
|
|
#@schema/nullable
|
|
service_https_loadbalancer_port: ""
|
|
|
|
#@schema/title "Service https clusterip port"
|
|
#@schema/desc "When specified, creates a ClusterIP Service with this `port` value, with port 8443 as its `targetPort`"
|
|
#@schema/examples ("Specify port","8443")
|
|
#@schema/nullable
|
|
service_https_clusterip_port: ""
|
|
|
|
#@schema/title "Service loadbalancer ip"
|
|
#@schema/desc "The `loadBalancerIP` value of the LoadBalancer Service. Ignored unless service_https_loadbalancer_port is provided."
|
|
#@schema/examples ("Example IP address","1.2.3.4")
|
|
#@schema/nullable
|
|
service_loadbalancer_ip: ""
|
|
|
|
#@schema/title "Log level"
|
|
#@ log_level_desc = "Specify the verbosity of logging: info (\"nice to know\" information), debug (developer information), trace (timing information), \
|
|
#@ or all (kitchen sink). Do not use trace or all on production systems, as credentials may get logged. \
|
|
#@ When this value is left unset, only warnings and errors are printed. There is no way to suppress warning and error logs."
|
|
#@schema/desc log_level_desc
|
|
#@schema/examples ("Developer logging information","debug")
|
|
#@schema/nullable
|
|
#@schema/validation one_of=["info", "debug", "trace", "all"]
|
|
log_level: ""
|
|
|
|
#@schema/title "Log format"
|
|
#@ deprecated_log_format_desc = "Specify the format of logging: json (for machine parsable logs) and text (for legacy klog formatted logs). \
|
|
#@ By default, when this value is left unset, logs are formatted in json. \
|
|
#@ This configuration is deprecated and will be removed in a future release at which point logs will always be formatted as json."
|
|
#@schema/desc deprecated_log_format_desc
|
|
#@schema/examples ("Set logs to JSON format","json")
|
|
#@schema/nullable
|
|
#@schema/validation one_of=["json", "text"]
|
|
#@schema/deprecated "This configuration is deprecated and will be removed in a future release at which point logs will always be formatted as json."
|
|
deprecated_log_format: ""
|
|
|
|
#@schema/title "Run as user"
|
|
#@schema/desc "The user ID that will own the process."
|
|
#! See the Dockerfile for the reasoning behind this default value.
|
|
run_as_user: 65532
|
|
|
|
#@schema/title "Run as group"
|
|
#@schema/desc "The group ID that will own the process."
|
|
#! See the Dockerfile for the reasoning behind this default value.
|
|
run_as_group: 65532
|
|
|
|
#@schema/title "API group suffix"
|
|
#@ api_group_suffix_desc = "Specify the API group suffix for all Pinniped API groups. By default, this is set to \
|
|
#@ pinniped.dev, so Pinniped API groups will look like foo.pinniped.dev, \
|
|
#@ authentication.concierge.pinniped.dev, etc. As an example, if this is set to tuna.io, then \
|
|
#@ Pinniped API groups will look like foo.tuna.io. authentication.concierge.tuna.io, etc."
|
|
#@schema/desc api_group_suffix_desc
|
|
#@schema/validation min_len=1
|
|
api_group_suffix: pinniped.dev
|
|
|
|
#@schema/title "HTTPS proxy"
|
|
#@ https_proxy_desc = "Set the standard golang HTTPS_PROXY and NO_PROXY environment variables on the Supervisor containers. \
|
|
#@ These will be used when the Supervisor makes backend-to-backend calls to upstream identity providers using HTTPS, \
|
|
#@ e.g. when the Supervisor fetches discovery documents, JWKS keys, and tokens from an upstream OIDC Provider. \
|
|
#@ The Supervisor never makes insecure HTTP calls, so there is no reason to set HTTP_PROXY. \
|
|
#@ Optional."
|
|
#@schema/desc https_proxy_desc
|
|
#@schema/examples ("Provide a proxy endpoint","http://proxy.example.com")
|
|
#@schema/nullable
|
|
https_proxy: ""
|
|
|
|
#@schema/title "No proxy"
|
|
#@schema/desc "Endpoints that should not be proxied. Defaults to some sensible known values on public cloud providers."
|
|
#@schema/validation min_len=1
|
|
no_proxy: "$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost,.svc,.cluster.local" #! do not proxy Kubernetes endpoints
|
|
|
|
#@schema/title "Endpoints"
|
|
#@ endpoints_desc = "Control the HTTP and HTTPS listeners of the Supervisor. The current defaults are: \
|
|
#@ {\"https\":{\"network\":\"tcp\",\"address\":\":8443\"},\"http\":\"disabled\"}. \
|
|
#@ These defaults mean: 1.) For HTTPS listening, bind to all interfaces using TCP on port 8443 and \
|
|
#@ 2.) Disable HTTP listening by default. \
|
|
#@ The schema of this config is as follows: \
|
|
#@ {'https':{'network':'tcp | unix | disabled','address':'host:port when network=tcp or /pinniped_socket/socketfile.sock when network=unix'},'http':{'network':'tcp | unix | disabled','address':'same as https, except that when network=tcp then the address is only allowed to bind to loopback interfaces'}} \
|
|
#@ The HTTP listener can only be bound to loopback interfaces. This allows the listener to accept \
|
|
#@ traffic from within the pod, e.g. from a service mesh sidecar. The HTTP listener should not be \
|
|
#@ used to accept traffic from outside the pod, since that would mean that the network traffic could be \
|
|
#@ transmitted unencrypted. The HTTPS listener should be used instead to accept traffic from outside the pod. \
|
|
#@ Ingresses and load balancers that terminate TLS connections should re-encrypt the data and route traffic \
|
|
#@ to the HTTPS listener. Unix domain sockets may also be used for integrations with service meshes. \
|
|
#@ Changing the HTTPS port number must be accompanied by matching changes to the service and deployment \
|
|
#@ manifests. Changes to the HTTPS listener must be coordinated with the deployment health checks."
|
|
#@schema/desc endpoints_desc
|
|
#@schema/examples ("Example matching default settings", '{"https":{"network":"tcp","address":":8443"},"http":"disabled"}')
|
|
#@schema/type any=True
|
|
#@schema/validation ("a map of keys and values", lambda v: type(v) in ["yamlfragment"])
|
|
#@schema/nullable
|
|
endpoints: {}
|
|
|
|
#@ deprecated_insecure_accept_external_unencrypted_http_requests_desc = "Optionally override the validation on the endpoints.http \
|
|
#@ value which checks that only loopback interfaces are used. \
|
|
#@ When deprecated_insecure_accept_external_unencrypted_http_requests is true, the HTTP listener is allowed to bind to any \
|
|
#@ interface, including interfaces that are listening for traffic from outside the pod. This value is being introduced \
|
|
#@ to ease the transition to the new loopback interface validation for the HTTP port for any users who need more time \
|
|
#@ to change their ingress strategy to avoid using plain HTTP into the Supervisor pods. \
|
|
#@ This value is immediately deprecated upon its introduction. It will be removed in some future release, at which time \
|
|
#@ traffic from outside the pod will need to be sent to the HTTPS listener instead, with no simple workaround available. \
|
|
#@ Allowed values are true (boolean), 'true' (string), false (boolean), and 'false' (string). The default is false."
|
|
#@schema/desc deprecated_insecure_accept_external_unencrypted_http_requests_desc
|
|
#@schema/type any=True
|
|
#@schema/validation ("a boolean or string version of boolean", lambda v: type(v) in ["string", "boolean"])
|
|
#@schema/validation one_of=["true", "false", True, False]
|
|
#@schema/deprecated "This data value will be removed in a future release"
|
|
deprecated_insecure_accept_external_unencrypted_http_requests: false
|