values.yaml

# Default values for identity-platform.

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: false
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

platform:
  ingress:
    enabled: true
    className: "nginx"
    annotations:
      # kubernetes.io/tls-acme: "true"
      # Nginx specific ingress annotations
      nginx.ingress.kubernetes.io/affinity: cookie
      nginx.ingress.kubernetes.io/session-cookie-hash: sha1
      nginx.ingress.kubernetes.io/session-cookie-name: route
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      # CORS is now set in the AM and IDM configurations
      nginx.ingress.kubernetes.io/enable-cors: "false"
      nginx.ingress.kubernetes.io/body-size: "64m"
      nginx.ingress.kubernetes.io/send-timeout: "600"
      nginx.ingress.kubernetes.io/proxy-body-size: "64m"
      nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
      nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
      nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
      nginx.ingress.kubernetes.io/configuration-snippet: |
        add_header X-ForgeRock-TransactionId $req_id;
        proxy_set_header X-ForgeRock-TransactionId $req_id;

    hosts:
      - identity-platform.domain.local
      # - identity-platform-2.local
    tls:
      # cert-manager must be deployed in order create/use a certificate issuer
      issuer:
        name: # "identity-platform-issuer"
        kind: Issuer  # ClusterIssuer
      #  create:
      #    type: "letsencrypt-prod" # "letsencrypt-staging" # "self-signed"
      #    email: "address@domain.com"
      secret:
        name: # "identity-platform-tls"
      #  create:
      #    crt: # base64 encoded string (Ex: base64 -w 0 <domain-file>.pem)
      #    key: # base64 encoded string (Ex: base64 -w 0 <domain-file>.key)

  storage:
    storage_class:
      name: fast
      #create:
      #  # GKE
      #  provisioner: pd.csi.storage.gke.io
      #  allowVolumeExpansion: true
      #  parameters:
      #    type: pd-ssd
      #  # EKS
      #  provisioner: ebs.csi.aws.com
      #  allowVolumeExpansion: true
      #  # AKS
      #  provisioner: disk.csi.azure.com
      #  allowVolumeExpansion: true
      #  parameters:
      #    storageaccounttype: Premium_LRS
      #    kind: Managed
    volumeSnapshotClass:
      name: ds-snapshot-class
      # create:
      #   # GKE
      #   driver: pd.csi.storage.gke.io
      #   # EKS
      #   driver: ebs.csi.aws.com
      #   # AKS
      #   driver: disk.csi.azure.com

  #secrets:
  #  ds-passwords:
  #    - name: dirmanager.pw
  #      length: 32
  #    - name: monitor.pw
  #      value: password
  #  am-passwords:
  #    - name: .keypass
  #      length: 24
  #    - name: .storepass
  #      length: 24
  #    - name: username
  #      value: amadmin
  #  am-env-secrets:
  #    - name: AM_AUTHENTICATION_SHARED_SECRET
  #      length: 32
  #      #useBinaryCharacters: true
  #    - name: AM_ENCRYPTION_KEY
  #      length: 24
  #    - name: AM_OIDC_CLIENT_SUBJECT_IDENTIFIER_HASH_SALT
  #      length: 20
  #    - name: AM_PASSWORDS_AMADMIN_CLEAR
  #      length: 24
  #    - name: AM_SELFSERVICE_LEGACY_CONFIRMATION_EMAIL_LINK_SIGNING_KEY
  #      length: 32
  #      #useBinaryCharacters: true
  #    - name: AM_SESSION_STATELESS_ENCRYPTION_KEY
  #      length: 32
  #      #useBinaryCharacters: true
  #    - name: AM_SESSION_STATELESS_SIGNING_KEY
  #      length: 32
  #      #useBinaryCharacters: true
  #  amster-env-secrets:
  #    - name: IDM_PROVISIONING_CLIENT_SECRET
  #      length: 24
  #    - name: IDM_RS_CLIENT_SECRET
  #  ds-env-secrets:
  #    - name: AM_STORES_APPLICATION_PASSWORD
  #      length: 32
  #    - name: AM_STORES_CTS_PASSWORD
  #      length: 32
  #    - name: AM_STORES_USER_PASSWORD
  #      length: 32
  #  idm-env-secrets:
  #    - name: OPENIDM_ADMIN_PASSWORD
  #      length: 24
  #    - name: OPENIDM_KEYSTORE_PASSWORD
  #      length: 24
  #  rcs-agent-env-secrets:
  #    - name: AGENT_IDM_SECRET
  #      length: 32
  #    - name: AGENT_RCS_SECRET
  #      length: 32

  tolerations:
    - key: kubernetes.io/arch
      operator: Exists
      effect: NoSchedule

am:
  enabled: true
  replicaCount: 1

  image:
    repository: us-docker.pkg.dev/forgeops-public/images/am
    tag: "7.4.0"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  ingress:
    enabled: true
    # Uncomment className and/or annotations to override global platform values
    # className: "nginx"
    # annotations: {}

  resources: {}
    # limits:
    #   cpu: 250m
    #   memory: 2000Mi
    # requests:
    #   cpu: 250m
    #   memory: 128Mi

  livenessProbe:
    initialDelaySeconds: 30
    periodSeconds: 30
    timeoutSeconds: 5

  readinessProbe:
    initialDelaySeconds: 20
    periodSeconds: 10
    timeoutSeconds: 5

  startupProbe:
    failureThreshold: 40
    periodSeconds: 10

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: am
    app: am

  podSecurityContext:
    runAsGroup: 0
    runAsUser: 11111

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 80

amster:
  enabled: true
  backoffLimit: 6
  restartPolicy: OnFailure
  deleteOnSuccess: false
  #ttlSecondsAfterFinished: 300

  image:
    repository: gcr.io/forgerock-io/amster/pit1
    tag: "7.4.0"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  resources: {}
    # limits:
    #   cpu: 100m
    #   memory: 512
    # requests:
    #   cpu: 100m
    #   memory: 512

  readinessProbe:
    initialDelaySeconds: 1

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: amster
    app: amster

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  env:
    DURATION: "10"

ldif_importer:
  enabled: true
  backoffLimit: 6
  restartPolicy: OnFailure
  ttlSecondsAfterFinished: 300

  image:
    repository: us-docker.pkg.dev/forgeops-public/images/ldif-importer
    tag: "7.4.0"
    pullPolicy: Always
    imagePullSecrets: []

  resources: {}
    # limits:
    #   cpu: 100m
    #   memory: 512
    # requests:
    #   cpu: 100m
    #   memory: 512

  readinessProbe:
    initialDelaySeconds: 1

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: ldif-importer
    app: ldif-importer

  podSecurityContext:
    fsGroup: 0
    runAsUser: 11111

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

idm:
  enabled: true
  replicaCount: 1

  image:
    repository: us-docker.pkg.dev/forgeops-public/images/idm
    tag: "7.4.0"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  ingress:
    enabled: true
    # Uncomment className and/or annotations to override global platform values
    # className: "nginx"
    # annotations: {}

  resources: {}
    # limits:
    #   cpu: 250m
    #   memory: 1280Mi
    # requests:
    #   cpu: 250m
    #   memory: 768Mi

  livenessProbe:
    initialDelaySeconds: 120
    periodSeconds: 60
    timeoutSeconds: 5

  readinessProbe:
    initialDelaySeconds: 30
    periodSeconds: 30
    timeoutSeconds: 5

  startupProbe:
    failureThreshold: 40
    periodSeconds: 10

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: idm
    app: idm

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 80

admin_ui:
  enabled: true
  replicaCount: 1

  image:
    repository: gcr.io/forgerock-io/platform-admin-ui
    tag: "7.4.0"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  ingress:
    enabled: true
    # Uncomment className and/or annotations to override global platform values
    # className: "nginx"
    # annotations: {}

  resources: {}
    # limits:
    #   cpu: 10m
    #   memory: 100Mi
    # requests:
    #   cpu: 10m
    #   memory: 100Mi

  startupProbe:
    initialDelaySeconds: 10

  livenessProbe:
    periodSeconds: 10
    timeoutSeconds: 1

  readinessProbe:
    periodSeconds: 10
    timeoutSeconds: 1

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: admin-ui
    app: admin-ui

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 8080

end_user_ui:
  enabled: true
  replicaCount: 1

  image:
    repository: gcr.io/forgerock-io/platform-enduser-ui
    tag: "7.4.0"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  ingress:
    enabled: true
    # Uncomment className and/or annotations to override global platform values
    # className: "nginx"
    # annotations: {}

  resources: {}
    # limits:
    #   cpu: 10m
    #   memory: 100Mi
    # requests:
    #   cpu: 10m
    #   memory: 100Mi

  startupProbe:
    initialDelaySeconds: 10

  livenessProbe:
    periodSeconds: 10
    timeoutSeconds: 1

  readinessProbe:
    periodSeconds: 10
    timeoutSeconds: 1

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: login-ui
    app: login-ui

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 8080

login_ui:
  enabled: true
  replicaCount: 1

  image:
    repository: gcr.io/forgerock-io/platform-login-ui
    tag: "7.4.0"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  ingress:
    enabled: true
    # Uncomment className and/or annotations to override global platform values
    # className: "nginx"
    # annotations: {}

  resources: {}
    # limits:
    #   cpu: 10m
    #   memory: 100Mi
    # requests:
    #   cpu: 10m
    #   memory: 100Mi

  startupProbe:
    initialDelaySeconds: 10

  livenessProbe:
    periodSeconds: 10
    timeoutSeconds: 1

  readinessProbe:
    periodSeconds: 10
    timeoutSeconds: 1

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: login-ui
    app: login-ui

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 8080

ig:
  enabled: false
  replicaCount: 1

  image:
    repository: us-docker.pkg.dev/forgeops-public/images/ig
    tag: "7.4.1"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  ingress:
    enabled: true
    # Uncomment className and/or annotations to override global platform values
    # className: "nginx"
    annotations:
      haproxy-ingress.github.io/ssl-redirect: "true"
      haproxy-ingress.github.io/rewrite-target: "/$2"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/rewrite-target: "/$2"

  resources: {}
    # limits:
    #   cpu: 200m
    #   memory: 512Mi
    # requests:
    #   cpu: 200m
    #   memory: 512Mi

  livenessProbe:
    periodSeconds: 30
    timeoutSeconds: 5

  readinessProbe:
    initialDelaySeconds: 5

  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: ig
    app: ig

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 80

# Common values for doing ds snapshots
ds_snapshot:
  class: ds-snapshot-class
  configmapCreate: true
  configmapOnly: false
  podSecurityContext: {}
  rbacCreate: true
  rbacOnly: false
  serviceAccountName: ds-snapshot

  image:
    repository: bitnami/kubectl
    tag: latest
    pullPolicy: IfNotPresent
    imagePullSecrets: []

ds_restore:
    # Restore a backup taken by the dsbackup tool
  autoRestore: false
  # backupLocation is either: 
  #   Pod:         /local/path
  #   Cloud Storage: s3://bucket/path | az://container/path | gs://bucket/path
  backupLocation: ""
  # Name of hosts running the backups (e.g. ds-idrepo-2,ds-cts-2)
  backupHosts: ""

ds_idrepo:
  enabled: true
  replicaCount: 1

  image:
    repository: us-docker.pkg.dev/forgeops-public/images/ds
    tag: "7.4.1"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  resources: {}
    # limits:
    #   cpu: 500m
    #   memory: 1200Mi
    # requests:
    #   cpu: 500m
    #   memory: 1200Mi

  startupProbe:
    failureThreshold: 720
    initialDelaySeconds: 30

  volumeClaimSpec:
    storageClassName: fast
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: 10Gi

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: ds-idrepo
    app: ds-idrepo

  podSecurityContext:
    fsGroup: 0
    runAsUser: 11111

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 8080

  snapshot:
    enabled: false
    name: ds-idrepo-snapshot
    pvcName: data-ds-idrepo-0

    # Daily snaphot at midnight
    schedule: "0 0 * * *"

    # Purge snaps older than 3 days
    purgeDelay: "-3 day"

ds_cts:
  enabled: true
  replicaCount: 1

  image:
    repository: us-docker.pkg.dev/forgeops-public/images/ds
    tag: "7.4.1"
    pullPolicy: IfNotPresent
    imagePullSecrets: []

  resources: {}
    # limits:
    #   cpu: 500m
    #   memory: 1024Mi
    # requests:
    #   cpu: 500m
    #   memory: 1024Mi

  startupProbe:
    failureThreshold: 720
    initialDelaySeconds: 30

  volumeClaimSpec:
    storageClassName: fast
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: 10Gi

  nodeSelector: {}

  tolerations: []

  affinity: {}

  podAnnotations: {}

  podLabels:
    app.kubernetes.io/component: ds-cts
    app: ds-cts

  podSecurityContext:
    fsGroup: 0
    runAsUser: 11111

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 8080

  snapshot:
    enabled: false
    name: ds-cts-snapshot
    pvcName: data-ds-cts-0

    # Daily snaphot at midnight
    schedule: "0 0 * * *"

    # Purge snaps older than 3 days
    purgeDelay: "-3 day"