The stronghold module: configuration

Requirements

To the Deckhouse version: 1.72 and above.

Parameters

Schema version: 1

• settings

  object
  • settings.diskSizeGigabytes

    integer

    The size of the disk for storage or PVC when specifying the storageClass parameters. For HA configurations, automatic increase and decrease of the disk size is supported. For one-node Stronghold configurations, only increase of the PVC size is supported. Make sure the specified value is sufficient for storing Stronghold data. The extended-monitoring module automatically monitors the percentage of used disk space.

    Default: 1

  • settings.enableAuditLog

    boolean

    Enables audit log (EE only feature).

    Available only when management.mode is Automatic.

    Example:

    enableAuditLog: true
    

  • settings.enableUserInterface

    boolean

    Enables User Interface.

    Default: true

    Example:

    enableUserInterface: false
    

  • settings.gatewayAPIGateway

    object

    Reference to the Gateway object (from the Gateway API) used for Stronghold.

    An optional parameter. By default, the modules.gatewayAPIGateway global value is used.

    Example:

    name: public
    namespace: d8-alb
    

    • settings.gatewayAPIGateway.name

      string

      Required value

      Name of the Gateway object.
    • settings.gatewayAPIGateway.namespace

      string

      Required value

      Namespace of the Gateway object.
  • settings.https

    object

    What certificate type to use with Stronghold.

    This parameter completely overrides the global.modules.https settings.

    Examples:

    customCertificate:
      secretName: stronghold-tls
    mode: CustomCertificate
    

    certManager:
      clusterIssuerName: letsencrypt
    mode: CertManager
    

    • settings.https.certManager

      object
      • settings.https.certManager.clusterIssuerName

        string

        What ClusterIssuer to use for Stronghold.

        Currently, letsencrypt, letsencrypt-staging, selfsigned are available. Also, you can define your own.

        Default: letsencrypt

    • settings.https.customCertificate

      object

      Default: {}

      • settings.https.customCertificate.secretName

        string

        The name of the secret in the d8-system namespace to use with Stronghold.

        This secret must have the kubernetes.io/tls format.

        Default: false

    • settings.https.mode

      string

      The HTTPS usage mode:

      • CertManager — Stronghold will use HTTPS and get a certificate from the clusterissuer defined in the certManager.clusterIssuerName parameter.
      • CustomCertificate — Stronghold will use HTTPS using the certificate from the d8-system namespace.

      Default: CertManager

      Allowed values: CertManager, CustomCertificate

  • settings.ingress

    object
    • settings.ingress.class

      string

      The class of the Ingress controller used for Stronghold.

      Deprecated. Use settings.ingressClass instead.

      Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

      Example:

      class: public
      

  • settings.ingressClass

    string

    The class of the Ingress controller used for Stronghold.

    An optional parameter. By default, the modules.ingressClass global value is used.

    Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

    Example:

    ingressClass: public
    

  • settings.inlet

    string

    The way the connection to Stronghold is implemented.

    The following inlet types are supported:

    • Ingress — access via ingress-nginx controller.
    • GatewayAPI — access via Application Load Balancer.
    • LoadBalancer — access via a service of the LoadBalancer type.
    • NodePort — access via nodes’ ports using a service of the NodePort type.
    • None — no standard inlet. Use when external access is not required, or traffic ingress is organized in another way.

    When LoadBalancer, NodePort, or None is used, https.mode must be set to CustomCertificate.

    Default: Ingress

    Allowed values: Ingress, GatewayAPI, LoadBalancer, NodePort, None

  • settings.license

    string

    Stronghold EE License key.

    Leave empty to use Stronghold CE.

    Default: ‘’

  • settings.loadBalancer

    object

    Parameters of the LoadBalancer inlet.
    • settings.loadBalancer.annotations

      object

      Annotations to assign to the service for flexible configuration of the load balancer.

      The module does not take into account the specifics of setting annotations in different clouds. If annotations for provisioning a load balancer are only applied when creating a service, disable and re-enable the module to update such parameters.

    • settings.loadBalancer.clusterPort

      integer

      Port for secure mTLS connections used for inter-cluster communication.

      Default: 8201

      Allowed values: 1 <= X <= 65535

    • settings.loadBalancer.httpsPort

      integer

      External port for secure HTTPS connections exposed by the provisioned LoadBalancer service.

      Default: 443

      Allowed values: 1 <= X <= 65535

    • settings.loadBalancer.loadBalancerClass

      string

      Class of the load balancer for incoming network requests.

      The value is passed to the spec.loadBalancerClass field of the provisioned LoadBalancer service.

    • settings.loadBalancer.sourceRanges

      array of strings

      List of IP addresses in the CIDR format that are allowed accessing the load balancer.

      Caution. A cloud provider may not support this option or ignore it.

      Providers supporting this option: AWS, Azure, GCP. Providers ignoring this option: Yandex Cloud.

      For other cloud providers, behavior may vary depending on the cloud implementation specifics. Test this option before using it in a production environment.

      • settings.loadBalancer.sourceRanges.Element of the array

        string

        Pattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$

  • settings.management

    object

    Default: {}

    • settings.management.administrators

      array of objects

      A list of users and groups that can access Stronghold as administrators. Other authenticated users will access Stronghold with default policy.

      Available only when management.mode is Automatic.

      Example:

      administrators:
      - name: admins
        type: Group
      - name: security
        type: Group
      - name: manager@mycompany.tld
        type: User
      

      • settings.management.administrators.name

        string
      • settings.management.administrators.type

        string

        Allowed values: Group, User

    • settings.management.mode

      string

      Stronghold management mode:

      • Automatic — enables Stronghold auto-init and auto-unseal. The root token is stored in the stronghold-keys Secret. Dex and Kubernetes integrations are configured automatically. Pods are restarted automatically when the configuration changes.
      • Manual — automatic initialization is disabled. Dex and Kubernetes integrations are not configured.

      Default: Automatic

      Allowed values: Automatic, Manual

      Examples:

      mode: Automatic
      

      mode: Manual
      

  • settings.nodePort

    object

    Parameters of the NodePort inlet.
    • settings.nodePort.clusterPort

      integer

      Port for secure mTLS connections used for inter-cluster communication via NodePort.

      Must be within the range set by the kube-apiserver --service-node-port-range argument (default is 30000-32767).

      Allowed values: 30000 <= X <= 32767

      Example:

      clusterPort: 30201
      

    • settings.nodePort.httpsPort

      integer

      Port for secure HTTPS connections via NodePort.

      Must be within the range set by the kube-apiserver --service-node-port-range argument (default is 30000-32767).

      Allowed values: 30000 <= X <= 32767

      Example:

      httpsPort: 30200
      

  • settings.nodeSelector

    object

    The same as the Pods’ spec.nodeSelector parameter in Kubernetes. If the parameter is omitted or false, Stronghold will be placed on control-plane nodes.

    Example:

    node-role.kubernetes.io/stronghold: ''
    

  • settings.plugins

    array of objects

    List of plugins to load into Stronghold. Each plugin is verified by SHA256 checksum.

    Example:

    plugins:
    - ignoreFailure: false
      name: vault-plugin-secrets-github
      sha256: 72cb1f2775ee2abf12ffb725e469d0377fe7bbb93cd7aaa6921c141eddecab87
      url: https://github.com/martinbaillie/vault-plugin-secrets-github/releases/download/v2.3.2/vault-plugin-secrets-github-linux-amd64
    

    • settings.plugins.ca

      string

      PEM-encoded CA certificate(s) used to verify the HTTPS server for this plugin’s URL. If set, only this CA is trusted (not system CAs).
    • settings.plugins.ignoreFailure

      boolean

      If true, failure to download or verify this plugin does not block Stronghold startup, but the plugin functionality will not be available.

      Default: false

    • settings.plugins.insecureSkipVerify

      boolean

      If true, TLS server certificate is not verified for this plugin’s URL.

      Default: false

    • settings.plugins.name

      string

      Filename of the plugin binary after download.
    • settings.plugins.sha256

      string

      SHA256 checksum of the file. Download is rejected if the checksum does not match. This will block Stronghold startup unless ignoreFailure is set.

      Pattern: ^[a-fA-F0-9]{64}$

    • settings.plugins.url

      string

      URL to download the plugin binary (http or https, domain, path and filename). If the file is unavailable, this will block Stronghold startup unless ignoreFailure is set.

      Pattern: ^https?://[a-zA-Z0-9][-a-zA-Z0-9.]*[a-zA-Z0-9](/[^/]+)*/[^/.]+$

  • settings.publishCluster

    object

    Parameters for publishing the cluster.

    Cluster publishing allows organizing Performance and DR Replication between different Stronghold clusters. For details, see Replication (Performance and DR). Available only in the EE edition.

    When publishing is enabled for the Ingress or GatewayAPI inlet types, you must specify the clusterIDs you want to publish. You can publish only a Performance Replication cluster, only a DR Replication cluster, or both clusters at the same time. The identifier of the corresponding group can be viewed via the Stronghold API or in the UI on the replication page.

    When the Ingress inlet is used, cluster publishing requires an ingressClass with the controller type LoadBalancerWithSSLPassthrough or HostPortWithSSLPassthrough.

    • settings.publishCluster.clusterIDs

      array of strings

      IDs of the clusters for which the Stronghold cluster is published.

      Required when cluster publishing is enabled with the Ingress or GatewayAPI inlet. Must not be specified for the NodePort and LoadBalancer inlets.

      Example:

      clusterIDs:
      - 89f7566d-ed2b-02c9-4616-f07e87d3799d
      

      • settings.publishCluster.clusterIDs.Element of the array

        string

        Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$

    • settings.publishCluster.enabled

      boolean

      Enables cluster publishing.

      Default: false

  • settings.storageClass

    string

    The name of StorageClass that will be used.

    By default Stronghold keeps data in local storage on master nodes.

    If you change this parameter, a gradual data transfer will be performed to the new StorageClass if using a HA Stronghold configuration.

    For one-node Stronghold configurations, this parameter is only considered when the module is first started.

    If you need to change the StorageClass in a one-node Stronghold configuration, you can do this through backup/restore and disabling/enabling the module. In this case, don’t forget to save the unseal keys as described in the documentation.

    When changing this parameter, make sure the value specified in diskSizeGigabytes is sufficient for storing Stronghold data.

    Default: ‘’

    Examples:

    storageClass: ssd
    

    storageClass: ceph-rbd
    

  • settings.tolerations

    array of objects

    The same as the Pods’ spec.tolerations parameter in Kubernetes. If the parameter is omitted or false, tolerations will be determined automatically.
    • settings.tolerations.effect

      string
    • settings.tolerations.key

      string
    • settings.tolerations.operator

      string
    • settings.tolerations.tolerationSeconds

      integer
    • settings.tolerations.value