The stronghold module: configuration

Requirements

To the Deckhouse version: 1.71 and above.

Parameters

Schema version: 1

• settings

  object
  • settings.enableAuditLog

    boolean

    Enables audit log (EE only feature).

    Example:

    
    

    enableAuditLog: true
    

  • settings.enableUserInterface

    boolean

    Enables User Interface.

    Default: true

    Example:

    
    

    enableUserInterface: false
    

  • settings.https

    object

    What certificate type to use with Stronghold.

    This parameter completely overrides the global.modules.https settings.

    Examples:

    
    

    customCertificate:
      secretName: stronghold-tls
    mode: CustomCertificate
    

    certManager:
      clusterIssuerName: letsencrypt
    mode: CertManager
    

    • settings.https.certManager

      object
      • settings.https.certManager.clusterIssuerName

        string

        What ClusterIssuer to use for Stronghold.

        Currently, letsencrypt, letsencrypt-staging, selfsigned are available. Also, you can define your own.

        Default: letsencrypt

    • settings.https.customCertificate

      object

      Default: {}

      • settings.https.customCertificate.secretName

        string

        The name of the secret in the d8-system namespace to use with Stronghold.

        This secret must have the kubernetes.io/tls format.

        Default: false

    • settings.https.mode

      string

      The HTTPS usage mode:

      • CertManager — Stronghold will use HTTPS and get a certificate from the clusterissuer defined in the certManager.clusterIssuerName parameter.
      • CustomCertificate — Stronghold will use HTTPS using the certificate from the d8-system namespace.

      Default: CertManager

      Allowed values: CertManager, CustomCertificate

  • settings.ingress

    object

    Default: {}

    • settings.ingress.class

      string

      The class of the Ingress controller used for Stronghold.

      An optional parameter. By default, the modules.ingressClass global value is used.

      Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

      Example:

      
      

      class: public
      

  • settings.inlet

    string

    The way the connection to Stronghold is implemented.

    The following inlet types are supported:

    • Ingress — access via ingress-nginx controller.

    Default: Ingress

    Allowed values: Ingress

  • settings.license

    string

    Stronghold EE License key. Leave empty to use Stronghold CE

    Default:

  • settings.management

    object

    Default: {}

    • settings.management.administrators

      array of objects

      An list of users and groups that can access Stronghold as administrators. Other authenticated users will access Stronghold with default policy.

      Example:

      
      

      administrators:
      - name: admins
        type: Group
      - name: security
        type: Group
      - name: manager@mycompany.tld
        type: User
      

      • settings.management.administrators.name

        string
      • settings.management.administrators.type

        string

        Allowed values: Group, User

    • settings.management.mode

      string

      Automatic - enable Stronghold auto-init and auto-unseal. Root token will be stored in stronghold-keys Secret resource

      Default: Automatic

      Allowed values: Automatic

      Example:

      
      

      mode: Automatic
      

  • settings.plugins

    array of objects

    List of plugins to load into Stronghold. Each plugin is verified by SHA256 checksum.

    Example:

    
    

    plugins:
    - ignoreFailure: false
      name: vault-plugin-secrets-github
      sha256: 72cb1f2775ee2abf12ffb725e469d0377fe7bbb93cd7aaa6921c141eddecab87
      url: https://github.com/martinbaillie/vault-plugin-secrets-github/releases/download/v2.3.2/vault-plugin-secrets-github-linux-amd64
    

    • settings.plugins.ca

      string

      PEM-encoded CA certificate(s) used to verify the HTTPS server for this plugin's URL. If set, only this CA is trusted (not system CAs).
    • settings.plugins.ignoreFailure

      boolean

      If true, failure to download or verify this plugin does not block Stronghold startup, but the plugin functionality will not be available.

      Default: false

    • settings.plugins.insecureSkipVerify

      boolean

      If true, TLS server certificate is not verified for this plugin's URL.

      Default: false

    • settings.plugins.name

      string

      Filename of the plugin binary after download.
    • settings.plugins.sha256

      string

      SHA256 checksum of the file. Download is rejected if the checksum does not match. This will block Stronghold startup unless ignoreFailure is set.

      Pattern: ^[a-fA-F0-9]{64}$

    • settings.plugins.url

      string

      URL to download the plugin binary (http or https, domain, path and filename). If the file is unavailable, this will block Stronghold startup unless ignoreFailure is set.

      Pattern: ^https?://[a-zA-Z0-9][-a-zA-Z0-9.]*[a-zA-Z0-9](/[^/]+)*/[^/.]+$