Add auth option for Tornjak (#259)
* Added auth option, specifically keycloak for tornjak production use Signed-off-by: Mohammed Abdi <[email protected]> * Added auth values for tornjak Signed-off-by: Mohammed Abdi <[email protected]> * Update charts/spire/charts/tornjak-frontend/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Mariusz Sabath <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> * nit Signed-off-by: Mohammed Abdi <[email protected]> * install keycloak first Signed-off-by: Mohammed Abdi <[email protected]> * add logs volume back Signed-off-by: Mohammed Abdi <[email protected]> * Fixed NPM init error Signed-off-by: Mariusz Sabath <[email protected]> * Fixed the values documentation errors Signed-off-by: Mariusz Sabath <[email protected]> * Post-review suggestion fixes Signed-off-by: Mariusz Sabath <[email protected]> * Fixed typo Signed-off-by: Mariusz Sabath <[email protected]> * Updating Keyclaok examples README Signed-off-by: Mariusz Sabath <[email protected]> * Fixed the parameter reference Signed-off-by: Mariusz Sabath <[email protected]> * Fix typo Signed-off-by: Mariusz Sabath <[email protected]> * use keycloak-config-cli to simplify tornjak realm import Signed-off-by: MohammedAbdi <[email protected]> * edit client id Signed-off-by: MohammedAbdi <[email protected]> * reverse client id Signed-off-by: MohammedAbdi <[email protected]> * fix the doc Signed-off-by: Mariusz Sabath <[email protected]> * update tornjak version and backend auth Signed-off-by: MohammedAbdi <[email protected]> * update client id Signed-off-by: MohammedAbdi <[email protected]> * updates values yaml Signed-off-by: MohammedAbdi <[email protected]> * update documentation Signed-off-by: MohammedAbdi <[email protected]> * nit Signed-off-by: MohammedAbdi <[email protected]> * update doc Signed-off-by: MohammedAbdi <[email protected]> * add audience check tornjak Signed-off-by: MohammedAbdi <[email protected]> * remove unused file Signed-off-by: MohammedAbdi <[email protected]> * update doc Signed-off-by: MohammedAbdi <[email protected]> * nit and add auth not enabled warning back Signed-off-by: MohammedAbdi <[email protected]> * adjust liveness probe until tornjak handles liveendpoint for auth and direct connection to discovery Signed-off-by: MohammedAbdi <[email protected]> * update doc and add keycloak proxy Signed-off-by: MohammedAbdi <[email protected]> --------- Signed-off-by: Mohammed Abdi <[email protected]> Signed-off-by: Mohammed Abdi <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: MohammedAbdi <[email protected]> Co-authored-by: Mohammed Abdi <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]>
This commit is contained in:
Mohammed Abdi
co-authored by
Faisal Memon
Mariusz Sabath
Mohammed Abdi
Faisal Memon
Mariusz Sabath
Mohammed Abdi
parent
f679a0dab6
commit
a2494ee45e
@@ -340,7 +340,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` |
|
||||
| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.4.2` |
|
||||
| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.6.0` |
|
||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||
@@ -361,6 +361,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
||||
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
||||
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
||||
| `tornjak.config.userManagement` | UserManagement config | |
|
||||
| `tornjak.config.userManagement.issuer` | UserManagement issuer URL | `""` |
|
||||
| `tornjak.config.userManagement.audience` | UserManagement audience check | `""` |
|
||||
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
||||
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||
|
||||
@@ -9,10 +9,12 @@ Installed {{ .Chart.Name }}…
|
||||
|
||||
Installed {{ include "spire-tornjak.fullname" . }}…
|
||||
|
||||
### WARNING ###
|
||||
{{- if eq .Values.tornjak.config.userManagement.issuer "" }}
|
||||
### WARNING ###
|
||||
|
||||
Tornjak runs without authentication and is therefore NOT suitable to run in production environments.
|
||||
Only use in test environments!
|
||||
Tornjak is configured to run without authentication and is therefore NOT suitable to run in production environments.
|
||||
Only use in test environments!
|
||||
{{- end }}
|
||||
|
||||
Access Tornjak:
|
||||
kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.ports.http }}:10000
|
||||
|
||||
@@ -319,7 +319,7 @@ spec:
|
||||
startupProbe:
|
||||
httpGet:
|
||||
scheme: HTTP
|
||||
path: /api/tornjak/serverinfo
|
||||
path: /
|
||||
port: 10000
|
||||
{{- toYaml .Values.tornjak.startupProbe | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -42,5 +42,13 @@ data:
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{- if ne .Values.tornjak.config.userManagement.issuer "" }}
|
||||
UserManagement "KeycloakAuth" {
|
||||
plugin_data {
|
||||
issuer = "{{ .Values.tornjak.config.userManagement.issuer }}"
|
||||
audience = "{{ .Values.tornjak.config.userManagement.audience }}"
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
@@ -805,7 +805,7 @@ tornjak:
|
||||
repository: spiffe/tornjak-backend
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
defaultTag: "v1.4.2"
|
||||
defaultTag: "v1.6.0"
|
||||
|
||||
service:
|
||||
## @param tornjak.service.type Type of service resource
|
||||
@@ -868,7 +868,13 @@ tornjak:
|
||||
driver: "sqlite3"
|
||||
## @param tornjak.config.dataStore.file File path for sqlite3 file
|
||||
file: "/run/spire/data/tornjak.sqlite3"
|
||||
|
||||
## @extra tornjak.config.userManagement [object] UserManagement config
|
||||
userManagement:
|
||||
## @param tornjak.config.userManagement.issuer UserManagement issuer URL
|
||||
issuer: ""
|
||||
## @param tornjak.config.userManagement.audience UserManagement audience check
|
||||
audience: ""
|
||||
|
||||
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
|
||||
# The connections are determined based on provided configuration
|
||||
# When `tlsSecret` is created in this chart namespace, the TLS connection is started
|
||||
|
||||
@@ -3,7 +3,7 @@ name: tornjak-frontend
|
||||
description: A Helm chart to deploy Tornjak frontend
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "v1.4.2"
|
||||
appVersion: "v1.6.0"
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/tornjak
|
||||
|
||||
@@ -55,47 +55,50 @@ port forwarding. See the chart NOTES output for more details.
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||
| `labels` | Labels for tornjak frontend pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `service.type` | Service type | `ClusterIP` |
|
||||
| `service.port` | Service port | `3000` |
|
||||
| `service.annotations` | Annotations for service resource | `{}` |
|
||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | |
|
||||
| `affinity` | Affinity rules | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
||||
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. | `""` |
|
||||
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
|
||||
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||
| `workingDir` | Set to override the default path containing the Tornjak frontend within the image | `""` |
|
||||
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
||||
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a0383e176104e7840387deb9fda1782660e903654f39acf62931e2c9a60b7fe1` |
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||
| `labels` | Labels for tornjak frontend pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `service.type` | Service type | `ClusterIP` |
|
||||
| `service.port` | Service port | `3000` |
|
||||
| `service.annotations` | Annotations for service resource | `{}` |
|
||||
| `nodeSelector` | (Optional) Select specific nodes to run on. Tornjak currently supports amd64 and arm64 architectures | `{}` |
|
||||
| `affinity` | Affinity rules | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
||||
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If not provided, auto-detection is attempted. | `""` |
|
||||
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
|
||||
| `auth.enabled` | Enables auth for Tornjak | `false` |
|
||||
| `auth.serverURL` | URL of the Auth service. Tornjak Frontend will redirect to this URL to authenticate the user | `""` |
|
||||
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||
| `workingDir` | Set to override the default path containing the Tornjak frontend within the image | `""` |
|
||||
| `logsDir` | Directory path for NPM logs | `/home/node/` |
|
||||
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
||||
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a0383e176104e7840387deb9fda1782660e903654f39acf62931e2c9a60b7fe1` |
|
||||
|
||||
@@ -10,11 +10,15 @@ Tornjak UI (Frontend)
|
||||
pull policy: {{ .Values.image.pullPolicy }}
|
||||
Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
|
||||
SPIRE health check enabled: "{{ .Values.spireHealthCheck.enabled }}"
|
||||
User Managemenet enabled: "{{ .Values.auth.enabled }}"
|
||||
User Managemenet API: "{{ .Values.auth.serverURL }}"
|
||||
|
||||
### WARNING ###
|
||||
{{- if not .Values.auth.enabled }}
|
||||
### WARNING ###
|
||||
|
||||
Tornjak runs without authentication and is therefore NOT suitable to run in production environments.
|
||||
Only use in test environments!
|
||||
Tornjak is configured to run without authentication and is therefore NOT suitable to run in production environments.
|
||||
Only use in test environments!
|
||||
{{- end }}
|
||||
|
||||
Access Tornjak:
|
||||
|
||||
|
||||
@@ -35,10 +35,14 @@ spec:
|
||||
env:
|
||||
- name: REACT_APP_API_SERVER_URI
|
||||
value: {{ include "tornjak-frontend.apiURL" . }}
|
||||
{{- if eq (.Values.spireHealthCheck.enabled | toString) "true" }}
|
||||
{{- if .Values.spireHealthCheck.enabled }}
|
||||
- name: REACT_APP_SPIRE_HEALTH_CHECK_ENABLE
|
||||
value: "{{ .Values.spireHealthCheck.enabled }}"
|
||||
{{- end }}
|
||||
{{- if .Values.auth.enabled }}
|
||||
- name: REACT_APP_AUTH_SERVER_URI
|
||||
value: "{{ .Values.auth.serverURL }}"
|
||||
{{- end }}
|
||||
{{- if .Values.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
@@ -57,7 +61,7 @@ spec:
|
||||
- name: env
|
||||
mountPath: {{ include "tornjak-frontend.workingDir" . }}/build/tmp
|
||||
- name: logs
|
||||
mountPath: /opt/app-root/src/.npm/
|
||||
mountPath: {{ .Values.logsDir }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
|
||||
@@ -63,10 +63,8 @@ service:
|
||||
port: 3000
|
||||
annotations: {}
|
||||
|
||||
## @extra nodeSelector Select specific nodes to run on (currently only amd64 is supported by Tornjak)
|
||||
nodeSelector:
|
||||
## @skip nodeSelector.kubernetes.io/arch
|
||||
kubernetes.io/arch: amd64
|
||||
## @param nodeSelector (Optional) Select specific nodes to run on. Tornjak currently supports amd64 and arm64 architectures
|
||||
nodeSelector: {}
|
||||
|
||||
## @param affinity [object] Affinity rules
|
||||
affinity: {}
|
||||
@@ -86,7 +84,7 @@ topologySpreadConstraints: []
|
||||
# cpu: 100m
|
||||
# memory: 512Mi
|
||||
|
||||
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted.
|
||||
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If not provided, auto-detection is attempted.
|
||||
apiServerURL: ""
|
||||
|
||||
# SPIRE Healthchecker indicator
|
||||
@@ -94,6 +92,13 @@ spireHealthCheck:
|
||||
## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator
|
||||
enabled: true
|
||||
|
||||
# User Management
|
||||
auth:
|
||||
## @param auth.enabled Enables auth for Tornjak
|
||||
enabled: false
|
||||
## @param auth.serverURL URL of the Auth service. Tornjak Frontend will redirect to this URL to authenticate the user
|
||||
serverURL: ""
|
||||
|
||||
## Configure extra options for Tornjak frontend container's startup probe
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
|
||||
## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container
|
||||
@@ -114,9 +119,12 @@ startupProbe:
|
||||
## @param workingDir Set to override the default path containing the Tornjak frontend within the image
|
||||
workingDir: ""
|
||||
|
||||
## @param logsDir Directory path for NPM logs
|
||||
logsDir: "/home/node/"
|
||||
|
||||
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
|
||||
## @param ingress.className Ingress class name for Tornjak frontend service
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
||||
ingress:
|
||||
enabled: false
|
||||
@@ -130,14 +138,14 @@ ingress:
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: tornjak-frontend.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
|
||||
Reference in New Issue
Block a user