-
Notifications
You must be signed in to change notification settings - Fork 7
/
athenz-sia.env
251 lines (251 loc) · 8.85 KB
/
athenz-sia.env
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
#######################################################################################
# Guidelines for managing the env file here:
# - If a default value is present, it must be provided with the URL where the default value is set
# - Follow the order of env variables as listed on https://github.com/AthenZ/k8s-athenz-sia/blob/main/pkg/config/config.go
#######################################################################################
#
# Booting mode of SIA
# must be one of "init" or "refresh"
# "init": SIA will exit after a single credential retrieval
# "refresh": SIA will run as a continuous process to retrieve credentials periodically and also runs as an HTTP server to provide credentials and metrics
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L114
#
MODE=init
#
# Athenz ZTS URL for SIA to request for X.509 certificate
# https://<ZTS HOST>:<ZTS PORT>/zts/v1 (e.g. "https://www.athenz.io:4443/zts/v1")
#
ENDPOINT=
#
# Athenz Service name for the cloud provider
# <Athenz Domain>.<Athenz Service> (e.g. "cloud-provider-top-level-domain.cluster-name.identityd-service")
#
PROVIDER_SERVICE=
#
# Suffix restriction for SANs(Subject Alternative Names) DNS field in X.509 certificate
# Subject Alternative Names:
# "DNS: <any name>.<Provider DNS Suffix>"
# "DNS: <Instance ID>.instanceid.athenz.<Provider DNS Suffix>"
# Note: <Provider DNS Suffix> must meat the suffix registered in Athenz (e.g. ".athenz.cloud")
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L42
#
DNS_SUFFIX=athenz.cloud
#
# Refresh interval for SIA to request to ZTS periodically in containers to get X.509 identity certificate
# Note: This only applies for refresh mode
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L115
#
REFRESH_INTERVAL=24h
#
# Delay interval for SIA to boot
# This may be useful when you want to prevent large number of SIA to make requests to ZTS concurrently in a short period
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L116
#
DELAY_JITTER_SECONDS=0
#
# File path to store X.509 certificate key file (e.g. /var/run/athenz/tls.key)
#
KEY_FILE=
#
# File path to store X.509 certificate file (e.g. /var/run/athenz/tls.crt)
#
CERT_FILE=
#
# File path to store X.509 ca certificate file that can verify CERT_FILE (e.g. /var/run/athenz/ca.crt)
#
CA_CERT_FILE=
#
# CertificateAuthorityBundle name to retrieve intermediate certificate
#
INTERMEDIATE_CERT_BUNDLE=
#
# Mode to store/load backup of X.509 certificate to/from Kubernetes Secret
# If write is specified, sia must be run uniquely per each secret to prevent conflict
# "": backup disabled
# "read": read backup from kubernetes secret
# "write": write backup into kubernetes secret
# "read+write": read & write backup from/into kubernetes secret
#
BACKUP=
#
# Kubernetes TLS Secret to backup and load X.509 certificate files
#
CERT_SECRET=
#
# Cloud users Athenz Domain to map to SIA
#
# if <ATHENZ_DOMAIN> is not "", Athenz Domain would be:
# "<ATHENZ_PREFIX><ATHENZ_DOMAIN><ATHENZ_SUFFIX>"
# <ATHENZ_PREFIX> must end with "."
# <ATHENZ_SUFFIX> must start with "."
# Example:
# ATHENZ_PREFIX="some-tld.foo."
# ATHENZ_DOMAIN="cluster-bar"
# ATHENZ_SUFFIX=".baz"
#
# if <ATHENZ_DOMAIN> is "", Athenz Domain would be:
# "<ATHENZ_PREFIX><NAMESPACE><ATHENZ_SUFFIX>"
# <NAMESPACE> is Kubernetes Namespace set by default
# <ATHENZ_PREFIX> must end with "."
# <ATHENZ_SUFFIX> must start with "."
# Example:
# ATHENZ_PREFIX="some-tld.foo."
# NAMESPACE="namespace-bar"
# ATHENZ_SUFFIX=".baz"
#
# NAMESPACE may be extracted from metadata.namespace in Kubernetes manifests
#
NAMESPACE=
ATHENZ_DOMAIN=
ATHENZ_PREFIX=
ATHENZ_SUFFIX=
#
# Kubernetes Service Account as same name as Athenz Service
#
# SERVICEACCOUNT may be extracted from spec.serviceAccountName in Kubernetes manifests
#
SERVICEACCOUNT=
#
# File path for Kubernetes Service Account Token
# The default is usually "/var/run/secrets/kubernetes.io/bound-serviceaccount/token"
#
SA_TOKEN_FILE=
#
# Kubernetes Pod IP
#
# POD_IP may be extracted from status.podIP in Kubernetes manifests
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L85
#
POD_IP=
#
# Kubernetes Pod UID
#
# POD_UID may be extracted from metadata.uid in Kubernetes manifests
#
POD_UID=
#
# Kubernetes Pod Name
#
# POD_NAME may be extracted from metadata.name in Kubernetes manifests
# At this point in Mar 2024, POD_NAME is only used for token cache features
#
POD_NAME=
#
# CA certificate to verify ZTS server certificate
#
SERVER_CA_CERT=
#
# Comma separated Athenz Roles to retrieve role certificates
# <Domain>:role.<Role>,<Domain>:role.<Role>...
#
TARGET_DOMAIN_ROLES=
#
# Directory path to store Athenz X.509 role certificate files (e.g. /var/run/athenz/rolecerts)
#
ROLECERT_DIR=
#
# File name delimiter for Athenz X.509 role certificate files
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L43
#
ROLE_CERT_FILENAME_DELIMITER=:role.
#
# Outputs private key specifically for role certificates (e.g. true or false)
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/dbbf93b9e22dbb0a38146ccfd9205f5169595144/pkg/config/default.go#L92
#
ROLE_CERT_KEY_FILE_OUTPUT=false
#
# Athenz Role Auth Header to retrieve role tokens
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L41
#
ROLE_AUTH_HEADER=Athenz-Role-Auth
#
# Token type for Athenz role tokens
# Available values are: roletoken, accesstoken, roletoken+accesstoken
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L94
#
TOKEN_TYPE=accesstoken
#
# Refresh interval for SIA to request to ZTS periodically in containers to get role tokens
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L31
#
TOKEN_REFRESH_INTERVAL=30m
#
# Token expiry duration (0 to use Athenz server's default expiry)
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L32
#
TOKEN_EXPIRY=0
#
# Server address to listen as token provider sidecar (e.g. :8080)
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L97
#
TOKEN_SERVER_ADDR=
#
# Enable token server RESTful API
# Available values are: true, false
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L98
#
TOKEN_SERVER_REST_API=false
#
# Token server timeout
#
TOKEN_SERVER_TIMEOUT=3s
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L34
#
# Token server TLS CA path (if set, enable TLS Client Authentication)
#
TOKEN_SERVER_TLS_CA_PATH=
#
# Token server TLS certificate path (if empty, disable TLS)
#
TOKEN_SERVER_TLS_CERT_PATH=
#
# Token server TLS certificate key path (if empty, disable TLS)
#
TOKEN_SERVER_TLS_KEY_PATH=
#
# Directory path to store Athenz role token files (e.g. /var/run/athenz)
#
TOKEN_DIR=
#
# Server address to listen as metrics exporter sidecar (e.g. :9999)
#
METRICS_SERVER_ADDR=
#
# Delete Instance ID at container shutdown
#
DELETE_INSTANCE_ID=false
#
# Enable token server
# When enabled, runs a server that appends AccessToken and RoleToken to the request headers,
# aligning with the de facto standard adopted by widely-used proxies such as Envoy, nginx, etc.
# Available values are: true, false
#
USE_TOKEN_SERVER=
#
# Directory to store the log files (e.g. /var/log/athenz-sia)
#
LOG_DIR=
#
# Log level to print logs
# Available values are: TRACE, DEBUG, INFO, WARNING, ERROR, FATAL or PANIC
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L112
#
LOG_LEVEL=INFO
#
# HTTP server address to provide health check (e.g. :6080)
#
HEALTH_CHECK_ADDR=
#
# HTTP server endpoint to provide health check (e.g. /healthz)
#
HEALTH_CHECK_ENDPOINT=
#
# Graceful shutdown timeout
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L47
#
SHUTDOWN_TIMEOUT=5s
#
# Graceful shutdown delay
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L48
#
SHUTDOWN_DELAY=0