The adoscore Helm chart
667
The Adoscore Helm chart provides the core services for the ADOS solution, including Security Manager, Configuration Manager, and Start.
The Adoscore Helm chart deploys the following Kubernetes resources:
Deployment: security
Manages the lifecycle of the Security Manager application pods, ensuring the specified number of replicas are running, specifying the ConfigMaps, Secret, volumeMounts, resources etc.
ConfigMap: security-env-configmap
Stores configuration data used by the Security Manager pods.
ConfigMap: security-env-configmap-logging
Stores logging configuration data for the Security Manager pods.
Secret: security-env-secrets
Stores secrets for the Security Manager pods
Service: security
Provides a stable endpoint for accessing the Security Manager pods, enabling load balancing and service discovery.
Deployment: configuration
Manages the lifecycle of the Configuration Manager application pods, ensuring the specified number of replicas are running, specifying the ConfigMaps, Secret, volumeMounts, resources etc.
ConfigMap: configuration
Stores configuration data used by the Configuration Manager pods.
Service: configuration
Provides a stable endpoint for accessing the Configuration Manager pods, enabling load balancing and service discovery.
Deployment: start
Manages the lifecycle of the Start application pods, ensuring the specified number of replicas are running, specifying the ConfigMaps, Secret, volumeMounts, resources etc.
ConfigMap: start
Stores configuration data used by the Start application pods.
Service: start
Provides a stable endpoint for accessing the Start application pods, enabling load balancing and service discovery.
security-configurationThe following sections describe the configurable parameters for the Adoscore Helm chart, including their default values. The default values refer to the values in the Helm chart and NOT necessarily the actual application.
| Name | Description | Default Value |
|---|---|---|
dbserver.name* | The name of the database server | "" |
dbserver.user* | The username credentials for the database server | "" |
dbserver.password* | The password credentials for the database server | "" |
website.site* | The domain name for the website | "" |
website.certificateName* | The name of the SSL certificate to be used for secure HTTPS connections | "app_listener" |
logging.minimumLevel | The minimum log level for the Security Manager application | "Information" |
*Note: Properties marked with an asterisk (*) are required.
| Name | Description | Default Value |
|---|---|---|
image.securityRepository* | The Docker Hub repository where the Security Manager image is stored | "atsproducts/ats.securitymanager-linux-x64" |
image.securityTag* | The tag for the Security Manager image | "latest" |
image.configurationRepository* | The Docker Hub repository where the Configuration Manager image is stored | "atsproducts/ats.configurationmanager-linux-x64" |
image.configurationTag* | The tag for the Configuration Manager image | "latest" |
image.startRepository* | The Docker Hub repository where the Start image is stored | "atsproducts/ats.start-linux-x64" |
image.startTag* | The tag for the Start image | "latest" |
image.pullPolicy* | Refers to the 'imagePullPolicy' setting in a Kubernetes Deployment or Container specification. It controls when the Kubernetes kubelet should pull (download) the container image from the registry | "Always" |
*Note: Properties marked with an asterisk (*) are required.
In Kubernetes, containers in a pod can be configured with resource requests and limits for CPU and memory. These configurations ensure that containers get the resources they need to run properly, while also preventing them from using more than their allocated share, which helps maintain the stability of the cluster. The resources are in a format: { "requests": { "memory": "", "cpu": ""}, "limits": { "memory": "", "cpu": ""} }
| Name | Description | Default Value |
|---|---|---|
resources.configuration | The resources for the Configuration Manager deployment | |
resources.security | The resources for the Security Manager deployment | null |
resources.start | The resources for the Start deployment | null |
The 'smtpSettings' parameters set the values for the SMTP server. If any property under 'smtpSettings' has a value other than an empty string or null, the application will read all SMTP settings from environment variables instead of the database. Otherwise, the settings variables will be ignored, and the database values will be used.
| Name | Description | Default Value |
|---|---|---|
smtpSettings.host | The host of the SMTP server | "" |
smtpSettings.port | The port of the SMTP server | 0 |
smtpSettings.authentication | Whether the SMTP server should use authentication. A boolean property | false |
smtpSettings.userName | The username for the SMTP server. Only used if 'smptSettings.authentication' is set to true | "" |
smtpSettings.password | The password for the SMTP server. Only used if 'smptSettings.authentication' is set to 'true' | "" |
smtpSettings.senderEmail | The SMTP email from which the server sends messages | "" |
smtpSettings.senderName | The SMTP sender name from which the server sends messages | "" |
smtpSettings.enableSsl | Whether the SMTP server is using SSL to send emails. A boolean property | false |
smtpSettings.enable | Whether the SMTP server is enabled. A boolean property | false |
LDAP queries the Windows Active Directory for all Groups with results ordered alphabetically. For better results, the LDAP Control Extension for Simple Paged Results Manipulation is used.
| Name | Description | Default Value |
|---|---|---|
ldap.pageSize | The default page size limit for results. The default value that Security Manager uses is 500. | 0 |
The DockerHub parameters are used for interacting with DockerHub's API, specifically for authentication and accessing Docker OCI artifacts. In ADOS those artificats are the plugins and language packs.
| Name | Description | Default Value |
|---|---|---|
dockerHub.authApiEndpoint | URL endpoint for Docker Hub's authentication service, where you can request tokens. The default value that Security Manager uses is: 'https://auth.docker.io/token' | "" |
dockerHub.registryApiEndpoint | Base URL for Docker Hub's registry API, which is used to interact with Docker images/artifacts. The default value that Security Manager uses is: 'https://registry-1.docker.io/v2/' | "" |
dockerHub.registryApiEndpointVersion | The version of the Docker Hub Registry API being used. The default value that Security Manager uses is: 'v2' | "" |
dockerHub.authService | The service name that the authentication token is requested for. The default value that Security Manager uses is: 'registry.docker.io' | "" |
dockerHub.authServiceAction | The action that the authentication token will allow. The default value that Security Manager uses is: 'pull' | "" |
dockerHub.distributionApiVersion | The version of the Docker distribution API being used. The default value that Security Manager uses is: 'registry/2.0' | "" |
dockerHub.repoNamespace | The namespace of the Docker repository on Docker Hub. The default value that Security Manager uses is: 'atsproducts' | "" |
| Name | Description | Default Value |
|---|---|---|
plugin.useDev | Whether the development registry for the plugin packages should be used. When set to false (default), only released versions of the plugin packages will be available for installation | false |
Define settings for WebHook scalling
| Name | Description | Default Value |
|---|---|---|
webHooks.senderCapacity | The number of senders that will be active at the moment. The default value that Security Manager uses is 1 | 0 |
webHooks.queueCapacity | The number of elements the global queue can contain. The default value that Security Manager uses is 200 | 0 |
| Name | Description | Default Value |
|---|---|---|
databaseConfiguration.commandTimeout | The database command timeout value in seconds. The default value that Security Manager uses is 30 seconds. | 0 |
| Name | Description | Default Value |
|---|---|---|
security.publicOrigin | By default, IdentityServer uses the host, protocol, and port from the HTTP request when creating links. This might not be accurate in reverse proxy or load-balancing situations. You can override the origin used for link generation using this property | "" |
configuration.version | The Security Manager version. By default the application refers to the versions specified in the appSettings.json file | "" |
configuration.environmentIdentification | Specifies the environment for the application e.g. "QA Testing" | "" |
configuration.dataProtection.keyStorage.type | Defines a type of location for the storage of the key. Possible types are: 'Default', 'FileSystem', 'AzureBlobStorage' and 'Redis' | "" |
configuration.dataProtection.keyStorage.uri | Used when the key storage type is 'AzureBlobStorage' or 'Redis'. Defines the path URI to the blob including SAS token or the path to the Redis Cache storage | "" |
configuration.dataProtection.keyStorage.path | Used when the key storage type is 'FileSystem'. Defines a path where the key will be stored | "" |
configuration.dataProtection.keyStorage.connectionstring | Used when the key storage type is 'AzureBlobStorage'. Defines the connection string to the storage account | "" |
configuration.dataProtection.keyStorage.containerName | Used when the key storage type is 'AzureBlobStorage'. Defines the container name. If not defined 'data-protection-keys' container will be used | "" |
configuration.dataProtection.keyStorage.blobName | Used when the key storage type is 'AzureBlobStorage'. Defines the name of the key file. If not specified keys.xml will be used | "" |
configuration.dataProtection.keyProtection.type | A type for the key ring protection. Possible types are: 'AzureKeyVault', 'CertificatePEM', 'CertificatePFX' and 'CertificateThumbprint' | "" |
configuration.dataProtection.keyProtection.keyIdentifier | Used when the key ring protection type is 'AzureKeyVault'. Defines the key identifier | "" |
configuration.dataProtection.keyProtection.tennantId | Used when the key ring protection type is 'AzureKeyVault'. Defines the tennat id | "" |
configuration.dataProtection.keyProtection.clientId | Used when the key ring protection type is 'AzureKeyVault'. Defines the client id | "" |
configuration.dataProtection.keyProtection.clientSecret | Used when the key ring protection type is 'AzureKeyVault'. Defines the client secret | "" |
configuration.dataProtection.keyProtection.certificatePath | Used when the key ring protection type is 'CertificatePEM' or 'CertificatePFX'. Defines the path to the PEM or PFX certificate | "" |
configuration.dataProtection.keyProtection.keyPath | Used when the key ring protection type is 'CertificatePEM'. Defines the path to the PEM key | "" |
configuration.dataProtection.keyProtection.certificatePassword | Used when the key ring protection type is 'CertificatePFX'. Defines the password for the PFX certificate | "" |
configuration.dataProtection.keyProtection.certificateThumbprint | Used when the key ring protection type is 'CertificateThumbprint'. Defines the certificate thumbprint | "" |
configuration.tokenSigningCertificate.type | The type of flow used for the certificate used for the signing of tokens. Possible types are: 'Store', 'File', 'Base64' and 'PemFile'. | "" |
configuration.tokenSigningCertificate.value | The certificate value if the store specifies a value from the store, or if the file specifies the location of PFX or if Base64 specifies the Base64 string | "" |
configuration.tokenSigningCertificate.password | The password for the certificate | "" |
configuration.tokenSigningCertificate.certificatePath | The file path for the Pem certificate | "" |
configuration.tokenSigningCertificate.keyPath | The key path for the Pem certificate | "" |
There are 2 types of seed data parameters:
| Name | Description | Default Value |
|---|---|---|
seed.initialAdminPassword | When creating the database, the admin user has a password by default. Upon the next login the admin user is forced to change the password. If there is a new password set in the password property, then the default password is replaced. If the password meets all the requirements for password complexity and is saved in the database, then the admin user will not be forced to change password on next login | "" |
| Name | Description | Default Value |
|---|---|---|
seed.settings.userManagerOptions.passwordOptions.requireDigit | Specifies whether the password should contain at least one number | false |
seed.settings.userManagerOptions.passwordOptions.requireLowercase | Specifies whether the password should contain at least one lowercase letter | false |
seed.settings.userManagerOptions.passwordOptions.requireNonAlphanumeric | Specifies whether the password should contain at least one special character such as '$'. "%', '&' etc. | false |
seed.settings.userManagerOptions.passwordOptions.requireUppercase | Specifies whether the password should contain at least one uppercase letter | false |
seed.settings.userManagerOptions.passwordOptions.requiredLength | The length of the password. Recommended value is from 6 to 16 | 0 |
seed.settings.userManagerOptions.passwordOptions.passwordNeverExpires | Specifies whether the password should expire | false |
seed.settings.userManagerOptions.passwordOptions.passwordExpirationDuration | Expiration duration in days for a user's password. Only relevant when passwordNeverExpires is false | 0 |
seed.settings.userManagerOptions.passwordOptions.previousPasswordsToCheck | Number of previous passwords of the user that ca not match with the new password. If value is 0 then users will be able to specify any password except the current password | 0 |
seed.settings.userManagerOptions.lockoutOptions.disableUserLockout | Specifies whether the user lockout is enabled/disabled. When false all other lockout settings are disregarded | false |
seed.settings.userManagerOptions.lockoutOptions.lockoutNeverEnds | If true the lockout of users will never end automatically, only an administrator can unlock the user. | false |
seed.settings.userManagerOptions.lockoutOptions.maxFailedAccessAttempts | The number of attempts the users can enter their credentials incorrectly before their account is locked | 0 |
seed.settings.userManagerOptions.lockoutOptions.defaultLockoutDuration | Duration in minutes of the lockout period | 0 |
seed.settings.userManagerOptions.userRegistration.retentionPeriodOfUnconfirmedUsers | Number of days for automatically deleting unconfirmed accounts | 0 |
seed.settings.userManagerOptions.userRegistration.defaultRoleId | The id of the role that will be set as a default one and every new user will be assigned that role. Because the properties are read only when seeding the database the available role ids are: Admin: c7fb6e03-9149-4f41-be9e-deedd98b0279 and Guest: 22a41932-2d64-498a-a795-ffbd7c863aa5 | "" |
seed.settings.userManagerOptions.userRegistration.enableSelfRegistration | Specifies whether self-registration should be enabled | false |
seed.settings.userManagerOptions.userRegistration.requireApprovalOfUser | Specifies whether all newly created users will have to wait for administrators approval to activate their account | false |
seed.settings.userManagerOptions.userRegistration.registrationDialogText | The text that will be displayed on the registration screen | "" |
seed.settings.generalSettingsOptions.enableForgotPassword | When set to true a Forgot password link is displayed on the ATS Security login page | false |
seed.settings.generalSettingsOptions.expiryPeriodConfirmationLinks | The expiry period in hours for Confirmation links. Accepts values between 1 and 48 | 0 |
seed.settings.generalSettingsOptions.expiryPeriodResetPasswordLinks | The expiry period in hours for Reset password links. Accepts values between 1 and 48 | 0 |
seed.settings.generalSettingsOptions.enableWebHooks | Whether the data exchange functionality is enabled for all applications | false |
seed.settings.loginPageOptions.showExternalProviders | Wether the external identity providers will be shown on the login screen | false |
seed.settings.loginPageOptions.supportEmail | The email for the users to contact the administrator | "" |
seed.settings.loginPageOptions.loginDialogText | The text displayed on the login screen | "" |
seed.settings.captchaOptions.selectedCaptchaType | The type of captcha used. Possible types: None: 0, Captcha: 1 and GoogleCaptcha: 2 | 0 |
seed.settings.captchaOptions.loginViewEnabled | Whether the Captcha image generator will be available on the Login screen | false |
seed.settings.captchaOptions.forgotPasswordViewEnabled | Whether the Captcha image generator will be available on the Forgot Password screen | false |
seed.settings.captchaOptions.changePasswordViewEnabled | Whether the Captcha image generator will be available on the Change Password screen | false |
seed.settings.captchaOptions.registerViewEnabled | Whether the Captcha image generator will be available on the Register screen | false |
seed.settings.captchaOptions.recaptchaSiteKey | Used when the captcha type is GoogleCaptcha. Defines the site key for GoogleCaptcha | "" |
seed.settings.captchaOptions.recaptchaSecretKey | Used when the captcha type is GoogleCaptcha. Defines the secret key used for communication between domain and Google to verify the validity of the Captcha | "" |
seed.settings.pluginSettingsOptions.autoCheckVersion | When set to true the latest version of the plugins is checked and displayed in the plugins grid to indicate an upgrade is available | false |
seed.settings.pluginSettingsOptions.autoDownloadVersion | When set to true the latest version of the plugins is automatically downloaded | false |
seed.settings.notificationSettingsOptions.expirationDays | The number of days notifications are persited in the database after being read | 0 |
Seeds the pre-configured applications. Only if a Guid for an application is specified, will that application be seeded
| Name | Description | Default Value |
|---|---|---|
seed.cm4dApplication | The Guid id of the ATS CM4D application | "" |
seed.reportingApplication | The Guid id of the ATS Reporting application | "" |
seed.licensingApplication | The Guid id of the ATS Licensing application | "" |
seed.busApplication | The Guid id of the ATS Bus application | "" |
seed.inspectApplication | The Guid id of the ATS Bus application | "" |
Only a single external provider is avaible to be seeded from the Helm chart.
| Name | Description | Default Value |
|---|---|---|
seed.useExternalProvider | Specifies whether this provider should be seeded | false |
seed.externalProviderType | The type of the Identity provider. Possible types are: Windows: 1, Google: 2, Facebook: 3, Azure: 5, GitHub: 6, Saml: 7 | 1 |
seed.externalProviderDisplayName | The display name of the provider | "" |
seed.externalProviderEnabled | Whether the provider is enabled | true |
seed.externalProviderClientId | The client id of the provider | "" |
seed.externalProviderClientSecret | The client secret of the provider | "" |
seed.externalProviderTenantId | The tenant id of the provider | "" |
seed.externalProviderEnableAutoRegister | Whether the AutoRegister functionality is enabled for the provider | false |
seed.externalProviderAuthority | The authority of the provider | "" |
seed.externalProviderHost | The host of the provider | "" |
seed.externalProviderPort | The port of the provider | 80 |
| Name | Description | Default Value |
|---|---|---|
configurationManager.version | The Configuration Manager version. By default the application refers to the version specified in the appSettings.json file | "" |
configurationManager.hotjarId | The hotjar id of your unique Hotjar account. If a value is provided Hotjar tracking will be activated for Configuration Manager | "" |
configurationManager.contentSecurity.scriptSources | An array that defines the allowed sources from which scripts can be loaded and executed in Configuration Manager | [] |
configurationManager.contentSecurity.styleSources | An array that defines the allowed sources from which stylesheets can be loaded and applied in Configuration Manager | [] |
| Name | Description | Default Value |
|---|---|---|
start.version | The Start version. By default the application refers to the version specified in the appSettings.json file | "" |
start.hotjarId | The hotjar id of your unique Hotjar account. If a value is provided Hotjar tracking will be activated for Start | "" |
start.contentSecurity.scriptSources | An array that defines the allowed sources from which scripts can be loaded and executed in Start | [] |
start.contentSecurity.styleSources | An array that defines the allowed sources from which stylesheets can be loaded and applied in Start | [] |
| Name | Description | Default Value |
|---|---|---|
ingress.usePrivate | Specifies whether the ingress controller should use the private IP address of the Azure Application Gateway | false |
volumesAndMounts.volumeMounts | The volume mounts for the ADOS deployments | null |
volumesAndMounts.volumes | The volumes for the ADOS deployments | null |
Content type
Helm
Digest
sha256:434804f92…
Size
21.3 kB
Last updated
11 months ago
helm pull oci://registry-1.docker.io/atsproducts/adoscore --version 3.4.0