List of Supported Values
These are the values supported in the ping-devops chart. In general, values specified in the global section can be overridden for individual products. The product sections have many global fields overridden by default (workloads, services, etc.).
Global Values
| Name | Description | Default |
|---|---|---|
|
Annotations listed, will be added to all Kubernetes resources. |
|
|
Labels listed, will be added to all Kubernetes resources. |
|
|
Environment variables listed will be added to the global-env-vars configmap |
|
|
Provides global ability to add names to kubernetes resources. One of |
|
|
|
|
|
Add release to host. One of |
|
|
Replaces with "defaultDomain" in host fields |
|
|
Replaces with "defaultTlsSecret" in tls.secretName |
|
|
|
|
|
||
|
If true, then an internal certificate secret will be created along with mount of the certificate in /run/secrets/internal-cert (creates a tls.crt and tls.key). By default the Issuer of the cert will be the service name created by the Helm Chart. Additionally, the ingress hosts, if enabled, will be added to the list of X509v3 Subject Alternative Name |
|
|
The format of the certificate to be generated. Used "pingaccess-fips-pem" to generate a valid certificate for running PingAccess in FIPS mode. Any other value will generate a PKCS12 keystore with the generated certificate. |
|
|
Additional hosts for the cert |
|
|
Additional IP addresses for the cert |
|
|
Uses Helm function derivePassword, which uses the master password specification: https://masterpassword.app/masterpassword-algorithm.pdf |
|
|
Enable master password |
|
|
Master password template. One of |
|
|
Defaults to release name |
|
|
Defaults to chart name |
|
|
Defaults to release namespace |
|
|
Hashicorp Vault configuration |
|
|
Enable Vault |
|
|
Annotation names, which will be appended to 'vault.hashicorp.com/' in the annotation. The vault.hashicorp.annotations.serviceAccountName value will be overwritten by the service account generated for the workload if there is one. |
|
|
Prefix that will be prepended to any secrets being injected. |
|
|
Vault secrets to pull in |
|
|
Repository authentication using secret defined as a docker-registry secret in Kubernetes. |
|
|
Default image registry is not the fully-qualified name of the image Example: image.repository: pingidentity, docker.io, 123.dkr.ecr.us-west-1.amazonaws.com |
|
|
Docker image repository fully-qualified name. Overrides image.repository and image.name on the pod image spec Example: image.repositoryFqn: pingidentity/pingfederate, docker.io/my-pingfederate |
|
|
Default image name MUST be set in child chart Example: image.name: pingfederate |
|
|
Default image tag |
|
|
Default image pull policy |
|
|
Set to true to generate a service account for the workload. |
|
|
Name of the service account that will be generated. The default value of "defaultServiceAccountName" will result in a service account named based on the Helm installation and the specific workload being deployed. If generateServiceAccount and generateGlobalServiceAccount are false, this value can also refer to a service account created outside of Helm. |
|
|
Set to true to generate a Role and RoleBinding corresponding to the workload service account. |
|
|
Set to true to generate a service account for the entire installation. This global service account will be used for workloads that do not generate their own service account. |
|
|
Set to true to generate a Role and RoleBinding corresponding to the global service account for the entire installation. |
|
|
Set to true (the default) to apply to service account to the workload. |
|
|
This yaml will be directly inserted into the generated Role when generateRoleAndRoleBinding and/or generateGlobalRoleAndRoleBinding are true. The rules for the Role can be set here. |
|
|
Any custom annotations to add to the service account. |
|
|
Any custom annotations to add to the role. |
|
|
Any custom annotations to add to the role binding. |
|
|
Any custom labels to add to the service account. |
|
|
Any custom labels to add to the role. |
|
|
Any custom labels to add to the role binding. |
|
|
Provides ability to use external images for various purposes such as using curl, waitfor, etc. A pingtoolkit image is included by default for running waitFor and generating private cert initContainers. A pingaccess image is also included by default to allow generating an encrypted PEM-formatted cert that is compatible with FIPS mode. Any values specified on the image will be copied directly to the k8s spec for the container, except for the externalImage.{name}.image section, which follows the format of the global.image section. If no image section is specified (the default), the corresponding value from the product values section will be used. For example, if externalImage.pingtoolkit.image is empty, the values from the top-level pingtoolkit.image section will be used. |
|
|
Services mapping a port to a targetPort on the corresponding container |
|
|
Value for the external-dns.alpha.kubernetes.io/hostname annotation for the cluster service. |
|
|
If set, then this name will be used as the cluster service name (i.e clusterService == true). |
|
|
If true, the data service will be created with type: LoadBalancer. |
|
|
If true, a ClusterIP service is created reachable within the cluster. A single IP is provided and the service will round-robin across the backend containers |
|
|
If true, a headless service is created, explicitly specifying "None" for the clusterIP. DNS requests to this service will provide one of the IPs of the backend containers |
|
|
Port on the kubernetes container |
|
|
Port available from the kubernetes service. If clusterService=true this port on the cluster service is not really used, as the headless service always maps through to the container port |
|
|
Port available from the kubernetes ingress |
|
|
Any custom annotations to add to the service. |
|
|
Any custom annotations to add to the ClusterIP service. |
|
|
Any custom labels to add to the service. |
|
|
Any custom labels to add to the ClusterIP service. |
Workload Values – Deployment and StatefulSet
| Name | Description | Default |
|---|---|---|
|
Can be Deployment or StatefulSet |
|
|
Annotations to apply to the template in the workload. To apply top-level annotations to the Deployment or StatefulSet itself, use global.workload.deployment.annotations or global.workload.statefulSet.annotations. |
|
|
Labels to apply to the template in the workload. To apply top-level labels to the Deployment or StatefulSet itself, use global.workload.deployment.labels or global.workload.statefulSet.labels. |
|
|
K8s scheduler |
|
|
Set shareProcessNamespace in the pod spec |
|
|
indicates whether info about services can be added as env variables |
|
|
Configuration of pod spread across cluster zones |
|
|
Deployment workload configuration |
|
|
Deployment pod replacement strategy |
|
|
Strategy type |
|
|
Max surge, only applicable for RollingUpdate type |
|
|
Max unavailable, only applicable for RollingUpdate type |
|
|
Annotations to apply to the top-level Deployment. To apply annotations to the template within the Deployment, use global.workload.annotations. |
|
|
Labels to apply to the top-level Deployment. To apply labels to the template within the Deployment, use global.workload.labels. |
|
|
StatefulSet workload configuration |
|
|
Used for canary testing if n>0 |
|
|
Enable persistent volumes |
|
|
For every volume defined in the volumes list, 3 items will be created in the StatefulSet: 1. container.volumeMounts - name and mountPath. 2. template.spec.volume - name and persistentVolumeClaim.claimName. 3. spec.volumeClaimTemplates - persistentVolumeClaim. |
|
|
Mount path for the volume |
|
|
volumeClaimTemplate |
|
|
Controls how pods are created during initial scale up, when replacing pods on nodes, or when scaling down. The default behavior is OrderedReady. The Parallel podManagementPolicy allows for starting up and scaling down multiple Pods simultaneously. Updates are not affected. The only products that support Parallel are PingDirectory and PingDataSync, on versions 2209 and later. When using the Parallel policy, consider setting the RETRY_TIMEOUT_SECONDS environment variable to a higher value (it defaults to 180) for the Pods. If the value is too low with many servers starting at once, it may lead to some Pods restarting unnecessarily during the initial workload startup. |
|
|
Annotations to apply to the top-level StatefulSet. To apply annotations to the template within the StatefulSet, use global.workload.annotations. |
|
|
Labels to apply to the top-level StatefulSet. To apply labels to the template within the StatefulSet, use global.workload.labels. |
|
|
securityContext for the workload Pod spec. The securityContext defined will be inserted directly into the Pod spec. The user (9031) and group (0) represent the current user and group used with PingIdentity images (except PingDelegator). The fsGroup is required for any workloads that volumeMount a pvc (i.e. StatefulSets). Set as securityContext: null when no generated securityContext is desired. |
|
|
Configure Horizontal Pod Autoscaling |
|
|
Enable Horizontal Pod Autoscaling. If enabled, ensure that proper container.resources values are set and coordinated with the targetCPUUtilizationPercentage or targetMemoryUtilizationPercentage |
|
|
Autoscaler minimum replicas |
|
|
Autoscaler maximum replicas |
|
|
Target CPU utilization |
|
|
Target memory utilization |
|
|
Custom annotations for the HPA. |
|
|
Custom labels for the HPA. |
|
|
Custom HPA behavior yaml |
|
|
Custom HPA metrics yaml |
|
|
Configure the container in the workload Pod spec |
|
|
securityContext at the container level for the workload. The securityContext defined will be inserted directly into the spec for the main container of the Pod. Container-level securityContext values will overwrite any corresponding values from the Pod-level securityContext. |
|
|
Number of replicas for workload |
|
|
container resources yaml to insert into Pod spec |
|
|
nodeSelector yaml to insert into Pod spec |
|
|
tolerations yaml to insert into Pod spec |
|
|
affinity yaml to insert into Pod spec |
|
|
termination grace period |
|
|
envFrom yaml to insert into Pod spec |
|
|
Additional environment variables to insert into the Pod spec. Unlike the global.envs values, these will be set directly on the Pod. global.envs values are set in ConfigMaps rather than on the Pod directly. This value allows for setting the valueFrom field for an environment variable when necessary. |
|
|
lifecycle yaml to insert into Pod spec |
|
|
probes yaml to insert into Pod spec |
|
Other Global Defaults
| Name | Description | Default |
|---|---|---|
|
Identify the k8s secret containing the DevOps USER/KEY if used during deployment. pingctl can be used to generate the devops-secret |
|
|
Deploy a utility sidecar for running command-line tools. This sidecar is useful for command line utilities like collect-support-data. The sidecar will remain running alongside the workload, even when the sidecar isn’t being used. It does not need to be listed in the includeSidecars value. |
|
|
Enable the utility sidecar |
|
|
Set k8s resources yaml for the sidecar spec |
|
|
Environment variables for the sidecar |
|
|
securityContext at the container level for the sidecar. The securityContext defined will be inserted directly into the spec for the sidecar. By default no container securityContext is defined. In Kubernetes when a container-level securityContext is set, it will overwrite any corresponding values from the Pod-level securityContext. |
|
|
names of sidecars to include, from the top-level |
|
|
names of sidecars to include, from the top-level |
|
|
names of sidecars to include, from the top-level |
|
Shared Utilities
| Name | Description | Default |
|---|---|---|
|
Sidecar yaml definitions available to product workload spec |
|
|
initContainer yaml definitions available to product workload spec |
|
|
volume yaml definitions available to product workload spec for sidecars, initContainers, or main product containers |
|
|
configMap yaml definitions available to product workload spec for sidecars or main product containers |
|
Image/Product Values
| Name | Description | Default |
|---|---|---|
|
LDAP SDK tools values |
|
|
Enable LDAP SDK tools deployment |
|
|
PingFederate admin values |
|
|
Enable PingFederate admin deployment |
|
|
CronJobs run a kubectl exec command to run commands on a utility sidecar container. They will also create the necessary ServiceAccount, Role, and RoleBinding to run the jobs |
|
|
Enable the PingFederate Admin CronJob |
|
|
yaml to insert into the created CronJob spec. If specified, this will override any other specified values for the CronJob. |
|
|
yaml to override default jobTemplate. If a jobTemplate is not overridden, a default template will be inserted. |
|
|
Image to run the Jobs. The image must include kubectl |
|
|
Job arguments |
|
|
securityContext for the pod in the jobTemplate. This will be used if a jobTemplate is not specified. |
|
|
securityContext for the container in the jobTemplate. This will be used if a jobTemplate is not specified. |
|
|
PingFederate engine values |
|
|
Enable PingFederate engine deployment |
|
|
CronJobs run a kubectl exec command to run commands on a utility sidecar container. They will also create the necessary ServiceAccount, Role, and RoleBinding to run the jobs |
|
|
Enable the PingFederate engine CronJob |
|
|
yaml to insert into the created CronJob spec. If specified, this will override any other specified values for the CronJob. |
|
|
yaml to override default jobTemplate. If a jobTemplate is not overridden, a default template will be inserted. |
|
|
Image to run the Jobs. The image must include kubectl |
|
|
Job arguments |
|
|
securityContext for the pod in the jobTemplate. This will be used if a jobTemplate is not specified. |
|
|
securityContext for the container in the jobTemplate. This will be used if a jobTemplate is not specified. |
|
|
PingDirectory values |
|
|
Enable PingDirectory deployment |
|
|
CronJobs run a kubectl exec command to run commands on a utility sidecar container. They will also create the necessary ServiceAccount, Role, and RoleBinding to run the jobs |
|
|
Enable the PingDirectory CronJob |
|
|
yaml to insert into the created CronJob spec. If specified, this will override any other specified values for the CronJob. |
|
|
yaml to override default jobTemplate. If a jobTemplate is not overridden, a default template will be inserted. |
|
|
Image to run the Jobs. The image must include kubectl |
|
|
Job arguments |
|
|
securityContext for the pod in the jobTemplate. This will be used if a jobTemplate is not specified. |
|
|
securityContext for the container in the jobTemplate. This will be used if a jobTemplate is not specified. |
|
|
If true, the per-Pod LoadBalancer services enabled with pingdirectory.services.loadBalancerServicePerPod will include this port. |
|
|
Set to true to create a separate LoadBalancer service for each individual Pod in the PingDirectory StatefulSet. |
|
|
Value used for the external-dns.alpha.kubernetes.io/hostname annotation for the LoadBalancer services. This value will be used as a suffix for the hostname for each individual pod when pingdirectory.services.loadBalancerServicePerPod is set to true. |
|
|
PingDirectoryProxy values |
|
|
Enable PingDirectoryProxy deployment |
|
|
PingDelegator values |
|
|
Enable PingDelegator deployment |
|
|
PingDataSync values |
|
|
Enable PingDataSync deployment |
|
|
PingAuthorize values |
|
|
Enable PingAuthorize deployment |
|
|
PingAuthorizePAP values |
|
|
Enable PingAuthorizePAP deployment |
|
|
PingAccess admin values |
|
|
Enable PingAccess admin deployment |
|
|
PingAccess engine values |
|
|
Enable PingAccess engine deployment |
|
|
PingCentral values |
|
|
Enable PingCentral deployment |
|
|
PingDataConsole values |
|
|
Enable PingDataConsole deployment |
|
|
Default login details for the console |
|
|
Default hostname |
|
|
Default port |
|
|
Default username |
|
|
values |
|
|
Enable PingIntelligence deployment |
|
|
PingDirectory replication timing values |
|
|
Enable PingDirectory replication timing deployment |
|
|
PingToolkit values |
|
|
Enable PingToolkit deployment |
|
|
Repository authentication using secrets defined as a docker-registry secrets in Kubernetes. |
|