1316 lines
52 KiB
YAML
1316 lines
52 KiB
YAML
################################################################
|
|
# Values that must always be provided by the user.
|
|
################################################################
|
|
|
|
# roles(string) -- is a comma-separated list of services which will be enabled
|
|
# when running the `teleport-kube-agent` chart.
|
|
#
|
|
# | Services | Value for `roles` | Mandatory additional settings for this role |
|
|
# |------------------------------|-------------------|---------------------------------------------|
|
|
# | Teleport Kubernetes service | `kube` | [`kubeClusterName`](#kubeclustername) |
|
|
# | Teleport Application service | `app` | [`apps`](#apps) or [`appResources`](#appresources) |
|
|
# | Teleport Database service | `db` | [`databases`](#databases) or [`databaseResources`](#databaseresources) |
|
|
# | Teleport Discovery service | `discovery` | [`kubeClusterName`](#kubeclustername) |
|
|
# | Teleport Jamf service | `jamf` | [`jamfApiEndpoint`](#jamfapiendpoint), [`jamfClientId`](#jamfclientid) |
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# roles: kube,app,discovery
|
|
# ```
|
|
roles: "kube"
|
|
|
|
# proxyAddr(string) -- provides the public-facing Teleport Proxy Service endpoint
|
|
# which should be used to join the cluster. This is the same URL used to access
|
|
# the web UI of your Teleport cluster. The port used is usually either 3080 or 443.
|
|
#
|
|
# Here are a few examples:
|
|
#
|
|
# | Deployment method | Example `proxy_service.public_addr` |
|
|
# |-------------------------------|-------------------------------------|
|
|
# | On-prem Teleport cluster | `teleport.example.com:3080` |
|
|
# | Teleport Cloud cluster | `example.teleport.sh:443` |
|
|
# | `teleport-cluster` Helm chart | `teleport.example.com:443` |
|
|
proxyAddr: ""
|
|
|
|
# enterprise(bool) -- controls if the `teleport-kube-agent` chart should deploy
|
|
# the OSS version or the enterprise version of the container image.
|
|
# This must be set to `true` when connecting to Teleport Cloud or self-hosted
|
|
# Teleport Enterprise clusters to allow the agent to leverage enterprise features.
|
|
enterprise: false
|
|
|
|
# authToken(string) -- provides a Teleport join token which will be used to join
|
|
# the Teleport instance to a Teleport cluster. `authToken` only supports the `token`
|
|
# join method.
|
|
#
|
|
# For other methods such as `kubernetes`, `iam` or `gcp`, the value
|
|
# [`joinParams`](#joinParams) should be used as it supports more methods to
|
|
# join the Teleport cluster. `joinParams` takes precedence if both `authToken`
|
|
# and `joinParams` are set.
|
|
#
|
|
# A token must be specified for the agent to join the Teleport cluster, either
|
|
# via `authToken`, [`joinParams`](#joinparams), or
|
|
# [an existing Kubernetes Secret](#joinTokenSecret).
|
|
#
|
|
# The token used must at least grant the required system roles. For example, if
|
|
# the chart [`roles`](#roles) is `kube,app`, the token should allow the system
|
|
# roles `App` and `Kube`.
|
|
authToken: ""
|
|
|
|
# joinParams -- controls how the Teleport agent joins the Teleport cluster.
|
|
# These sub-values must be configured for the agent to connect to a cluster.
|
|
#
|
|
# This value serves the same purpose as [`authToken`](#authToken) but supports
|
|
# all join methods. When set, it takes precedence over `authToken`.
|
|
# Its usage should be preferred.
|
|
joinParams:
|
|
# joinParams.method(string) -- controls which join method will be used by the
|
|
# instance to join the Teleport cluster.
|
|
#
|
|
# See [the join method reference](../../join-methods.mdx) for the list of possible
|
|
# values, the implications of each join method, and guides to set up each method.
|
|
#
|
|
# Common join-methods for the `teleport-kube-agent` are:
|
|
# - `token`: the most basic one, with regular ephemeral secret tokens
|
|
# - `kubernetes`: either the `in-cluster` variant (if the agent runs in the
|
|
# same Kubernetes cluster as the `teleport-cluster` chart) or the `JWKS`
|
|
# variant (works in every Kubernetes cluster, regardless of the Teleport Auth
|
|
# Service location).
|
|
method: "token"
|
|
|
|
# joinParams.tokenName(string) -- controls which token is used by the agent to
|
|
# join the Teleport cluster.
|
|
#
|
|
# When `joinParams.method` is [a delegated join method](../../join-methods.mdx#delegated-join-methods),
|
|
# the value is not sensitive.
|
|
#
|
|
# When `joinParams.method` is `token` (by default), `joinParams.tokenName`
|
|
# contains the secret token itself. In this case, the value is sensitive and
|
|
# is automatically stored in a Kubernetes Secret instead of being directly
|
|
# included in the agent's configuration.
|
|
#
|
|
# If method is `token`, `joinParams.tokenName` can be empty if the token
|
|
# is provided through an existing Kubernetes Secret, see
|
|
# [`joinTokenSecret`](#joinTokenSecret) for more details and instructions.
|
|
tokenName: ""
|
|
|
|
################################################################
|
|
# Values that must be provided if Kubernetes access is enabled.
|
|
################################################################
|
|
|
|
# kubeClusterName(string) -- sets the name used for the Kubernetes cluster proxied by
|
|
# the Teleport agent. This name will be shown to Teleport users connecting to
|
|
# the cluster.
|
|
#
|
|
# This setting is required if the chart `roles` contains `kube`.
|
|
kubeClusterName: ""
|
|
|
|
################################################################
|
|
# Values that must be provided if Application access is enabled.
|
|
################################################################
|
|
|
|
# apps(list) -- is a static list of applications that should be proxied by
|
|
# the agent. See [the Teleport Application access documentation](../../../enroll-resources/application-access/introduction.mdx)
|
|
# for more details.
|
|
#
|
|
# Proxied applications can be defined statically (through this value) or dynamically
|
|
# (through the [`appResources`](#appResources) value).
|
|
# One of `apps` and `appResources` is required if the chart `roles` contains `app`.
|
|
#
|
|
# You can specify multiple apps by adding elements to the list.
|
|
# For example:
|
|
#
|
|
# ```yaml
|
|
# apps:
|
|
# - name: grafana
|
|
# uri: http://localhost:3000
|
|
# labels:
|
|
# purpose: monitoring
|
|
# - name: jenkins
|
|
# uri: http://jenkins:8080
|
|
# labels:
|
|
# purpose: ci
|
|
# ```
|
|
#
|
|
# <Admonition type="tip" title="Supported values">
|
|
# You can see a list of all the supported values that can be used in a Teleport
|
|
# Application Service configuration in the [Application Service Configuration
|
|
# Reference](../../../enroll-resources/application-access/reference.mdx#configuration).
|
|
# </Admonition>
|
|
apps: []
|
|
|
|
# appResources(list) -- is a set of labels the agent will monitor. Any application
|
|
# matching those labels will be proxied by the agent. See [the Teleport
|
|
# Application access documentation](../../../enroll-resources/application-access/introduction.mdx)
|
|
# for more details.
|
|
#
|
|
# Proxied applications can be defined statically (through [`apps`](#apps)) or
|
|
# dynamically (through this value).
|
|
# One of `apps` and `appResources` is required if the chart `roles` contains `app`.
|
|
#
|
|
# You can specify multiple selectors by including additional list elements.
|
|
# For example:
|
|
# ```yaml
|
|
# appResources:
|
|
# - labels:
|
|
# "env": "prod"
|
|
# - labels:
|
|
# "env": "test"
|
|
# ```
|
|
#
|
|
# <Admonition type="tip" title="Example">
|
|
# Once `appResources` is set, you can dynamically register application with
|
|
# `tsh` by following [the Dynamic App Registration guide](../../../enroll-resources/application-access/guides/dynamic-registration.mdx).
|
|
# </Admonition>
|
|
appResources: []
|
|
|
|
# clusterDomain(string) -- sets the domain name used by the Kubernetes cluster. This value is used to build the
|
|
# FQDN application URIs. For example, if the cluster domain is `anything.local`, the agent will proxy the application
|
|
# `myapp` running in the `default` namespace at `http://myapp.default.svc.anything.local`. You must manually set this value
|
|
# to match your cluster domain if it is different from the default value `cluster.local`.
|
|
clusterDomain: "cluster.local"
|
|
|
|
################################################################
|
|
# Values that must be provided if Database access is enabled.
|
|
################################################################
|
|
|
|
# At least one of the `databases`, `awsDatabases`, `azureDatabases`, or
|
|
# `databaseResources` values must be set when database access is enabled.
|
|
|
|
# awsDatabases(list) -- configures AWS database auto-discovery.
|
|
#
|
|
# <Admonition type="note" title="IAM roles">
|
|
# For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../../enroll-resources/database-access/enroll-aws-databases/rds.mdx#step-36-create-iam-policies-for-teleport).
|
|
# After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions:
|
|
#
|
|
# ```yaml
|
|
# annotations:
|
|
# serviceAccount:
|
|
# eks.amazonaws.com/role-arn: arn:aws:iam::1234567890:role/my-rds-autodiscovery-role
|
|
# ```
|
|
# </Admonition>
|
|
#
|
|
# You can specify multiple database filters by adding elements to the list.
|
|
#
|
|
# - `types` is a list containing the types of AWS databases that should be discovered.
|
|
# - `regions` is a list of AWS regions which should be scanned for databases.
|
|
# - `tags` can be used to set AWS tags that must be matched for databases to be discovered.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# roles: db
|
|
# awsDatabases:
|
|
# - types: ["rds"]
|
|
# regions: ["us-east-1", "us-west-2"]
|
|
# tags:
|
|
# "environment": "production"
|
|
# - types: ["rds"]
|
|
# regions: ["us-east-1"]
|
|
# tags:
|
|
# "environment": "dev"
|
|
# - types: ["rds"]
|
|
# regions: ["eu-west-1"]
|
|
# tags:
|
|
# "*": "*"
|
|
# annotations:
|
|
# serviceAccount:
|
|
# eks.amazonaws.com/role-arn: arn:aws:iam::1234567890:role/my-rds-autodiscovery-role
|
|
# ```
|
|
awsDatabases: []
|
|
|
|
# azureDatabases(list) -- configures Azure database auto-discovery.
|
|
# <Admonition type="note" title="Azure IAM">
|
|
# For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../../enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx#step-35-configure-iam-permissions-for-teleport).
|
|
#
|
|
# After configuring a service principal with appropriate IAM permissions, you must pass credentials to the pods.
|
|
# The easiest way is to use an Azure client secret.
|
|
#
|
|
# First, create in the chart installation namespace a Kubernetes `Secret` containing the azure client secret:
|
|
# ```code
|
|
# $ kubectl create secret generic teleport-azure-client-secret --from-literal=client_secret=<your-azure-client-secret>
|
|
# secret/teleport-azure-client-secret created
|
|
# ```
|
|
#
|
|
# Then, use the [`extraEnv`](#extraenv) value to set the pods environment variables:
|
|
#
|
|
# ```yaml
|
|
# extraEnv:
|
|
# - name: AZURE_CLIENT_SECRET
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: teleport-azure-client-secret
|
|
# key: client_secret
|
|
# optional: false
|
|
# - name: AZURE_TENANT_ID
|
|
# value: "11111111-2222-3333-4444-555555555555"
|
|
# - name: AZURE_CLIENT_ID
|
|
# value: "11111111-2222-3333-4444-555555555555"
|
|
# ```
|
|
# </Admonition>
|
|
#
|
|
# You can specify multiple database filters by adding elements to the list.
|
|
#
|
|
# Required fields for each filter:
|
|
# - `types` is a list containing the types of Azure databases that should be discovered.
|
|
# - `tags` can be used to set Azure resource tags that must be matched for databases to be discovered.
|
|
#
|
|
# Optional fields for each filter:
|
|
# - `regions` is a list of Azure regions which should be scanned for databases.
|
|
# - `subscriptions` can be used to discover databases within matching Azure subscriptions.
|
|
# - `resource_groups` can be used to discover databases within matching Azure resource groups.
|
|
#
|
|
# The default for each of these optional settings is `*`, which will auto-discover in all
|
|
# subscriptions, regions, or resource groups accessible by the Teleport service
|
|
# principal in Azure.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# roles: db
|
|
# azureDatabases:
|
|
# - types: ["mysql", "postgres"]
|
|
# tags:
|
|
# "*": "*"
|
|
# - types: ["mysql"]
|
|
# tags:
|
|
# "env": ["dev", "staging"]
|
|
# "origin": "alice"
|
|
# regions: ["eastus", "centralus"]
|
|
# subscriptions: ["subID1", "subID2"]
|
|
# resource_groups: ["group1", "group2"]
|
|
# extraEnv:
|
|
# - name: AZURE_CLIENT_SECRET
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: teleport-azure-client-secret
|
|
# key: client_secret
|
|
# optional: false
|
|
# - name: AZURE_TENANT_ID
|
|
# value: "11111111-2222-3333-4444-555555555555"
|
|
# - name: AZURE_CLIENT_ID
|
|
# value: "11111111-2222-3333-4444-555555555555"
|
|
# ```
|
|
azureDatabases: []
|
|
|
|
# databases(list) -- is a static list of databases that should be proxied by
|
|
# the agent. See [the Teleport Database access documentation](../../../enroll-resources/database-access/database-access.mdx)
|
|
# for more details.
|
|
#
|
|
# Proxied applications can be defined statically (through this value) or dynamically
|
|
# (through the [`databaseResources`](#databaseResources) value).
|
|
#
|
|
# You can specify multiple databases by adding additional list elements.
|
|
#
|
|
# `values.yaml` example:
|
|
#
|
|
# ```yaml
|
|
# databases:
|
|
# - name: aurora-postgres
|
|
# uri: postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432
|
|
# protocol: postgres
|
|
# aws:
|
|
# region: us-east-1
|
|
# static_labels:
|
|
# env: staging
|
|
# - name: mysql
|
|
# uri: mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306
|
|
# protocol: mysql
|
|
# aws:
|
|
# region: us-east-1
|
|
# static_labels:
|
|
# env: staging
|
|
# ```
|
|
#
|
|
# <Admonition type="tip" title="Supported values">
|
|
# You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../../enroll-resources/database-access/reference/configuration.mdx).
|
|
# </Admonition>
|
|
#
|
|
# <Admonition type="tip" title="Trusting Database CA">
|
|
# Database CAs can be trusted on a per-database basis.
|
|
# You must create a secret containing the database CA certificate in the same namespace as Teleport using a command like:
|
|
#
|
|
# ```code
|
|
# $ kubectl create secret generic my-postgres-ca --from-file=ca.pem=/path/to/database-ca.pem
|
|
# ```
|
|
#
|
|
# Then, deploy the Helm chart with the following values:
|
|
#
|
|
# ```yaml
|
|
# databases:
|
|
# - name: my-postgres
|
|
# uri: postgres.example.com:5432
|
|
# protocol: postgres
|
|
# tls:
|
|
# ca_cert_file: "/etc/teleport-tls-db/my-postgres/ca.pem"
|
|
# extraVolumes:
|
|
# - name: my-postgres-ca
|
|
# secret:
|
|
# secretName: my-postgres-ca
|
|
# extraVolumeMounts:
|
|
# - name: my-postgres-ca
|
|
# mountPath: /etc/teleport-tls-db/my-postgres
|
|
# readOnly: true
|
|
# ```
|
|
# </Admonition>
|
|
databases: []
|
|
|
|
# databaseResources(list) -- is a set of labels the agent will monitor.
|
|
# Any database matching those labels will be proxied by the agent. See [the Teleport
|
|
# Database access
|
|
# documentation](../../../enroll-resources/database-access/database-access.mdx)
|
|
# for more details.
|
|
#
|
|
# Proxied databases can be defined statically (through [`databases`](#databases)) or
|
|
# dynamically (through this value).
|
|
#
|
|
# You can specify multiple selectors by including additional list elements.
|
|
# For example:
|
|
# ```yaml
|
|
# databaseResources:
|
|
# - labels:
|
|
# "env": "prod"
|
|
# "engine": "postgres"
|
|
# - labels:
|
|
# "env": "test"
|
|
# "engine": "mysql"
|
|
# ```
|
|
#
|
|
# <Admonition type="tip" title="Example">
|
|
# Once `databaseResources` is set, you can dynamically register database with
|
|
# `tsh` by following [this guide](../../../enroll-resources/database-access/guides/dynamic-registration.mdx).
|
|
# </Admonition>
|
|
databaseResources: []
|
|
|
|
################################################################
|
|
# Values that must be provided for Kubernetes Discovery
|
|
################################################################
|
|
|
|
# kubernetesDiscovery(list) -- controls the Discovery Service configuration
|
|
# if it's enabled.
|
|
#
|
|
# The Discovery Service is enabled when the agent `roles` contains "discovery".
|
|
# The Discovery service automatically detects Kubernetes Services and configures
|
|
# the agent to provide access to them. See [the Kubernetes App Discovery
|
|
# documentation](../../../enroll-resources/auto-discovery/kubernetes-applications/architecture.mdx)
|
|
# for more details.
|
|
#
|
|
# <Admonition type="note">
|
|
# The Discovery mechanism ignores Kubernetes services running in the `kube-system` and
|
|
# `kube-public` namespaces.
|
|
# </Admonition>
|
|
# The default value will try to discover all apps running in Kubernetes.
|
|
# The discovery can be restricted through this value. For example:
|
|
#
|
|
# ```yaml
|
|
# kubernetesDiscovery:
|
|
# - types: ["app"]
|
|
# namespaces: [ "toronto", "porto" ]
|
|
# labels:
|
|
# env: staging
|
|
# - types: ["app"]
|
|
# namespaces: [ "seattle", "oakland" ]
|
|
# labels:
|
|
# env: testing
|
|
# ```
|
|
kubernetesDiscovery:
|
|
- types: ["app"]
|
|
namespaces: ["*"]
|
|
labels:
|
|
"*": "*"
|
|
|
|
################################################################
|
|
# Values that must be provided if Jamf service is enabled.
|
|
################################################################
|
|
|
|
# jamfApiEndpoint(string) -- sets the Jamf Pro API endpoint used for Jamf service.
|
|
# Example: "https://yourtenant.jamfcloud.com/api".
|
|
#
|
|
# This setting is required if the chart `roles` contains `jamf`.
|
|
jamfApiEndpoint: ""
|
|
|
|
# jamfClientId(string) -- sets the Jamf Pro API Client ID used for Jamf service.
|
|
#
|
|
# This setting is required if the chart `roles` contains `jamf`.
|
|
jamfClientId: ""
|
|
|
|
# jamfClientSecret(string) -- sets the Jamf Pro API client secret used for Jamf service.
|
|
#
|
|
# This setting is required if the chart `roles` contains `jamf` and `jamfCredentialsSecret.create` is set to `true`.
|
|
# If you provide your own Kubernetes Secret, this setting can remain unset.
|
|
jamfClientSecret: ""
|
|
|
|
# jamfCredentialsSecret -- manages the Kubernetes Secret containing the Jamf API credentials (either Jamf client secret or password).
|
|
jamfCredentialsSecret:
|
|
# jamfCredentialsSecret.create(bool) -- controls whether the chart creates the
|
|
# Kubernetes `Secret` containing the Jamf Pro API Client Secret.
|
|
# If false, you must create a Kubernetes Secret with the configured name in
|
|
# the Helm release namespace.
|
|
create: true
|
|
# jamfCredentialsSecret.name(string) -- is the name of the Kubernetes Secret
|
|
# containing the Jamf Pro API Client Secret used by the chart.
|
|
#
|
|
# If `jamfCredentialsSecret.create` is `false`, the chart will not attempt to create the secret itself.
|
|
# Instead, it will read the value from an existing Kubernetes Secret. `jamfCredentialsSecret.name`
|
|
# configures the name of this secret. This allows you to configure this secret externally and avoid having a plaintext
|
|
# Jamf Pro API Client Secret stored in your Teleport chart values.
|
|
#
|
|
# To create your own Kubernetes Secret containing Jamf Pro API Client Secret, run the command:
|
|
#
|
|
# ```code
|
|
# $ kubectl --namespace teleport create secret generic my-jamf-secret --from-literal=credential=<replace-with-actual-secret>
|
|
# ```
|
|
#
|
|
# <Admonition type="note">
|
|
# The key used for the Jamf Pro API Client Secret inside the secret must be `credential`, as in the command above.
|
|
# </Admonition>
|
|
#
|
|
# For example:
|
|
#
|
|
# ```yaml
|
|
# jamfCredentialsSecret:
|
|
# create: false
|
|
# name: my-jamf-secret
|
|
# ```
|
|
name: teleport-jamf-api-credentials
|
|
|
|
################################################################
|
|
# Values that you may need to change.
|
|
################################################################
|
|
|
|
# teleportVersionOverride(string) -- controls the Teleport Kubernetes Operator
|
|
# image version deployed by the chart.
|
|
#
|
|
# Normally, the version of the Teleport Kubernetes Operator matches the
|
|
# version of the chart. If you install chart version 15.0.0, you'll use
|
|
# Teleport version 15.0.0. Upgrading the agent is done by upgrading the chart.
|
|
#
|
|
# <Admonition type="warning">
|
|
# `teleportVersionOverride` is intended for development and MUST NOT be
|
|
# used to control the Teleport version in a typical deployment. This
|
|
# chart is designed to run a specific Teleport version. You will face
|
|
# compatibility issues trying to run a different Teleport version with it.
|
|
#
|
|
# If you want to run Teleport version `X.Y.Z`, you should use
|
|
# `helm install --version X.Y.Z` instead.
|
|
# </Admonition>
|
|
teleportVersionOverride: ""
|
|
|
|
# caPin(list) -- is a list of CA pins the agent must validate when joining
|
|
# the Teleport cluster to ensure it is connecting to the correct Auth Service.
|
|
#
|
|
# This is only used when joining the Auth Service directly. When joining through
|
|
# a Proxy Service, authenticity is guaranteed by the x509 certificate used for
|
|
# the TLS connection.
|
|
#
|
|
# Each list element can be the pin itself (recommended), or a path to a file
|
|
# containing the pin. For the latter, it is your responsibility to mount
|
|
# the file, using [`extraVolumes`](#extraVolumes).
|
|
caPin: []
|
|
|
|
# insecureSkipProxyTLSVerify(bool) -- disables TLS verification of the TLS
|
|
# certificate presented by the Proxy Service.
|
|
#
|
|
# This can be used for joining a Teleport instance to a Teleport cluster
|
|
# which does not have valid TLS certificates for testing.
|
|
#
|
|
# <Admonition type="warning">
|
|
# Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
|
|
# cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
|
|
#
|
|
# One option might be to use Teleport's built-in [ACME support](../teleport-cluster.mdx#acme) or enable [cert-manager support](../teleport-cluster.mdx#highavailabilitycertmanager).
|
|
# </Admonition>
|
|
insecureSkipProxyTLSVerify: false
|
|
|
|
# teleportConfig(object) -- contains YAML teleport configuration to pass to the
|
|
# Teleport pods. The configuration will be merged with the chart-generated
|
|
# configuration and will take precedence in case of conflict.
|
|
#
|
|
# See the [Teleport Configuration Reference](../../config.mdx) for the list of supported fields.
|
|
#
|
|
# ```yaml
|
|
# teleportConfig:
|
|
# app_service:
|
|
# debug_app: true
|
|
# discovery_service:
|
|
# enabled: true
|
|
# azure:
|
|
# - types: ["aks"]
|
|
# tags:
|
|
# "*":"*"
|
|
# ```
|
|
teleportConfig: {}
|
|
|
|
# tls -- contains settings for mounting your own TLS material in the agent pod.
|
|
# The agent does not expose a TLS server, so this is only used to trust CAs.
|
|
tls:
|
|
# tls.existingCASecretName(string) -- sets the `SSL_CERT_FILE` environment
|
|
# variable to load a trusted CA or bundle in PEM format into Teleport pods.
|
|
# The injected CA will be used to validate TLS communications, with the Proxy
|
|
# Service, with upstream applications or databases.
|
|
#
|
|
# <Admonition type="note">
|
|
# The recommended way to trust a database CA is to do it per-database instead
|
|
# of adding the CA to the global Teleport trust store. It allows to trust
|
|
# multiple CAs while limiting the trust scope to their specific databases.
|
|
# See [the `databases` section](#databases).
|
|
# </Admonition>
|
|
#
|
|
# You must create a secret containing the CA certs in the same namespace as Teleport using a command like:
|
|
#
|
|
# ```code
|
|
# $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
|
|
# ```
|
|
#
|
|
# <Notice type="warning" title="Root CA filename">
|
|
# The key containing the root CA in the secret must be `ca.pem`.
|
|
# </Notice>
|
|
existingCASecretName: ""
|
|
|
|
# updater -- controls whether the Kube Agent Updater should be deployed alongside
|
|
# the `teleport-kube-agent`. The updater fetches the target version, validates the
|
|
# image signature, and updates the teleport deployment. The `enterprise` value should
|
|
# have been set to `true`.
|
|
#
|
|
# All Kubernetes-specific fields such as `tolerations`, `affinity`, `nodeSelector`,
|
|
# ... default to the agent values. However, they can be overridden from the
|
|
# `updater` object. For example:
|
|
#
|
|
# ```yaml
|
|
# # the agent pod requests 1cpu and 2 GiB of memory. It also has a memory limit.
|
|
# resources:
|
|
# requests:
|
|
# cpu: "1"
|
|
# memory: "2Gi"
|
|
# limits:
|
|
# memory: "2Gi"
|
|
#
|
|
# # the updater pod requests 0.5 cpu and 512MiB of memory. The memory limit has also been unset.
|
|
# updater:
|
|
# resources:
|
|
# requests:
|
|
# cpu: "0.5"
|
|
# memory: "512Mi"
|
|
# limits: ~
|
|
# ```
|
|
#
|
|
# Other updater-specific values that can be defined in `updater` are described
|
|
# below.
|
|
updater:
|
|
# updater.enabled(bool) -- Enables the Kube Agent Updater and deploys it alongside the Teleport Agent.
|
|
# You can enable this when:
|
|
#
|
|
# - using Teleport Cloud and your tenant is enrolled into automatic updates.
|
|
# (You can check this through the web UI, choose `Add Kubernetes` and
|
|
# `Enroll New Resource of type Kubernetes`, and check if the value is turned
|
|
# on.)
|
|
# - using self-hosted Teleport and you maintain your own version server.
|
|
#
|
|
# You must not enable this when:
|
|
#
|
|
# - you are a Teleport Cloud customer not enrolled in automatic updates.
|
|
# - you are a self-hosted Teleport user and have not set up your Teleport cluster to
|
|
# support automatic updates.
|
|
enabled: false
|
|
|
|
# updater.versionServer(string) -- is the URL of the version server the agent
|
|
# fetches the target version from. The complete version endpoint is built by
|
|
# concatenating [`versionServer`](#updaterversionserver) and [`releaseChannel`
|
|
# ](#updaterreleasechannel).
|
|
# This field supports gotemplate.
|
|
#
|
|
# You must set this if the updater is enabled, and you are not a Teleport Cloud user.
|
|
#
|
|
# You must not change the default values if you are a Teleport Cloud user.
|
|
versionServer: "https://{{ .Values.proxyAddr }}/v1/webapi/automaticupgrades/channel"
|
|
|
|
# updater.releaseChannel(string) -- is the release channel the updater
|
|
# subscribes to.
|
|
#
|
|
# The complete version endpoint is built by concatenating
|
|
# [`versionServer`](#updaterversionserver) and [`releaseChannel`](#updaterreleasechannel).
|
|
# You must not change the default value if you are a Teleport Cloud user unless
|
|
# instructed by Teleport support.
|
|
#
|
|
# You can change this value if the updater is enabled, you are not a Teleport
|
|
# Cloud user, and manage your own version server.
|
|
releaseChannel: "stable/cloud"
|
|
|
|
# updater.image(string) -- sets the container image used for Teleport updater
|
|
# pods run when `updater.enabled` is true.
|
|
#
|
|
# You can override this to use your own Teleport Kube Agent Updater image rather
|
|
# than a Teleport-published image.
|
|
image: public.ecr.aws/gravitational/teleport-kube-agent-updater
|
|
|
|
# updater.serviceAccount --
|
|
serviceAccount:
|
|
# updater.serviceAccount.name(string) -- is the updater Kubernetes Service
|
|
# Account name. When unset, it defaults to `<kube agent sa name>-updater`
|
|
name: ""
|
|
|
|
# updater.pullCredentials(string) -- configures how the updater attempts to
|
|
# get the image pull credentials used to validate the image signature.
|
|
#
|
|
# This is not required when pulling images from official public Teleport
|
|
# registries (chart's default).
|
|
#
|
|
# Supported values are `amazon`, `google`, `docker` and `none`.
|
|
pullCredentials: ""
|
|
|
|
# updater.extraArgs(list) -- contains additional arguments to pass to the updater
|
|
# binary.
|
|
extraArgs: []
|
|
|
|
# updater.extraVolumes(list) -- contains extra volumes to mount into the Updater pods.
|
|
# See [the Kubernetes volume documentation](https://kubernetes.io/docs/concepts/storage/volumes/)
|
|
# for more details.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# updater:
|
|
# extraVolumes:
|
|
# - name: myvolume
|
|
# secret:
|
|
# secretName: testSecret
|
|
# ```
|
|
extraVolumes: []
|
|
|
|
# updater.extraVolumeMounts(list) -- contains extra volumes mounts for the updater.
|
|
# See [the Kubernetes volume documentation](https://kubernetes.io/docs/concepts/storage/volumes/)
|
|
# for more details.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# updater:
|
|
# extraVolumesMounts:
|
|
# - name: myvolume
|
|
# mountPath: /path/on/host
|
|
# ```
|
|
extraVolumeMounts: []
|
|
|
|
# existingDataVolume(string) -- is the name of an existing Kubernetes Persistent
|
|
# Volume that should be mounted at `/var/lib/teleport`.
|
|
#
|
|
# This is only useful if you had a previous agent running with persistence enabled
|
|
# and want for a new agent to reuse the volume.
|
|
existingDataVolume: ""
|
|
|
|
# podSecurityPolicy --
|
|
podSecurityPolicy:
|
|
# podSecurityPolicy.enabled(bool) -- controls if the chart should deploy a Kubernetes
|
|
# PodSecurityPolicy.
|
|
#
|
|
# By default, Teleport charts used to install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/branch/(=teleport.major_version=)/examples/chart/teleport-cluster/templates/psp.yaml).
|
|
#
|
|
# PodSecurityPolicy resources (PSP) have been removed in Kubernetes 1.25
|
|
# and replaced since 1.23 by PodSecurityAdmission (PSA). If you are running on
|
|
# Kubernetes 1.23 or later, it is recommended to disable PSPs and use PSAs.
|
|
# The steps are documented in the
|
|
# [PSP removal guide](../../../deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
|
|
#
|
|
# This value will be removed in a future chart version.
|
|
enabled: true
|
|
|
|
# labels(object) -- is the map of key-value pairs that will be applied on the
|
|
# Teleport resource representing the Kubernetes cluster. These labels can then
|
|
# be used with Teleport's RBAC policies to define access rules for the cluster.
|
|
# This is only used when the [`roles`](#roles) contains `kube`.
|
|
#
|
|
# <Admonition type="note">
|
|
# These are Teleport-specific RBAC labels, not Kubernetes labels.
|
|
# </Admonition>
|
|
#
|
|
# <Admonition type="note">
|
|
# For historical/backwards compatibility reasons, these labels will only be applied to the Kubernetes cluster being joined via the
|
|
# Teleport Kubernetes service.
|
|
#
|
|
# To set labels for applications, add a `labels` element to the [`apps`](#apps) section.
|
|
# To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section.
|
|
#
|
|
# For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../../management/admin/labels.mdx).
|
|
# </Admonition>
|
|
#
|
|
# For example:
|
|
#
|
|
# ```yaml
|
|
# labels:
|
|
# environment: production
|
|
# region: us-east
|
|
# ```
|
|
labels: {}
|
|
|
|
# highAvailability -- contains settings controlling the availability of the
|
|
# Teleport agent deployed by the chart.
|
|
#
|
|
# The availability can be increased by:
|
|
# - running more replicas with `replicaCount`
|
|
# - requiring that the Pods are not scheduled on the same Kubernetes Node with `requireAntiAffinity`
|
|
# - by asking Kubernetes not to delete all pods at the same time with `podDisruptionBudget`.
|
|
#
|
|
# Even with highAvailability settings Restarting/rolling-out pods can still cause
|
|
# disruption for established long-lived sessions, like `kubectl exec` or
|
|
# database shells.
|
|
highAvailability:
|
|
# highAvailability.replicaCount(int) -- is the number of agent replicas deployed by the Chart.
|
|
#
|
|
# Set to a number higher than `1` for a high availability mode where multiple Teleport pods will be deployed.
|
|
#
|
|
# <Admonition type="tip" title="Sizing guidelines">
|
|
# As a rough guide, we recommend configuring one replica per distinct
|
|
# availability zone where your cluster has worker nodes.
|
|
#
|
|
# 2 replicas/availability zones will be fine for smaller workloads. 3-5
|
|
# replicas/availability zones will be more appropriate for bigger
|
|
# clusters with more traffic.
|
|
# </Admonition>
|
|
#
|
|
# When adding new replicas to an existing agent, you must ensure the provided token
|
|
# (via [`authToken`](#authToken), [`joinParams`](#joinParams), or [`joinTokenSecret`](#joinTokenSecret))
|
|
# is still valid. Each replica has its own identity and needs to join the Teleport
|
|
# cluster on its first startup.
|
|
replicaCount: 1
|
|
|
|
# highAvailability.requireAntiAffinity(bool) -- configures Kubernetes `requiredDuringSchedulingIgnoredDuringExecution`
|
|
# to require that multiple Teleport pods must not be scheduled on the same physical host.
|
|
#
|
|
# <Admonition type="warning">
|
|
# This can result in Teleport pods failing to be scheduled in very small
|
|
# clusters or during node downtime, so should be used with caution.
|
|
# </Admonition>
|
|
#
|
|
# Setting `highAvailability.requireAntiAffinity` to `false` (the default)
|
|
# uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
|
|
# anti-affinity a soft requirement.
|
|
#
|
|
# <Admonition type="note">
|
|
# This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
|
|
# </Admonition>
|
|
requireAntiAffinity: false
|
|
|
|
# highAvailability.podDisruptionBudget -- controls how the chart creates and
|
|
# configures a Kubernetes PodDisruptionBudget to ensure Kubernetes does not
|
|
# delete all agent replicas at the same time.
|
|
podDisruptionBudget:
|
|
# highAvailability.podDisruptionBudget.enabled(bool) -- makes the chart create
|
|
# a Kubernetes PodDisruptionBudget for the agent pods.
|
|
enabled: false
|
|
|
|
# highAvailability.podDisruptionBudget.minAvailable(int) -- is the minimum
|
|
# available pod specified on the PodDisruptionBudget.
|
|
minAvailable: 1
|
|
|
|
# podMonitor -- controls the PodMonitor CR (from monitoring.coreos.com/v1)
|
|
# This CRD is managed by the prometheus-operator and allows workload to
|
|
# get monitored. To use this value, you need to run a `prometheus-operator`
|
|
# in the cluster for this value to take effect.
|
|
# See https://prometheus-operator.dev/docs/prologue/introduction/
|
|
podMonitor:
|
|
# podMonitor.enabled(bool) -- controls if the chart deploys a PodMonitor.
|
|
# This is disabled by default as it requires the PodMonitor CRD to be installed.
|
|
enabled: false
|
|
|
|
# podMonitor.additionalLabels(object) -- adds labels on the PodMonitor.
|
|
# This is used to be selected by a specific prometheus instance.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# podMonitor:
|
|
# additionalLabels:
|
|
# prometheus: default
|
|
# ```
|
|
additionalLabels: {}
|
|
|
|
# podMonitor.interval(string) -- is the interval between two metrics scrapes.
|
|
interval: 30s
|
|
|
|
################################################################
|
|
# Values that must be provided if using persistent storage for Teleport.
|
|
################################################################
|
|
|
|
# storage -- controls how the agent stores data in a Kubernetes Persistent Volume.
|
|
#
|
|
# Since Teleport 12, the agent does not need PV storage to keep its identity across
|
|
# restarts: it stores it in a Kubernetes Secret. This means the `teleport-kubernetes-agent`
|
|
# can use one-time and short-lived join tokens, it will retain its identity and
|
|
# secrets even after a restart.
|
|
#
|
|
# The main benefit of enabling storage is to persist not-yet-uploaded session
|
|
# recordings after Pod termination, when the Teleport session recording mode is
|
|
# not synchronous.
|
|
storage:
|
|
# storage.enabled(bool) -- enables the creation of a Kubernetes persistent
|
|
# volume to hold Teleport instance state.
|
|
enabled: false
|
|
|
|
# storage.storageClassName(string) -- controls which Kubernetes StorageClass
|
|
# the chart uses when creating Persistent Volume Claims. A StorageClass with
|
|
# the provided name must exist on the Kubernetes cluster.
|
|
storageClassName: ""
|
|
|
|
# storage.requests(string) -- is the size of the persistent volume to create.
|
|
requests: 128Mi
|
|
|
|
# adminClusterRoleBinding -- optionally creates a cluster admin role binding.
|
|
# This is useful for granting cluster admin permissions to a Kubernetes Group
|
|
# other than the default `system:masters` group.
|
|
#
|
|
# GKE Autopilot clusters forbid using the `system:masters` group for impersonation
|
|
# and require a custom group to be used instead.
|
|
adminClusterRoleBinding:
|
|
# adminClusterRoleBinding.create(bool) -- controls if the chart should create
|
|
# an additional admin cluster role binding.
|
|
create: false
|
|
# adminClusterRoleBinding.name(string) -- is the name of the created admin
|
|
# cluster role binding.
|
|
name: "cluster-admin"
|
|
|
|
################################################################
|
|
# Values that you shouldn't need to change.
|
|
################################################################
|
|
|
|
# image(string) -- sets the container image used for Teleport OSS agent pods
|
|
# created by the chart.
|
|
#
|
|
# You can override this to use your own Teleport image rather than a Teleport-published image.
|
|
#
|
|
# <Admonition type="warning" title="Interaction with Teleport Kube Agent Updater">
|
|
# When using the Teleport Kube Agent Updater, you must ensure the image is
|
|
# available before the updater version target gets updated and Kubernetes tries
|
|
# to pull the image.
|
|
#
|
|
# For this reason, it is strongly discouraged to set a custom image when
|
|
# using automatic updates. Teleport Cloud uses automatic updates by default.
|
|
# </Admonition>
|
|
#
|
|
# Since version 13, hardened distroless images are used by default.
|
|
# You can use the deprecated debian-based images by setting the value to
|
|
# `public.ecr.aws/gravitational/teleport`. Those images will be
|
|
# removed with teleport 15.
|
|
#
|
|
# This setting only takes effect when [`enterprise`](#enterprise) is `false`.
|
|
# When running an enterprise version, you must use
|
|
# [`enterpriseImage`](#enterpriseImage) instead.
|
|
image: public.ecr.aws/gravitational/teleport-distroless
|
|
|
|
# enterpriseImage(string) -- sets the container image used for Teleport Enterprise
|
|
# agent pods created by the chart.
|
|
#
|
|
# You can override this to use your own Teleport image rather than a
|
|
# Teleport-published image.
|
|
#
|
|
# <Admonition type="warning" title="Interaction with Teleport Kube Agent Updater">
|
|
# When using the Teleport Kube Agent Updater you must ensure the image is
|
|
# available before the updater version target gets updated and Kubernetes tries
|
|
# to pull the image.
|
|
#
|
|
# For this reason, it is strongly discouraged to set a custom image when
|
|
# using automatic updates. Teleport Cloud uses automatic updates by default.
|
|
# </Admonition>
|
|
#
|
|
# Since version 13, hardened distroless images are used by default.
|
|
# You can use the deprecated debian-based images by setting the value to
|
|
# `public.ecr.aws/gravitational/teleport-ent`. Those images will be
|
|
# removed with teleport 15.
|
|
#
|
|
# This setting only takes effect when [`enterprise`](#enterprise) is `true`.
|
|
# When running an enterprise version, you must use [`image`](#image) instead.
|
|
enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless
|
|
|
|
# imagePullSecrets(list) -- is a list of secrets containing authorization tokens
|
|
# which can be optionally used to access a private Docker registry.
|
|
#
|
|
# See the [Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod) for more details.
|
|
imagePullSecrets: []
|
|
|
|
# Number of replicas for the agent deployment.
|
|
# DEPRECATED Use highAvailability.replicaCount instead
|
|
# replicaCount: 1
|
|
|
|
# clusterRoleName(string) -- can be optionally used to override the name of the
|
|
# Kubernetes `ClusterRole` used by the agent's `ServiceAccount`.
|
|
#
|
|
# <Admonition type="note">
|
|
# Most users will not need to change this.
|
|
# </Admonition>
|
|
clusterRoleName: ""
|
|
|
|
# clusterRoleBindingName(string) -- can be optionally used to override the name
|
|
# of the Kubernetes `ClusterRoleBinding` used by the agent's `ServiceAccount`.
|
|
#
|
|
# <Admonition type="note">
|
|
# Most users will not need to change this.
|
|
# </Admonition>
|
|
clusterRoleBindingName: ""
|
|
|
|
# roleName(string) -- provides a custom name for the `Role` resource that the
|
|
# `teleport-kube-agent` chart creates for the Teleport pod. By default, the `Role`
|
|
# has the name of the Helm release.
|
|
#
|
|
# You should set this value if there is a `Role` resource in the namespace of your
|
|
# `teleport-kube-agent` resources with the same name as your `teleport-kube-agent`
|
|
# release.
|
|
roleName: ""
|
|
|
|
# roleBindingName(string) -- provides a custom name for the `RoleBinding` resource that the
|
|
# `teleport-kube-agent` chart creates for the Teleport pod. By default, the
|
|
# `RoleBinding` has the name of the Helm release.
|
|
#
|
|
# You should set this value if there is a `RoleBinding` resource in the namespace
|
|
# of your `teleport-kube-agent` resources with the same name as your
|
|
# `teleport-kube-agent` release.
|
|
roleBindingName: ""
|
|
|
|
# serviceAccountName(string) -- is deprecated and will be removed in a future
|
|
# version. Use [`serviceAccount.name`](#serviceaccountname-1) instead.
|
|
serviceAccountName: ""
|
|
|
|
# serviceAccount -- controls the Kubernetes ServiceAccounts deployed and used by
|
|
# the chart.
|
|
serviceAccount:
|
|
# serviceAccount.create(bool) -- controls whether Helm Chart creates the
|
|
# Kubernetes `ServiceAccount` resources for the agent and optionally for the
|
|
# updater.
|
|
# When off, you are responsible for creating the appropriate ServiceAccount
|
|
# resources.
|
|
create: true
|
|
# serviceAccount.name(string) -- sets the name of the `ServiceAccount` resource
|
|
# used by the chart. By default, the `ServiceAccount` has the name of the
|
|
# Helm release.
|
|
name: ""
|
|
|
|
# rbac --
|
|
rbac:
|
|
# rbac.create(bool) -- controls if the chart should create RBAC Kubernetes resources.
|
|
#
|
|
# - When `true`, the chart creates both `ClusterRole` and `ClusterRoleBinding`
|
|
# resources for the agent, and `Role`/`RoleBinding` for the updater if enabled.
|
|
# - When `false`, the chart does not create the `Role` and `RoleBinding` resources.
|
|
# The user is responsible for deploying and maintaining them separately.
|
|
#
|
|
# This value can be set to `false` when deploying in constrained environments
|
|
# where the user deploying the operator is not allowed to edit RBAC resources.
|
|
create: true
|
|
|
|
# Name of the Secret to store the teleport join token.
|
|
# DEPRECATED Use joinTokenSecret.name instead
|
|
secretName: ""
|
|
|
|
# joinTokenSecret -- manages the join token secret creation and its name.
|
|
# See the [`joinParams`](#joinParams) section for more details.
|
|
joinTokenSecret:
|
|
# joinTokenSecret.create(bool) -- controls whether the chart creates the
|
|
# Kubernetes `Secret` containing the Teleport join token.
|
|
# If false, you must create a Kubernetes Secret with the configured name in
|
|
# the Helm release namespace.
|
|
create: true
|
|
# joinTokenSecret.name(string) -- is the name of the Kubernetes Secret
|
|
# containing the Teleport join token used by the chart.
|
|
#
|
|
# If `joinTokenSecret.create` is `false`, the chart will not attempt to create the secret itself.
|
|
# Instead, it will read the value from an existing secret. `joinTokenSecret.name`
|
|
# configures the name of this secret. This allows you to configure this secret externally and avoid having a plaintext
|
|
# join token stored in your Teleport chart values.
|
|
#
|
|
# To create your own join token secret, you can use a command like this:
|
|
#
|
|
# ```code
|
|
# $ kubectl --namespace teleport create secret generic my-token-secret --from-literal=auth-token=<replace-with-actual-token>
|
|
# ```
|
|
#
|
|
# <Admonition type="note">
|
|
# The key used for the auth token inside the secret must be `auth-token`, as in the command above.
|
|
# </Admonition>
|
|
#
|
|
# For example:
|
|
#
|
|
# ```yaml
|
|
# joinTokenSecret:
|
|
# create: false
|
|
# name: my-token-secret
|
|
#
|
|
# joinParams:
|
|
# method: "token"
|
|
# tokenName: ""
|
|
# ```
|
|
name: teleport-kube-agent-join-token
|
|
|
|
# log -- controls the agent logging.
|
|
log:
|
|
# log.level(string) -- is the log level for the Teleport process.
|
|
# Available log levels are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
|
|
#
|
|
# The default is `INFO`, which is recommended in production.
|
|
# `DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
|
|
level: INFO
|
|
# log.output(string) -- sets the output destination for the Teleport process.
|
|
# This can be set to any of the built-in values: `stdout`, `stderr` or `syslog`
|
|
# to use that destination.
|
|
#
|
|
# The value can also be set to a file path (such as `/var/log/teleport.log`)
|
|
# to write logs to a file. Bear in mind that a few service startup messages
|
|
# will still go to `stderr` for resilience.
|
|
output: stderr
|
|
# log.format(string) -- sets the log output format for the Teleport process.
|
|
# Possible values are `text` (default) or `json`.
|
|
format: text
|
|
# log.extraFields(list) -- sets the fields used in logging for the Teleport process.
|
|
#
|
|
# See the [Teleport config file reference](../../config.mdx) for
|
|
# more details on possible values for `extra_fields`.
|
|
extraFields: ["timestamp", "level", "component", "caller"]
|
|
|
|
##################################
|
|
# Extra Kubernetes configuration #
|
|
##################################
|
|
|
|
# affinity(object) -- sets the affinities for any pods created by the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
|
|
# for more details.
|
|
affinity: {}
|
|
|
|
# dnsConfig(object) -- contains custom Pod DNS Configuration for the agent pods.
|
|
# This value is useful if you need to reduce the DNS load: set "ndots" to 0 and
|
|
# only use FQDNs to refer to applications and databases.
|
|
#
|
|
# See [the Kubernetes pod DNS documentation
|
|
# ](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config)
|
|
# for more information.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# nameservers:
|
|
# - 1.2.3.4
|
|
# searches:
|
|
# - ns1.svc.cluster-domain.example
|
|
# - my.dns.search.suffix
|
|
# options:
|
|
# - name: ndots
|
|
# value: "2"
|
|
# ```
|
|
dnsConfig: {}
|
|
|
|
# dnsPolicy(string) -- sets the Pod's DNS Policy
|
|
#
|
|
# See [the Kubernetes pod DNS documentation
|
|
# ](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy)
|
|
# for more information.
|
|
dnsPolicy: ""
|
|
|
|
# nodeSelector(object) -- sets the node selector for any pods created by the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector)
|
|
# for more details.
|
|
nodeSelector: {}
|
|
|
|
# extraLabels -- contains additional Kubernetes labels to apply on the resources
|
|
# created by the chart.
|
|
# See [the Kubernetes label documentation
|
|
# ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
|
|
# for more information.
|
|
extraLabels:
|
|
# extraLabels.clusterRole(object) -- are labels to set on the ClusterRole.
|
|
clusterRole: {}
|
|
# extraLabels.clusterRoleBinding(object) -- are labels to set on the ClusterRoleBinding.
|
|
clusterRoleBinding: {}
|
|
# extraLabels.role(object) -- are labels to set on the Role.
|
|
role: {}
|
|
# extraLabels.roleBinding(object) -- are labels to set on the RoleBinding.
|
|
roleBinding: {}
|
|
# extraLabels.config(object) -- are labels to set on the ConfigMap.
|
|
config: {}
|
|
# extraLabels.deployment(object) -- are labels to set on the Deployment or StatefulSet.
|
|
deployment: {}
|
|
# extraLabels.job(object) -- are labels to set on the post-delete Job created by the chart.
|
|
job: {}
|
|
# extraLabels.pod(object) -- are labels to set on the Pods created by the
|
|
# Deployment or StatefulSet.
|
|
pod: {}
|
|
# extraLabels.podDisruptionBudget(object) -- are labels to set on the podDisruptionBudget.
|
|
podDisruptionBudget: {}
|
|
# extraLabels.podSecurityPolicy(object) -- are labels to set on the podSecurityPolicy.
|
|
podSecurityPolicy: {}
|
|
# extraLabels.secret(object) -- are labels to set on the Secret.
|
|
secret: {}
|
|
# extraLabels.serviceAccount(object) -- are labels to set on the ServiceAccount.
|
|
serviceAccount: {}
|
|
|
|
# annotations -- contains annotations to apply to the different Kubernetes
|
|
# objects created by the chart. See [the Kubernetes annotation
|
|
# documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
|
|
# for more details.
|
|
annotations:
|
|
# annotations.config(object) -- contains the Kubernetes annotations
|
|
# put on the `ConfigMap` resource created by the chart.
|
|
config: {}
|
|
# annotations.deployment(object) -- contains the Kubernetes annotations
|
|
# put on the `Deployment` or `StatefulSet` resource created by the chart.
|
|
deployment: {}
|
|
# annotations.pod(object) -- contains the Kubernetes annotations
|
|
# put on the `Pod` resources created by the chart.
|
|
pod: {}
|
|
# annotations.secret(object) -- contains the Kubernetes annotations
|
|
# put on the `Secret` resource created by the chart.
|
|
# This has no effect when `joinTokenSecret.create` is `false`.
|
|
secret: {}
|
|
# annotations.serviceAccount(object) -- contains the Kubernetes annotations
|
|
# put on the `ServiceAccount` resource created by the chart.
|
|
serviceAccount: {}
|
|
|
|
# extraArgs(list) -- contains extra arguments to pass to `teleport start` for
|
|
# the main Teleport pod
|
|
extraArgs: []
|
|
|
|
# extraEnv(list) -- contains extra environment variables to set in the main
|
|
# Teleport pod.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# extraEnv:
|
|
# - name: HTTPS_PROXY
|
|
# value: "http://username:password@my.proxy.host:3128"
|
|
# ```
|
|
extraEnv: []
|
|
|
|
# extraContainers(list) -- contains extra containers to add in the main Teleport
|
|
# pod.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# extraContainers:
|
|
# - name: debug-sidecar
|
|
# command:
|
|
# - busybox
|
|
# - sh
|
|
# - -c
|
|
# - "echo waiting && sleep infinity"
|
|
# image: busybox:latest
|
|
# imagePullPolicy: IfNotPresent
|
|
# securityContext:
|
|
# privileged: true
|
|
# runAsNonRoot: false
|
|
# ```
|
|
extraContainers: []
|
|
|
|
# extraVolumes(list) -- contains extra volumes to mount into the Teleport pods.
|
|
# See [the Kubernetes volume documentation](https://kubernetes.io/docs/concepts/storage/volumes/)
|
|
# for more details.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# extraVolumes:
|
|
# - name: myvolume
|
|
# secret:
|
|
# secretName: testSecret
|
|
# ```
|
|
extraVolumes: []
|
|
|
|
# extraVolumeMounts(list) -- contains extra volumes mounts for the main Teleport container.
|
|
# See [the Kubernetes volume documentation](https://kubernetes.io/docs/concepts/storage/volumes/)
|
|
# for more details.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# extraVolumesMounts:
|
|
# - name: myvolume
|
|
# mountPath: /path/on/host
|
|
# ```
|
|
extraVolumeMounts: []
|
|
|
|
# hostAliases -- sets Host aliases in the Teleport Pod.
|
|
# See [the Kubernetes hosts file documentation](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)
|
|
# for more details.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# hostAliases:
|
|
# - ip: "127.0.0.1"
|
|
# hostnames:
|
|
# - "foo.local"
|
|
# - "bar.local"
|
|
# - ip: "10.1.2.3"
|
|
# hostnames:
|
|
# - "foo.remote"
|
|
# - "bar.remote"
|
|
# ```
|
|
hostAliases: []
|
|
|
|
# imagePullPolicy(string) -- sets the pull policy for any pods created by the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
|
|
# for more details.
|
|
imagePullPolicy: IfNotPresent
|
|
|
|
# initContainers(list) -- sets the Teleport Pod's init-containers.
|
|
# See [the Kubernetes init-container documentation](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
|
|
# for more details.
|
|
#
|
|
# For example:
|
|
# ```yaml
|
|
# initContainers:
|
|
# - name: "teleport-init"
|
|
# image: "alpine"
|
|
# args: ["echo test"]
|
|
# ```
|
|
initContainers: []
|
|
|
|
# resources(object) -- sets the resource requests/limits for any pods created by the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
|
|
# for more details.
|
|
resources: {}
|
|
|
|
# initSecurityContext(object) -- sets the init container security context for any
|
|
# pods created by the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
|
|
# for more details.
|
|
#
|
|
# The default value is compatible with [the restricted PSS](https://kubernetes.io/docs/concepts/security/pod-security-standards/).
|
|
#
|
|
# To unset the security context, set it to `null` or `~`.
|
|
initSecurityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 9807
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
# securityContext(object) -- sets the container security context for any pods created by the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
|
|
# for more details.
|
|
#
|
|
# The default value is compatible with [the restricted PSS](https://kubernetes.io/docs/concepts/security/pod-security-standards/).
|
|
#
|
|
# To unset the security context, set it to `null` or `~`.
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 9807
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
# podSecurityContext(object) -- sets the pod security context for any pods created by the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
|
|
# for more details.
|
|
#
|
|
# To unset the security context, set it to `null` or `~`.
|
|
podSecurityContext:
|
|
fsGroup: 9807
|
|
|
|
# priorityClassName(string) -- sets the priority class used by any pods created by the chart.
|
|
# The user is responsible for creating the `PriorityClass` resource before deploying the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
|
|
# for more details.
|
|
priorityClassName: ""
|
|
|
|
# tolerations(list) -- sets the tolerations for any pods created by the chart.
|
|
# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
|
|
# for more details.
|
|
tolerations: []
|
|
|
|
# probeTimeoutSeconds(int) -- sets the timeout for the readiness and liveness probes
|
|
# https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
|
|
probeTimeoutSeconds: 1
|