diff --git a/passbolt/passbolt-app.yaml b/passbolt/passbolt-app.yaml new file mode 100644 index 0000000..3c95581 --- /dev/null +++ b/passbolt/passbolt-app.yaml @@ -0,0 +1,26 @@ +apiVersion: argoproj.io/v1alpha +kind: Application +metadata: passbolt-application +namespace: argocd +spec: + project: default + sources: + - repoURL: 'https://download.passbolt.com/charts/passbolt' + chart: passbolt + targetRevision: '2.1.0' + helm: + valueFiles: + - values.yaml + - repoURL: git@192.168.0.29:caelebfi/local.realm.passbolt.git + targetRevision: HEAD + ref: values + destination: + server: https://kubernetes.default.svc + namespace: passbolt + syncPolicy: + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + automated: + selfHeal: true + prune: true diff --git a/passbolt/passbolt.yaml b/passbolt/passbolt.yaml new file mode 100644 index 0000000..a6dcde3 --- /dev/null +++ b/passbolt/passbolt.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: passbolt + namespace: argocd +spec: + project: default + source: + chart: passbolt + repoURL: https://download.passbolt.com/charts/passbolt + targetRevision: 2.1.0 # Wählen Sie eine stabile Version + helm: + valueFiles: + - values.yaml # Falls Sie die Datei in einem Git-Repo liegen haben + destination: + server: https://kubernetes.default.svc + namespace: passbolt + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/passbolt/values.yaml b/passbolt/values.yaml index 9c8164c..be23d08 100644 --- a/passbolt/values.yaml +++ b/passbolt/values.yaml @@ -1,470 +1,28 @@ -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -## Dependencies configuration parameters - -## Redis dependency parameters - -# -- Install redis as a depending chart -redisDependencyEnabled: true -# -- Install mariadb as a depending chart -mariadbDependencyEnabled: true -# -- Install postgresql as a depending chart -postgresqlDependencyEnabled: false - -# Configure postgresql as a dependency chart -# postgresql: -# global: -# security: -# # -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850 -# allowInsecureImages: true -# image: -# # -- Pin PostgreSQL image to bitnamilegacy image repository. -# repository: bitnamilegacy/postgresql -# auth: -# # -- Configure postgresql auth username -# username: CHANGEME -# # -- Configure postgresql auth password -# password: CHANGEME -# # -- Configure postgresql auth database -# database: passbolt - -global: - imageRegistry: "" - imagePullSecrets: [] - -# Configure redis dependency chart -redis: - global: - security: - # -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850 - allowInsecureImages: true - image: - # -- Pin redis image to bitnamilegacy image repository. - repository: bitnamilegacy/redis - auth: - # -- Enable redis authentication - enabled: true - # -- Configure redis password - password: "CHANGEME" - sentinel: - image: - # -- Pin redis-sentinel image to bitnamilegacy image repository. - repository: bitnamilegacy/redis-sentinel - # -- Enable redis sentinel - enabled: true - -## MariaDB dependency parameters - -# Configure mariadb as a dependency chart -mariadb: - global: - security: - # -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850 - allowInsecureImages: true - image: - # -- Pin redis image to bitnamilegacy image repository. - repository: bitnamilegacy/mariadb - # -- Configure mariadb architecture - architecture: replication - auth: - # -- Configure mariadb auth root password - rootPassword: root - # -- Configure mariadb auth username - username: pbadmin - # -- Configure mariadb auth password - password: DW"C_/9jTTkMjwj<'% - # -- Configure mariadb auth database - database: passboltdb - # -- Configure mariadb auth replicationPassword - replicationPassword: w(*4Ewj:m`K/Ai^/qb - # -- Configure parameters for the primary instance. - primary: - # -- Configure persistence options. - persistence: - # -- Enable persistence on MariaDB primary replicas using a `PersistentVolumeClaim`. If false, use emptyDir - enabled: true - # -- Name of an existing `PersistentVolumeClaim` for MariaDB primary replicas. When it's set the rest of persistence parameters are ignored. - existingClaim: "" - # -- Subdirectory of the volume to mount at - subPath: "" - # -- Primary persistent volume storage Class - storageClass: "" - # -- Labels for the PVC - labels: {} - # -- Primary persistent volume claim annotations - annotations: {} - # -- Primary persistent volume access Modes - accessModes: - - ReadWriteOnce - # -- Primary persistent volume size - size: 8Gi - # -- Selector to match an existing Persistent Volume - selector: {} - # -- Configure parameters for the secondary instance. - secondary: - # -- Configure persistence options. - persistence: - # -- Enable persistence on MariaDB secondary replicas using a `PersistentVolumeClaim`. If false, use emptyDir - enabled: true - # -- Subdirectory of the volume to mount at - subPath: "" - # -- Secondary persistent volume storage Class - storageClass: "" - # -- Labels for the PVC - labels: {} - # -- Secondary persistent volume claim annotations - annotations: {} - # -- Secondary persistent volume access Modes - accessModes: - - ReadWriteOnce - # -- Secondary persistent volume size - size: 8Gi - # -- Selector to match an existing Persistent Volume - selector: {} - -## Passbolt configuration - -## Passbolt container and sidecar parameters -app: - # -- Configure pasbolt deployment init container that waits for database - databaseInitContainer: - # -- Toggle pasbolt deployment init container that waits for database - enabled: true - # initImage: - # # -- Configure pasbolt deployment init container image client for database - # client: mariadb - # registry: "" - # # -- Configure pasbolt deployment image repsitory - # repository: mariadb - # # -- Configure pasbolt deployment image pullPolicy - # pullPolicy: IfNotPresent - # # -- Overrides the image tag whose default is the chart appVersion. - # tag: latest - image: - # -- Configure pasbolt deployment image repsitory - registry: "" - repository: passbolt/passbolt - # -- Configure pasbolt deployment image pullPolicy - pullPolicy: IfNotPresent - # -- Overrides the image tag whose default is the chart appVersion. - tag: 5.9.0-1-ce - # Allowed options: mariadb, mysql or postgresql - database: - kind: mariadb - # -- Configure ssl on mariadb/mysql clients - # -- In case this is enabled, you will be responsible for creating and mounting the certificates and - # -- additional configutions on both the client and the server. - # ssl: off - cache: - # Use CACHE_CAKE_DEFAULT_* variables to configure the connection to redis instance - # on the passboltEnv configuration section - redis: - # -- By enabling redis the chart will mount a configuration file on /etc/passbolt/app.php - # That instructs passbolt to store sessions on redis and to use it as a general cache. - enabled: true - sentinelProxy: - # -- Inject a haproxy sidecar container configured as a proxy to redis sentinel - # Make sure that CACHE_CAKE_DEFAULT_SERVER is set to '127.0.0.1' to use the proxy - enabled: true - # -- Configure redis sentinel proxy image - image: - registry: "" - # -- Configure redis sentinel image repository - repository: haproxy - # -- Configure redis sentinel image tag - tag: "latest" - # -- Configure redis sentinel container resources - resources: {} - # -- Configure the passbolt deployment resources - extraPodLabels: {} - resources: {} - tls: - # -- If autogenerate is true, the chart will generate a secret with a certificate for APP_FULL_BASE_URL hostname - # -- if autogenerate is false, existingSecret should be filled with an existing tls kind secret name - # @ignored - autogenerate: true - # existingSecret: "" - # -- Configure additional containers to be added to the pod - extraContainers: [] - -# -- Enable email cron -cronJobEmail: - enabled: true - schedule: "* * * * *" - extraPodLabels: {} - -## Passbolt environment parameters - -# -- Pro subscription key in base64 only if you are using pro version -# subscriptionKey: -# -- Configure passbolt subscription key path -# subscription_keyPath: /etc/passbolt/subscription_key.txt - -# -- Configure passbolt gpg directory -gpgPath: /etc/passbolt/gpg -# -- Gpg server private key in base64 -gpgServerKeyPrivate: "" -# -- Gpg server public key in base64 -gpgServerKeyPublic: "" -# -- Name of the existing secret for the GPG server keypair. The secret must contain the `serverkey.asc` and `serverkey_private.asc` keys. -gpgExistingSecret: "" - -# -- Name of the existing secret for the JWT server keypair. The secret must contain the `jwt.key` and `jwt.pem` keys. -jwtExistingSecret: "" -# -- Configure passbolt jwt directory -jwtPath: /etc/passbolt/jwt -# -- JWT server private key in base64 -jwtServerPrivate: "" -# -- JWT server public key in base64 -jwtServerPublic: "" -# -- Forces overwrite JWT keys -jwtCreateKeysForced: false -jobCreateJwtKeys: - extraPodLabels: {} - -jobCreateGpgKeys: - extraPodLabels: {} - +# Beispielhafte Minimal-Konfiguration passboltEnv: plain: - - # -- Configure passbolt privacy url - PASSBOLT_LEGAL_PRIVACYPOLICYURL: https://www.passbolt.com/privacy - # -- Configure passbolt fullBaseUrl - APP_FULL_BASE_URL: https://passbolt.realm.local - # -- Configure passbolt to force ssl - PASSBOLT_SSL_FORCE: true - # -- Toggle passbolt public registration - PASSBOLT_REGISTRATION_PUBLIC: true - # -- Configure passbolt cake cache server - CACHE_DEFAULT_HOST: 127.0.0.1 - # -- Configure passbolt cake core cache server - CACHE_CAKECORE_HOST: 127.0.0.1 - # -- Configure passbolt cake model cache server - CACHE_CAKEMODEL_HOST: 127.0.0.1 - # -- Configure passbolt cake cache server port - CACHE_DEFAULT_PORT: 6379 - # -- Configure passbolt cake core cache server port - CACHE_CAKECORE_PORT: 6379 - # -- Configure passbolt cake model cache server port - CACHE_CAKEMODEL_PORT: 6379 - # -- Configure passbolt cake session storage, either php, cake, database or cache - SESSION_DEFAULTS: cache - # -- Configure passbolt cake cache class - CACHE_DEFAULT_CLASSNAME: Redis - # -- Configure passbolt cake model cache class - CACHE_CAKEMODEL_CLASSNAME: Redis - # -- Configure passbolt cake core cache class - CACHE_CAKECORE_CLASSNAME: Redis - # -- Configure passbolt default email service port - EMAIL_TRANSPORT_DEFAULT_PORT: 587 - # -- Toggle passbolt debug mode - DEBUG: false - # -- Configure email used on gpg key. This is used when automatically creating a new gpg server key and when automatically calculating the fingerprint. - PASSBOLT_KEY_EMAIL: passbolt@solusar.de - # -- Toggle passbolt selenium mode - PASSBOLT_SELENIUM_ACTIVE: false - # -- Configure passbolt license path - PASSBOLT_PLUGINS_LICENSE_LICENSE: /etc/passbolt/subscription_key.txt - # -- Configure passbolt default email from - EMAIL_DEFAULT_FROM: no-reply@passbolt.realm.local - # -- Configure passbolt default email from name - EMAIL_DEFAULT_FROM_NAME: Passbolt - # -- Configure passbolt default email host - EMAIL_TRANSPORT_DEFAULT_HOST: 127.0.0.1 - # -- Configure passbolt default email timeout - EMAIL_TRANSPORT_DEFAULT_TIMEOUT: 30 - # -- Toggle passbolt tls - EMAIL_TRANSPORT_DEFAULT_TLS: true - # -- Configure passbolt jwt private key path - PASSBOLT_JWT_SERVER_KEY: /var/www/passbolt/config/jwt/jwt.key - # -- Configure passbolt jwt public key path - PASSBOLT_JWT_SERVER_PEM: /var/www/passbolt/config/jwt/jwt.pem - # -- Toggle passbolt jwt authentication - PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED: true - # -- Download Command for kubectl - KUBECTL_DOWNLOAD_CMD: "" - # -- Set to false to supress warnings when running passbolt commands as non webserver user, mainly for Openshift - PASSBOLT_SECURITY_DISPLAY_NON_WEBUSER_WARNING: true + APP_FULL_BASE_URL: "https://passbolt.realm.local" + DATASOURCES_DEFAULT_DRIVER: "Cake\Database\Driver\Postgres" secret: - # -- Configure passbolt cake cache password - CACHE_DEFAULT_PASSWORD: ={K=X=6UcS~s^Pa,a, - # -- Configure passbolt cake core cache password - CACHE_CAKECORE_PASSWORD: U!L9Ue%"`_-+{.u"vQ - # -- Configure passbolt cake model cache password - CACHE_CAKEMODEL_PASSWORD: V!K'_6}Q\%PSufj$eV - # -- Configure passbolt default database password - DATASOURCES_DEFAULT_PASSWORD: DW"C_/9jTTkMjwj<'% - # -- Configure passbolt default database username - DATASOURCES_DEFAULT_USERNAME: pbadmin - # -- Configure passbolt default database - DATASOURCES_DEFAULT_DATABASE: passboltdb - # -- Configure passbolt default email service username - EMAIL_TRANSPORT_DEFAULT_USERNAME: admin@solusar.de - # -- Configure passbolt default email service password - EMAIL_TRANSPORT_DEFAULT_PASSWORD: #gentoo# - # -- Configure passbolt server gpg key fingerprint - # PASSBOLT_GPG_SERVER_KEY_FINGERPRINT: - # -- Configure passbolt security salt. - # SECURITY_SALT: - # -- Environment variables to add to the passbolt pods - extraEnv: [] - # -- Environment variables from secrets or configmaps to add to the passbolt pods - extraEnvFrom: - [] - # - secretRef: - # name: passbolt-secret - ## Overrides the plain value in the case of not wanting to provide the config from values - ## Do this ONLY if you know what you are doing - configMapName: "" - ## Overrides the secrets value in the case of not wanting to provide them in the values file. - ## Do this ONLY if you know what you are doing - secretName: "" -## Passbolt deployment parameters + # Passwörter sollten idealerweise über Kubernetes Secrets eingebunden werden + DATASOURCES_DEFAULT_PASSWORD: + secretName: passbolt-db-secret + secretKey: rwr5FJ92HbtEapMs# -# -- If autoscaling is disabled this will define the number of pods to run -replicaCount: 2 +mariadb: + enabled: false # Installiert MariaDB automatisch mit -# Configure autoscaling on passbolt deployment -autoscaling: - # -- Enable autoscaling on passbolt deployment - enabled: false - # -- Configure autoscaling minimum replicas - minReplicas: 1 - # -- Configure autoscaling maximum replicas - maxReplicas: 100 - # -- Configure autoscaling target CPU uptilization percentage - targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 - -# -- Enable role based access control -rbacEnabled: true - -# -- Configure passbolt container livenessProbe -livenessProbe: - # @ignore - httpGet: - port: https - scheme: HTTPS - path: /healthcheck/status.json - httpHeaders: - - name: Host - value: passbolt.realm.local - initialDelaySeconds: 20 - periodSeconds: 10 -# -- Configure passbolt container RadinessProbe -readinessProbe: - # @ignore - httpGet: - port: https - scheme: HTTPS - httpHeaders: - - name: Host - value: passbolt.realm.local - path: /healthcheck/status.json - initialDelaySeconds: 5 - periodSeconds: 10 - -# Configure network policies to allow ingress access passbolt pods -# networkPolicy defines which labels are allowed to reach to passbolt -# and which namespaces -networkPolicy: - # -- Enable network policies to allow ingress access passbolt pods - enabled: false - # -- Configure network policies label for ingress deployment - label: app.kubernetes.io/name - # -- Configure network policies podLabel for podSelector - podLabel: ingress-nginx - # -- Configure network policies namespaceLabel for namespaceSelector - namespaceLabel: ingress-nginx - -# -- Configure image pull secrets -imagePullSecrets: [] -# -- Value to override the chart name on default -nameOverride: "" -# -- Value to override the whole fullName -fullnameOverride: "" - -serviceAccount: - # -- Specifies whether a service account should be created - create: true - # -- Annotations to add to the service account - annotations: {} - -# -- Map of annotation for passbolt server pod -podAnnotations: {} - -# -- Security Context configuration for passbolt server pod -podSecurityContext: - {} - # fsGroup: 2000 - -service: - # -- Configure passbolt service type - type: LoadBalancer - # -- Annotations to add to the service - annotations: {} - # -- Configure the service ports - ports: - # -- Configure the HTTPS port - https: - # -- Configure passbolt HTTPS service port - port: 443 - # -- Configure passbolt HTTPS service targetPort - targetPort: 443 - # -- Configure passbolt HTTPS service port name - name: https - http: - # -- Configure passbolt HTTP service port - port: 80 - # -- Configure passbolt HTTP service targetPort - targetPort: 80 - # -- Configure passbolt HTTP service port name - name: http - # -- Preference for routing traffic to endpoints that are in the same zone as the client - # trafficDistribution: "PreferSameZone" +postgresql: + enabled: true + auth: + database: passboltdb + username: pbadmin + password: rwr5FJ92HbtEapMs# +# Ingress konfigurieren, um Passbolt von außen erreichbar zu machen ingress: - # -- Enable passbolt ingress - enabled: false - # -- Configure passbolt ingress annotations - annotations: {} - # -- Configure passbolt ingress class name - # className: "nginx-example" - # -- Configure passbolt ingress hosts + enabled: true hosts: - # @ignored - host: passbolt.realm.local paths: - path: / - port: https - pathType: ImplementationSpecific - # -- Configure passbolt ingress tls - tls: - # If autogenerate is true, the chart will generate a secret for the given hosts - # if autogenerate is false, existingSecret should be filled with an existing tls kind secret name - # @ignored - - autogenerate: true - # existingSecret: "" - hosts: - - passbolt.realm.local -# -- Configure passbolt deployment nodeSelector -nodeSelector: {} - -# -- Configure passbolt deployment tolerations -tolerations: [] - -# -- Configure passbolt deployment affinity -affinity: {} - -# -- Add additional volumes, e.g. for overwriting config files -extraVolumes: [] - -# -- Add additional volume mounts, e.g. for overwriting config files -extraVolumeMounts: [] - -# Toggle to true if deploying on Openshift -# Removes security context specifying UID from the email cronjob -# Adds a route to use -Openshift: false diff --git a/passbolt/values.yaml_full b/passbolt/values.yaml_full new file mode 100644 index 0000000..b4da734 --- /dev/null +++ b/passbolt/values.yaml_full @@ -0,0 +1,470 @@ +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +## Dependencies configuration parameters + +## Redis dependency parameters + +# -- Install redis as a depending chart +redisDependencyEnabled: true +# -- Install mariadb as a depending chart +mariadbDependencyEnabled: true +# -- Install postgresql as a depending chart +postgresqlDependencyEnabled: false + +# Configure postgresql as a dependency chart +postgresql: + global: + security: + # -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850 + allowInsecureImages: true + image: + # -- Pin PostgreSQL image to bitnamilegacy image repository. + repository: bitnamilegacy/postgresql + auth: + # -- Configure postgresql auth username + username: pbadmin + # -- Configure postgresql auth password + password: DW"C_/9jTTkMjwj<'% + # -- Configure postgresql auth database + database: passboltdb + +global: + imageRegistry: "" + imagePullSecrets: [] + +# Configure redis dependency chart +redis: + global: + security: + # -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850 + allowInsecureImages: true + image: + # -- Pin redis image to bitnamilegacy image repository. + repository: bitnamilegacy/redis + auth: + # -- Enable redis authentication + enabled: true + # -- Configure redis password + password: "CHANGEME" + sentinel: + image: + # -- Pin redis-sentinel image to bitnamilegacy image repository. + repository: bitnamilegacy/redis-sentinel + # -- Enable redis sentinel + enabled: true + +## MariaDB dependency parameters + +# Configure mariadb as a dependency chart +#mariadb: +# global: +# security: +# # -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850 +# allowInsecureImages: true +# image: +# # -- Pin redis image to bitnamilegacy image repository. +# repository: bitnamilegacy/mariadb +# # -- Configure mariadb architecture +# architecture: replication +# auth: +# # -- Configure mariadb auth root password +# rootPassword: root +# # -- Configure mariadb auth username +# username: pbadmin +# # -- Configure mariadb auth password +# password: DW"C_/9jTTkMjwj<'% +# # -- Configure mariadb auth database +# database: passboltdb +# # -- Configure mariadb auth replicationPassword +# replicationPassword: w(*4Ewj:m`K/Ai^/qb +# # -- Configure parameters for the primary instance. +# primary: +# # -- Configure persistence options. +# persistence: +# # -- Enable persistence on MariaDB primary replicas using a `PersistentVolumeClaim`. If false, use emptyDir +# enabled: true +# # -- Name of an existing `PersistentVolumeClaim` for MariaDB primary replicas. When it's set the rest of persistence parameters are ignored. +# existingClaim: "" +# # -- Subdirectory of the volume to mount at +# subPath: "" +# # -- Primary persistent volume storage Class +# storageClass: "" +# # -- Labels for the PVC +# labels: {} +# # -- Primary persistent volume claim annotations +# annotations: {} +# # -- Primary persistent volume access Modes +# accessModes: +# - ReadWriteOnce +# # -- Primary persistent volume size +# size: 8Gi +# # -- Selector to match an existing Persistent Volume +# selector: {} +# # -- Configure parameters for the secondary instance. +# secondary: +# # -- Configure persistence options. +# persistence: +# # -- Enable persistence on MariaDB secondary replicas using a `PersistentVolumeClaim`. If false, use emptyDir +# enabled: true +# # -- Subdirectory of the volume to mount at +# subPath: "" +# # -- Secondary persistent volume storage Class +# storageClass: "" +# # -- Labels for the PVC +# labels: {} +# # -- Secondary persistent volume claim annotations +# annotations: {} +# # -- Secondary persistent volume access Modes +# accessModes: +# - ReadWriteOnce +# # -- Secondary persistent volume size +# size: 8Gi +# # -- Selector to match an existing Persistent Volume +# selector: {} + +## Passbolt configuration + +## Passbolt container and sidecar parameters +app: + # -- Configure pasbolt deployment init container that waits for database + databaseInitContainer: + # -- Toggle pasbolt deployment init container that waits for database + enabled: true + # initImage: + # # -- Configure pasbolt deployment init container image client for database + # client: mariadb + # registry: "" + # # -- Configure pasbolt deployment image repsitory + # repository: mariadb + # # -- Configure pasbolt deployment image pullPolicy + # pullPolicy: IfNotPresent + # # -- Overrides the image tag whose default is the chart appVersion. + # tag: latest + image: + # -- Configure pasbolt deployment image repsitory + registry: "" + repository: passbolt/passbolt + # -- Configure pasbolt deployment image pullPolicy + pullPolicy: IfNotPresent + # -- Overrides the image tag whose default is the chart appVersion. + tag: 5.9.0-1-ce + # Allowed options: mariadb, mysql or postgresql + database: + kind: postgresql + # -- Configure ssl on mariadb/mysql clients + # -- In case this is enabled, you will be responsible for creating and mounting the certificates and + # -- additional configutions on both the client and the server. + # ssl: off + cache: + # Use CACHE_CAKE_DEFAULT_* variables to configure the connection to redis instance + # on the passboltEnv configuration section + redis: + # -- By enabling redis the chart will mount a configuration file on /etc/passbolt/app.php + # That instructs passbolt to store sessions on redis and to use it as a general cache. + enabled: true + sentinelProxy: + # -- Inject a haproxy sidecar container configured as a proxy to redis sentinel + # Make sure that CACHE_CAKE_DEFAULT_SERVER is set to '127.0.0.1' to use the proxy + enabled: true + # -- Configure redis sentinel proxy image + image: + registry: "" + # -- Configure redis sentinel image repository + repository: haproxy + # -- Configure redis sentinel image tag + tag: "latest" + # -- Configure redis sentinel container resources + resources: {} + # -- Configure the passbolt deployment resources + extraPodLabels: {} + resources: {} + tls: + # -- If autogenerate is true, the chart will generate a secret with a certificate for APP_FULL_BASE_URL hostname + # -- if autogenerate is false, existingSecret should be filled with an existing tls kind secret name + # @ignored + autogenerate: true + # existingSecret: "" + # -- Configure additional containers to be added to the pod + extraContainers: [] + +# -- Enable email cron +cronJobEmail: + enabled: true + schedule: "* * * * *" + extraPodLabels: {} + +## Passbolt environment parameters + +# -- Pro subscription key in base64 only if you are using pro version +# subscriptionKey: +# -- Configure passbolt subscription key path +# subscription_keyPath: /etc/passbolt/subscription_key.txt + +# -- Configure passbolt gpg directory +gpgPath: /etc/passbolt/gpg +# -- Gpg server private key in base64 +gpgServerKeyPrivate: "" +# -- Gpg server public key in base64 +gpgServerKeyPublic: "" +# -- Name of the existing secret for the GPG server keypair. The secret must contain the `serverkey.asc` and `serverkey_private.asc` keys. +gpgExistingSecret: "" + +# -- Name of the existing secret for the JWT server keypair. The secret must contain the `jwt.key` and `jwt.pem` keys. +jwtExistingSecret: "" +# -- Configure passbolt jwt directory +jwtPath: /etc/passbolt/jwt +# -- JWT server private key in base64 +jwtServerPrivate: "" +# -- JWT server public key in base64 +jwtServerPublic: "" +# -- Forces overwrite JWT keys +jwtCreateKeysForced: false +jobCreateJwtKeys: + extraPodLabels: {} + +jobCreateGpgKeys: + extraPodLabels: {} + +passboltEnv: + plain: + + # -- Configure passbolt privacy url + PASSBOLT_LEGAL_PRIVACYPOLICYURL: https://www.passbolt.com/privacy + # -- Configure passbolt fullBaseUrl + APP_FULL_BASE_URL: https://passbolt.realm.local + # -- Configure passbolt to force ssl + PASSBOLT_SSL_FORCE: true + # -- Toggle passbolt public registration + PASSBOLT_REGISTRATION_PUBLIC: true + # -- Configure passbolt cake cache server + CACHE_DEFAULT_HOST: 127.0.0.1 + # -- Configure passbolt cake core cache server + CACHE_CAKECORE_HOST: 127.0.0.1 + # -- Configure passbolt cake model cache server + CACHE_CAKEMODEL_HOST: 127.0.0.1 + # -- Configure passbolt cake cache server port + CACHE_DEFAULT_PORT: 6379 + # -- Configure passbolt cake core cache server port + CACHE_CAKECORE_PORT: 6379 + # -- Configure passbolt cake model cache server port + CACHE_CAKEMODEL_PORT: 6379 + # -- Configure passbolt cake session storage, either php, cake, database or cache + SESSION_DEFAULTS: cache + # -- Configure passbolt cake cache class + CACHE_DEFAULT_CLASSNAME: Redis + # -- Configure passbolt cake model cache class + CACHE_CAKEMODEL_CLASSNAME: Redis + # -- Configure passbolt cake core cache class + CACHE_CAKECORE_CLASSNAME: Redis + # -- Configure passbolt default email service port + EMAIL_TRANSPORT_DEFAULT_PORT: 587 + # -- Toggle passbolt debug mode + DEBUG: false + # -- Configure email used on gpg key. This is used when automatically creating a new gpg server key and when automatically calculating the fingerprint. + PASSBOLT_KEY_EMAIL: passbolt@solusar.de + # -- Toggle passbolt selenium mode + PASSBOLT_SELENIUM_ACTIVE: false + # -- Configure passbolt license path + PASSBOLT_PLUGINS_LICENSE_LICENSE: /etc/passbolt/subscription_key.txt + # -- Configure passbolt default email from + EMAIL_DEFAULT_FROM: no-reply@solusar.de + # -- Configure passbolt default email from name + EMAIL_DEFAULT_FROM_NAME: Passbolt + # -- Configure passbolt default email host + EMAIL_TRANSPORT_DEFAULT_HOST: 127.0.0.1 + # -- Configure passbolt default email timeout + EMAIL_TRANSPORT_DEFAULT_TIMEOUT: 30 + # -- Toggle passbolt tls + EMAIL_TRANSPORT_DEFAULT_TLS: true + # -- Configure passbolt jwt private key path + PASSBOLT_JWT_SERVER_KEY: /var/www/passbolt/config/jwt/jwt.key + # -- Configure passbolt jwt public key path + PASSBOLT_JWT_SERVER_PEM: /var/www/passbolt/config/jwt/jwt.pem + # -- Toggle passbolt jwt authentication + PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED: true + # -- Download Command for kubectl + KUBECTL_DOWNLOAD_CMD: "" + # -- Set to false to supress warnings when running passbolt commands as non webserver user, mainly for Openshift + PASSBOLT_SECURITY_DISPLAY_NON_WEBUSER_WARNING: true + secret: + # -- Configure passbolt cake cache password + CACHE_DEFAULT_PASSWORD: ={K=X=6UcS~s^Pa,a, + # -- Configure passbolt cake core cache password + CACHE_CAKECORE_PASSWORD: U!L9Ue%"`_-+{.u"vQ + # -- Configure passbolt cake model cache password + CACHE_CAKEMODEL_PASSWORD: V!K'_6}Q\%PSufj$eV + # -- Configure passbolt default database password + DATASOURCES_DEFAULT_PASSWORD: DW"C_/9jTTkMjwj<'% + # -- Configure passbolt default database username + DATASOURCES_DEFAULT_USERNAME: pbadmin + # -- Configure passbolt default database + DATASOURCES_DEFAULT_DATABASE: passboltdb + # -- Configure passbolt default email service username + EMAIL_TRANSPORT_DEFAULT_USERNAME: admin@solusar.de + # -- Configure passbolt default email service password + EMAIL_TRANSPORT_DEFAULT_PASSWORD: #gentoo# + # -- Configure passbolt server gpg key fingerprint + # PASSBOLT_GPG_SERVER_KEY_FINGERPRINT: + # -- Configure passbolt security salt. + # SECURITY_SALT: + # -- Environment variables to add to the passbolt pods + extraEnv: [] + # -- Environment variables from secrets or configmaps to add to the passbolt pods + extraEnvFrom: + [] + # - secretRef: + # name: passbolt-secret + ## Overrides the plain value in the case of not wanting to provide the config from values + ## Do this ONLY if you know what you are doing + configMapName: "" + ## Overrides the secrets value in the case of not wanting to provide them in the values file. + ## Do this ONLY if you know what you are doing + secretName: "" +## Passbolt deployment parameters + +# -- If autoscaling is disabled this will define the number of pods to run +replicaCount: 2 + +# Configure autoscaling on passbolt deployment +autoscaling: + # -- Enable autoscaling on passbolt deployment + enabled: false + # -- Configure autoscaling minimum replicas + minReplicas: 1 + # -- Configure autoscaling maximum replicas + maxReplicas: 100 + # -- Configure autoscaling target CPU uptilization percentage + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +# -- Enable role based access control +rbacEnabled: true + +# -- Configure passbolt container livenessProbe +livenessProbe: + # @ignore + httpGet: + port: https + scheme: HTTPS + path: /healthcheck/status.json + httpHeaders: + - name: Host + value: passbolt.realm.local + initialDelaySeconds: 20 + periodSeconds: 10 +# -- Configure passbolt container RadinessProbe +readinessProbe: + # @ignore + httpGet: + port: https + scheme: HTTPS + httpHeaders: + - name: Host + value: passbolt.realm.local + path: /healthcheck/status.json + initialDelaySeconds: 5 + periodSeconds: 10 + +# Configure network policies to allow ingress access passbolt pods +# networkPolicy defines which labels are allowed to reach to passbolt +# and which namespaces +networkPolicy: + # -- Enable network policies to allow ingress access passbolt pods + enabled: false + # -- Configure network policies label for ingress deployment + label: app.kubernetes.io/name + # -- Configure network policies podLabel for podSelector + podLabel: ingress-nginx + # -- Configure network policies namespaceLabel for namespaceSelector + namespaceLabel: ingress-nginx + +# -- Configure image pull secrets +imagePullSecrets: [] +# -- Value to override the chart name on default +nameOverride: "" +# -- Value to override the whole fullName +fullnameOverride: "" + +serviceAccount: + # -- Specifies whether a service account should be created + create: true + # -- Annotations to add to the service account + annotations: {} + +# -- Map of annotation for passbolt server pod +podAnnotations: {} + +# -- Security Context configuration for passbolt server pod +podSecurityContext: + {} + # fsGroup: 2000 + +service: + # -- Configure passbolt service type + type: LoadBalancer + # -- Annotations to add to the service + annotations: {} + # -- Configure the service ports + ports: + # -- Configure the HTTPS port + https: + # -- Configure passbolt HTTPS service port + port: 443 + # -- Configure passbolt HTTPS service targetPort + targetPort: 443 + # -- Configure passbolt HTTPS service port name + name: https + http: + # -- Configure passbolt HTTP service port + port: 80 + # -- Configure passbolt HTTP service targetPort + targetPort: 80 + # -- Configure passbolt HTTP service port name + name: http + # -- Preference for routing traffic to endpoints that are in the same zone as the client + # trafficDistribution: "PreferSameZone" + +ingress: + # -- Enable passbolt ingress + enabled: false + # -- Configure passbolt ingress annotations + annotations: {} + # -- Configure passbolt ingress class name + # className: "nginx-example" + # -- Configure passbolt ingress hosts + hosts: + # @ignored + - host: passbolt.realm.local + paths: + - path: / + port: https + pathType: ImplementationSpecific + # -- Configure passbolt ingress tls + tls: + # If autogenerate is true, the chart will generate a secret for the given hosts + # if autogenerate is false, existingSecret should be filled with an existing tls kind secret name + # @ignored + - autogenerate: true + # existingSecret: "" + hosts: + - passbolt.realm.local +# -- Configure passbolt deployment nodeSelector +nodeSelector: {} + +# -- Configure passbolt deployment tolerations +tolerations: [] + +# -- Configure passbolt deployment affinity +affinity: {} + +# -- Add additional volumes, e.g. for overwriting config files +extraVolumes: [] + +# -- Add additional volume mounts, e.g. for overwriting config files +extraVolumeMounts: [] + +# Toggle to true if deploying on Openshift +# Removes security context specifying UID from the email cronjob +# Adds a route to use +Openshift: false