Helm Chart Values

This file lists the configurable Helm Chart Values for the Corsha Gatekeeper. Default values have been provided where applicable. Deploying this Helm Chart is described in the How to Install Corsha Gatekeeper guide.

Configurable Helm Values

Globals

Name	Description	Value
global.TLD	Top-level Domain of the Corsha Gatekeeper	""

Corsha Gatekeeper Image

Name	Description	Value
image.registry	Corsha Gatekeeper image registry	corsha-docker.jfrog.io
image.repository	Corsha Gatekeeper image repository	proxy
image.tag	Corsha Gatekeeper image tag (immutable tags are recommended)	v0.0.1
image.pullPolicy	corsha-authenticator image pull policy	IfNotPresent
imageCredentials.registry	Docker image registry hosting Corsha Artifacts	"corsha-docker.jfrog.io"
imageCredentials.username	Docker image username for registry hosting Corsha Artifacts	""
imageCredentials.password	Docker image password for registry hosting Corsha Artifacts	""

Proxy Secret

The Proxy Secret parameter is used to seed the Gatekeeper.

Name	Description	Value
proxySecret	A secret used to initialize the Proxy	""

Corsha Protected APIs

Corsha Gatekeeper parameters configure the core functionality of the Corsha Gatekeeper.

The Corsha Gatekeeper can proxy downstream client requests to multiple upstream services. Each Gatekeeper can be configured by assigning the following proxy values under the proxies key. Examples can be found in the How to Install Corsha Gatekeeper guide.

Name	Description	Value
http.listenPort	The port the Corsha Gatekeeper listens. This is coupled with the k8s Service port	8080
http.observeOnlyMode.enabled	Whether the Gatekeeper is deployed in Observe Only mode	false
http.proxies[].name	Name of the Corsha-protected service	""
http.proxies[].domain	The domain signifies the host that the Corsha Gatekeeper will match to route client requests.	""
http.proxies[].upstream.host	Hostname of the upstream Corsha-protected service	""
http.proxies[].upstream.port	Port of the upstream Corsha-protected service	""
http.proxies[].upstream.protocol	Protocol of the upstream Corsha-protected service. Options: HTTP, HTTPS, or TCP	""
http.proxies[].tls.existingSecret	Name of existing secret containing PEM-encoded TLS signing certificate and key. Mutually exclusive with http.proxies[].tls.cert and http.proxies[].tls.key	""
http.proxies[].tls.cert	PEM-encoded signing certificate for TLS. Mutually exclusive with http.proxies[].tls.existingSecret	""
http.proxies[].tls.key	PEM-encoded key for the signing certificate for ingress to the Gatekeeper. Mutually exclusive with http.proxies[].tls.existingSecret	""
http.proxies[].rewriteRedirect.enabled	Enable the ability the modify URLs in a response's Redirect Headers. Only allowed for HTTP upstreams.	false
http.proxies[].rewriteRedirect.redirect	Redirect path to be replaced for rewriteRedirect. This should include the protocol and the full path to be redirected.	""
http.proxies[].rewriteRedirect.replacement	Replacement path to replace redirect for rewriteRedirect. This should include the protocol and the full path to be replaced.	""
http.proxies[].requestTimeout	Sets how long the Corsha Gatekeeper waits for a response from the upstream service. You can use short formats like 30s (seconds) and 5m (minutes). If not specified, the default is 15 seconds; set to zero to disable timeout.	""
http.credPassThrough.enabled	Enables passing the X-Corsha-Cred header to downstream services.	false
http.allowHttp10.enabled	Allow downstream HTTP 1.0 clients to connect.	false
http.allowHttp10.defaultHost	The default Host header value for HTTP/1.0 requests if it is empty. The Corsha Gatekeeper does not support HTTP/1.0 without a Host header. This is a no-op if http.allowHttp10.enabled: false.	""

Trusted CA

Name	Description	Value
trustedCAs	A bundle of PEM-encoded CA certs used to extend trust	""

Corsha Auth Server

These parameters contain the required values to connect to the Corsha Authentication Server.

Name	Description	Value
authserver.host	Auth Server host where cred-checking occurs	""
authserver.port	Auth Server port where cred-checking occurs	""
authserver.tls.cert	PEM-encoded TLS signing certificate.	""
authserver.tls.key	PEM-encoded TLS key for the signing certificate.	""
authserver.timeout	Timeout when performing authentication checks	30s

Kubernetes Deployment

Name	Description	Value
imagePullSecrets.customImagePullSecrets	Array of image pull secrets	[]
imagePullSecrets.defaultImagePullSecrets	Enables use of global imageCredentials derived from a combination of imageCredentials.registry, imageCredentials.username, and imageCredentials.password	true
replicaCount	Number of Gatekeeper replicas	1
serviceAccount	Specifies whether a Service Account should be created	true
service.type	Proxy service type	ClusterIP
nameOverride	String to partially override common.names.fullname. Ex: Deployment release-name-chart-name becomes release-name-override-name	""
fullNameOverride	String to fully override common.names.fullname. Ex: Deployment release-name-chart-name becomes override-name	""
podAnnotations	Annotations for Gatekeeper pod	{}
resources.limits.cpu	Resource CPU limit for the Gatekeeper container	100m
resources.limits.memory	Resource memory limit for the Gatekeeper container	128Mi
resources.requests.cpu	Request CPU limit for the Gatekeeper container	100m
resources.requests.memory	Request memory limit for the Gatekeeper container	128Mi
nodeSelector	Node labels for pod assignment	{}
tolerations	Tolerations for pod assignment	[]
affinity	Affinity for pod assignment	{}

Liveness and Readiness Probe Parameters

Name	Description	Value
livenessProbe.initialDelaySeconds	Number of seconds after the container has started before liveness probes is initiated	30
livenessProbe.periodSeconds	How often (in seconds) to perform the probe.	15
livenessProbe.timeoutSeconds	Number of seconds after which the probe times out.	5
livenessProbe.successThreshold	Minimum consecutive successes for the probe to be considered successful after having failed.	1
livenessProbe.failureThreshold	Number of times the probe can fail before Kubernetes considers the overall check failed. For the liveness probe, Kubernetes will treat the container as unhealthy and trigger a restart once the failureThreshold is reached.	5
readinessProbe.initialDelaySeconds	Number of seconds after the container has started before liveness probes is initiated	30
readinessProbe.periodSeconds	How often (in seconds) to perform the probe.	15
readinessProbe.timeoutSeconds	Number of seconds after which the probe times out.	2
readinessProbe.successThreshold	Minimum consecutive successes for the probe to be considered successful after having failed.	1
readinessProbe.failureThreshold	Number of times the probe can fail before Kubernetes considers the overall check failed and the container not ready.	3

Kubernetes Security Context

Name	Description	Value
podSecurityContext.enabled	Enable pod security context	true
podSecurityContext.runAsNonRoot	Require that the pod will run with a non-root user	true
podSecurityContext.runAsUser	User ID for Gatekeeper pod	10001
podSecurityContext.runAsGroup	Group ID for Gatekeeper pod	10001
securityContext.enabled	Enable container security context	true
securityContext.runAsNonRoot	Require that the container will run with a non-root user	true
securityContext.runAsUser	User ID for container	10001
securityContext.runAsGroup	Primary group ID for container	10001

Enabling cert-manager

The Corsha Gatekeeper comes with native cert-manager support to easily configure TLS endpoints. To enable cert-manager support, the following Helm values are required.

Name	Description	Value
certmanager.enabled	Flag to enable Cert-Manager	true
ingress.annotations	Ingress annotation for Cert-Manager	cert-manager.io/cluster-issuer: "le-wildcard-issuer"

Enabling TLS Termination

Name	Description	Value
http.tlsTermination.enabled	Enables TLS termination at the proxy. If enabled, either http.proxies[].tls.existingSecret or both http.proxies[].tls.cert and http.proxies[].tls.key will be used as server certificates.	false
ingress.annotations	Ingress annotation to enable SSL passthrough. This must be enabled to terminate TLS at the proxy.	nginx.ingress.kubernetes.io/ssl-passthrough: true

Corsha Protected OPC UA TCP Protocol Parameters

Name	Description	Value
opcuaTcp.listenPort	The port the Corsha Gatekeeper listens for OPC UA TCP traffic. This is coupled with the k8s Service port	4841
opcuaTcp.upstream.host	Hostname of the upstream Corsha-protected service	""
opcuaTcp.upstream.port	Port of the upstream Corsha-protected service	""
opcuaTcp.upstream.protocol	Protocol of the upstream Corsha-protected service. Options: OPCUATCP	""
opcuaTcp.tlsTermination.enabled	Enables TLS termination at the Gatekeeper OPC UA TCP listenport. If enabled, either opcuaTcp.tls.existingSecret or both opcuaTcp.tls.cert and opcuaTcp.tls.key will be used as server certificates.	false
opcuaTcp.tls.existingSecret	Name of existing secret containing PEM-encoded TLS signing certificate and key. Mutually exclusive with opcuaTcp.tls.cert and opcuaTcp.tls.key	""
opcuaTcp.tls.cert	Inline PEM-encoded signing certificate for TLS. Mutually exclusive with opcuaTcp.tls.existingSecret	""
opcuaTcp.tls.key	Inline PEM-encoded key for the signing certificate for ingress to the Gatekeeper. Mutually exclusive with opcuaTcp.tls.existingSecret	""