mirror of
https://github.com/versity/versitygw.git
synced 2026-10-22 06:12:39 +00:00
202 lines
6.9 KiB
Plaintext
202 lines
6.9 KiB
Plaintext
##########################################
|
|
# VersityGW standalone IAM configuration #
|
|
##########################################
|
|
|
|
# Copy this file to /etc/versitygw.d/ and rename it to a unique service name.
|
|
# For example, /etc/versitygw.d/iam.conf is started with:
|
|
# systemctl start versitygw@iam
|
|
# systemctl enable versitygw@iam
|
|
|
|
##############################
|
|
# VersityGW Required Options #
|
|
##############################
|
|
|
|
# Run the standalone IAM API server.
|
|
VGW_BACKEND=iam
|
|
|
|
# The IAM API needs one storage backend. Set VGW_IAM_DIR for local file-backed
|
|
# storage, or configure VGW_IAM_VAULT_ENDPOINT_URL and its authentication
|
|
# options below for HashiCorp Vault storage.
|
|
VGW_IAM_DIR=/var/lib/versitygw/iam
|
|
|
|
# The access and secret options specify the root account credentials. The root
|
|
# account has full authorization to IAM API requests after authentication.
|
|
ROOT_ACCESS_KEY_ID=
|
|
ROOT_SECRET_ACCESS_KEY=
|
|
|
|
############################
|
|
# VersityGW Global Options #
|
|
############################
|
|
|
|
# The IAM API listener address. It accepts the same comma-separated TCP or
|
|
# UNIX-socket addresses as the gateway, for example :7076 or /run/vgw/iam.sock.
|
|
#VGW_PORT=:7076
|
|
|
|
# TLS certificate and private key for the IAM API listener.
|
|
#VGW_CERT=
|
|
#VGW_KEY=
|
|
|
|
# Maximum concurrent connections and in-flight requests.
|
|
#VGW_MAX_CONNECTIONS=250000
|
|
#VGW_MAX_REQUESTS=100000
|
|
|
|
# Region returned by IAM responses. Defaults to us-east-1.
|
|
#VGW_REGION=us-east-1
|
|
|
|
# Set the debug logger verbosity to silent, debug, or unsafe. The unsafe level
|
|
# writes credentials and tokens in the clear, so use it only for local
|
|
# troubleshooting on a trusted machine.
|
|
#VGW_LOG_LEVEL=silent
|
|
|
|
# VGW_DEBUG is a deprecated alias for VGW_LOG_LEVEL=debug.
|
|
#VGW_DEBUG=false
|
|
|
|
# Enable the pprof HTTP server on the specified address, for example
|
|
# localhost:6060.
|
|
#VGW_PPROF=
|
|
|
|
# Silence request logging to stdout.
|
|
#VGW_QUIET=false
|
|
|
|
# Enable HTTP keep-alive connections.
|
|
#VGW_KEEP_ALIVE=false
|
|
|
|
# Configure an unauthenticated GET health endpoint, for example /health.
|
|
#VGW_HEALTH=
|
|
|
|
# File-mode permissions for file-backed UNIX sockets, as an octal integer.
|
|
#VGW_SOCKET_PERM=
|
|
|
|
# Configure this when a browser-based WebUI on another origin accesses IAM.
|
|
#VGW_CORS_ALLOW_ORIGIN=
|
|
|
|
# Enable the WebUI on one or more comma-separated listener addresses.
|
|
#VGW_WEBUI_PORT=
|
|
|
|
# Use separate TLS credentials for the WebUI. When unset, the WebUI uses
|
|
# VGW_CERT and VGW_KEY.
|
|
#VGW_WEBUI_CERT=
|
|
#VGW_WEBUI_KEY=
|
|
|
|
# Disable WebUI TLS even when TLS is configured for the IAM API.
|
|
#VGW_WEBUI_NO_TLS=false
|
|
|
|
# Mount the WebUI under a single path segment, for example /ui.
|
|
#VGW_WEBUI_PATH_PREFIX=
|
|
|
|
# Override the S3 gateway URLs offered by the WebUI. Specify one or more
|
|
# comma-separated URLs, for example http://localhost:7070 or
|
|
# https://s3.example.com.
|
|
#VGW_WEBUI_GATEWAYS=
|
|
|
|
# Override the admin gateway URLs offered by the WebUI. Specify one or more
|
|
# comma-separated URLs, for example https://admin.example.com.
|
|
#VGW_WEBUI_ADMIN_GATEWAYS=
|
|
|
|
# Override the public IAM API URLs used by the WebUI, for example when this
|
|
# service is reached through an ingress hostname that differs from VGW_PORT.
|
|
#VGW_WEBUI_IAM_GATEWAYS=
|
|
|
|
#################
|
|
# Vault Storage #
|
|
#################
|
|
|
|
# Use Vault instead of VGW_IAM_DIR by setting the Vault endpoint and suitable
|
|
# credentials.
|
|
|
|
# Vault server URL for IAM storage.
|
|
#VGW_IAM_VAULT_ENDPOINT_URL=
|
|
|
|
# Fallback Vault namespace for both AppRole authentication and KV v2 storage.
|
|
# The more-specific authentication and storage namespace options override it.
|
|
#VGW_IAM_VAULT_NAMESPACE=
|
|
|
|
# KV v2 path prefix used to store IAM users. Defaults to iam.
|
|
#VGW_IAM_VAULT_SECRET_STORAGE_PATH=iam
|
|
|
|
# Vault namespace for the KV v2 IAM storage path. Overrides VGW_IAM_VAULT_NAMESPACE.
|
|
#VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE=
|
|
|
|
# Vault authentication method mount path. Defaults to approle.
|
|
#VGW_IAM_VAULT_AUTH_METHOD=approle
|
|
|
|
# Vault namespace used for AppRole login. Overrides VGW_IAM_VAULT_NAMESPACE.
|
|
#VGW_IAM_VAULT_AUTH_NAMESPACE=
|
|
|
|
# Vault KV v2 secrets engine mount path. Defaults to kv-v2.
|
|
#VGW_IAM_VAULT_MOUNT_PATH=kv-v2
|
|
|
|
# Vault root token for authentication. Do not set this with the AppRole ID or
|
|
# secret options below.
|
|
#VGW_IAM_VAULT_ROOT_TOKEN=
|
|
|
|
# Vault AppRole role ID for authentication. Set with VGW_IAM_VAULT_ROLE_SECRET
|
|
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
|
|
#VGW_IAM_VAULT_ROLE_ID=
|
|
|
|
# Vault AppRole secret ID for authentication. Set with VGW_IAM_VAULT_ROLE_ID
|
|
# instead of VGW_IAM_VAULT_ROOT_TOKEN.
|
|
#VGW_IAM_VAULT_ROLE_SECRET=
|
|
|
|
# PEM-encoded Vault server TLS certificate used to verify the Vault server.
|
|
#VGW_IAM_VAULT_SERVER_CERT=
|
|
|
|
# PEM-encoded client TLS certificate presented to Vault.
|
|
#VGW_IAM_VAULT_CLIENT_CERT=
|
|
|
|
# PEM-encoded private key for VGW_IAM_VAULT_CLIENT_CERT.
|
|
#VGW_IAM_VAULT_CLIENT_CERT_KEY=
|
|
|
|
############################
|
|
# Private IAM API Listener #
|
|
############################
|
|
|
|
# This private endpoint serves the VersityGW protocol used by S3 gateway
|
|
# instances to communicate directly with the standalone IAM service.
|
|
|
|
# Private endpoint listen addresses. Set one or more comma-separated UNIX
|
|
# socket paths, or TCP addresses such as :7077 or 127.0.0.1:7077. TCP listeners
|
|
# require the three mTLS settings below; UNIX sockets do not.
|
|
#VGW_IAM_PRIVATE_PORTS=
|
|
|
|
# TLS server certificate for TCP private endpoint listeners.
|
|
#VGW_IAM_PRIVATE_CERT=
|
|
|
|
# TLS private key for VGW_IAM_PRIVATE_CERT.
|
|
#VGW_IAM_PRIVATE_CERT_KEY=
|
|
|
|
# PEM-encoded CA bundle used to verify the S3 gateway's client certificate on
|
|
# TCP private endpoint listeners.
|
|
#VGW_IAM_PRIVATE_CLIENT_CA=
|
|
|
|
# Octal permissions for file-backed UNIX private sockets, for example 0660.
|
|
# This does not affect TCP or Linux abstract-namespace sockets.
|
|
#VGW_IAM_PRIVATE_SOCKET_PERM=
|
|
|
|
#################
|
|
# OIDC Settings #
|
|
#################
|
|
|
|
# Reject OIDC provider creation without an explicit certificate thumbprint.
|
|
#VGW_IAM_DISABLE_OIDC_THUMBPRINT_AUTOFETCH=false
|
|
|
|
# Allow OIDC provider URLs that resolve to loopback/private/link-local
|
|
# addresses and that carry an explicit port; needed for an identity provider
|
|
# that only exists on an internal network, and also re-permits cloud
|
|
# metadata endpoints as fetch targets.
|
|
#VGW_IAM_OIDC_ALLOW_PRIVATE_ENDPOINTS=false
|
|
|
|
# Allow plaintext http OIDC provider URLs and skip TLS certificate
|
|
# verification (thumbprint pinning included) for https ones; only for an
|
|
# identity provider reached over an already-trusted path, such as a
|
|
# loopback-bound sidecar.
|
|
#VGW_IAM_OIDC_ALLOW_INSECURE_TRANSPORT=false
|
|
|
|
# Fetch one OIDC provider's discovery document from somewhere other than the
|
|
# provider URL itself, as '<provider url>=<discovery url>'. Specify one or
|
|
# more comma-separated entries. The discovery URL is fetched exactly as
|
|
# given, so include the '/.well-known/openid-configuration' path, and it may
|
|
# be a private in-cluster address without VGW_IAM_OIDC_ALLOW_PRIVATE_ENDPOINTS.
|
|
# Tokens are still matched against the provider URL, and keys are still read
|
|
# from the jwks_uri the fetched document publishes.
|
|
#VGW_IAM_OIDC_DISCOVERY_URLS= |