Configuration

Requirements

To the Deckhouse Platform version: 1.71 and above.

Conversions

The module is configured using the ModuleConfig resource, the schema of which contains a version number. When you apply an old version of the ModuleConfig schema in a cluster, automatic transformations are performed. To manually update the ModuleConfig schema version, the following steps must be completed sequentially for each version:

• Updates from version 1 to 2:

  The allowAnyoneToRuleTheCluster field is removed. The auth.password field is removed; if the auth object becomes empty, it is removed as well.

Parameters

Schema version: 2

• settings

  object
  • settings.auth

    object

    Authentication configuration.

    Default: {}

    • settings.auth.allowedUserGroups

      array of strings

      An array of user groups that can access the web UI.

      This parameter is used if the user-authn module is enabled or the externalAuthentication parameter is set.

      Caution! Note that you must add those groups to the appropriate field in the DexProvider config if this module is used together with the user-authn one.

      • settings.auth.allowedUserGroups.Element of the array

        string

        Maximum length: 253

    • settings.auth.externalAuthentication

      object

      Parameters to enable external authentication. Uses Nginx Ingress external-auth mechanism which is based on the the Nginx auth_request module.
      • settings.auth.externalAuthentication.authSignInURL

        string

        URL to redirect the user for authentication (if the authentication service returned a non-200 HTTP response code).

        Must start with http:// or https:// and be set together with authURL.

        Maximum length: 2048

        Pattern: ^https?://

      • settings.auth.externalAuthentication.authURL

        string

        URL of the authentication service. If the user is authenticated, the service should return an HTTP 200 response code.

        Must start with http:// or https:// and be set together with authSignInURL.

        Maximum length: 2048

        Pattern: ^https?://

      • settings.auth.externalAuthentication.useBearerTokens

        boolean

        The console must use the user ID to work with the Kubernetes API (the authentication service must return the Authorization HTTP header that contains the bearer-token – the console will use this token to make requests to the Kubernetes API server).

        Default value is true.

        Caution! For security reasons, this mode only works if https.mode (global or for a module) is not set to Disabled.

    • settings.auth.sessionTTL

      string

      User session will be kept for specified amount of time even if user will not log in.

      Specified as a single number with s, m or h suffix, for example 30m. Compound values like 1h30m are not supported.

      Default: 24h

      Pattern: ^[0-9]+[smh]$

    • settings.auth.whitelistSourceRanges

      array of strings

      An array of IPv4 CIDRs that are allowed to authenticate. The mask is required, for example 1.1.1.1/32.

      Example:

      whitelistSourceRanges:
      - 1.1.1.1/32
      

      • settings.auth.whitelistSourceRanges.Element of the array

        string

        Pattern: ^((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])/([0-9]|[12][0-9]|3[0-2])$

  • settings.externalWebsocketPort

    integer

    External port for WebSocket protocol requests. If WebSocket traffic goes through a proxy server before reaching the backend, the frontend application will use this to connect to the proxy server.

    Allowed values: 1 <= X <= 65535

  • settings.highAvailability

    boolean

    Manually enable the high availability mode.

    By default, Deckhouse automatically decides whether to enable the HA mode. Click here to learn more about the HA mode for modules.

    Examples:

    highAvailability: true
    

    highAvailability: false
    

  • settings.https

    object

    What certificate type to use with frontend and status apps.

    This parameter completely overrides the global.modules.https settings.

    Examples:

    customCertificate:
      secretName: foobar
    mode: CustomCertificate
    

    certManager:
      clusterIssuerName: letsencrypt
    mode: CertManager
    

    • settings.https.certManager

      object
      • settings.https.certManager.clusterIssuerName

        string

        What ClusterIssuer to use for frontend.

        Currently, letsencrypt, letsencrypt-staging, selfsigned are available. Also, you can define your own.

        Default: letsencrypt

        Maximum length: 253

        Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

    • settings.https.customCertificate

      object

      Default: {}

      • settings.https.customCertificate.secretName

        string

        The name of the secret in the d8-system namespace to use with frontend.

        This secret must have the kubernetes.io/tls format.

        Default: false

        Maximum length: 253

        Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

    • settings.https.mode

      string

      The HTTPS usage mode:

      • Disabled — in this mode, the web UI can only be accessed over HTTP. Caution! This mode is not supported. HTTPS is required for the module to function properly. If HTTPS is disabled, the web UI will be unavailable.
      • CertManager — frontend will use HTTPS and get a certificate from the clusterissuer defined in the certManager.clusterIssuerName parameter.
      • CustomCertificate — frontend will use HTTPS using the certificate from the d8-system namespace.
      • OnlyInURI — frontend will work over HTTP (thinking that there is an external HTTPS load balancer in front that terminates HTTPS traffic). All the links in the user-authn will be generated using the HTTPS scheme.

      Allowed values: Disabled, CertManager, CustomCertificate, OnlyInURI

  • settings.ingressClass

    string

    The class of the Ingress controller used for the web UI.

    An optional parameter. By default, the modules.ingressClass global value is used.

    Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

    Example:

    ingressClass: nginx
    

  • settings.nodeSelector

    object

    Node selector for frontend and backend pods. The same as in the Pods’ spec.nodeSelector parameter in Kubernetes.

    If the parameter is omitted or false, it will be determined automatically according to the general node placement logic: module components are placed on control plane nodes, or, if none are available for such placement, on nodes with the node-role.deckhouse.io/system label.

    Example:

    disktype: ssd
    

  • settings.tolerations

    array of objects

    Node tolerations for frontend and backend pods. The same as in the Pods’ spec.tolerations parameter in Kubernetes;

    If the parameter is omitted or false, it will be determined automatically.

    Example:

    tolerations:
    - effect: NoSchedule
      key: key1
      operator: Equal
      value: value1
    

    • settings.tolerations.effect

      string

      Allowed values: NoSchedule, PreferNoSchedule, NoExecute

    • settings.tolerations.key

      string

      Maximum length: 316

    • settings.tolerations.operator

      string

      Allowed values: Exists, Equal

    • settings.tolerations.tolerationSeconds

      integer
    • settings.tolerations.value

      string

      Maximum length: 63