## @section Global parameters ## Global Docker image parameters ## Please, note that this will override the image parameters, including dependencies, configured to use the global value ## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass ## @param global.imageRegistry Global Docker image registry ## @param global.imagePullSecrets Global Docker registry secret names as an array ## @param global.storageClass Global StorageClass for Persistent Volume(s) ## global: imageRegistry: "" ## E.g. ## imagePullSecrets: ## - myRegistryKeySecretName ## imagePullSecrets: [] storageClass: "" ## @section Common parameters ## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) ## kubeVersion: "" ## @param nameOverride String to partially override freeradius.fullname ## nameOverride: "" ## @param namespaceOverride String to partially override freeradius.namespace ## namespaceOverride: "" ## @param fullnameOverride String to fully override adminer.fullname ## fullnameOverride: "" ## @param commonLabels Labels to add to all deployed objects ## commonLabels: {} ## @param commonAnnotations Annotations to add to all deployed objects ## commonAnnotations: {} ## @param clusterDomain Default Kubernetes cluster domain ## clusterDomain: cluster.local ## @param extraDeploy Array of extra objects to deploy with the release ## extraDeploy: [] ## Enable diagnostic mode in the deployment ## diagnosticMode: ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) ## enabled: false ## @param diagnosticMode.command Command to override all containers in the deployment ## command: - sleep ## @param diagnosticMode.args Args to override all containers in the deployment ## args: - infinity ## @section FreeRADIUS Image parameters ## FreeRADIUS image ## ref: https://hub.docker.com/r/freeradius/freeradius-server/tags ## @param image.registry FreeRADIUS image registry ## @param image.repository FreeRADIUS image repository ## @param image.tag FreeRADIUS image tag (immutable tags are recommended) ## @param image.pullPolicy FreeRADIUS image pull policy ## @param image.pullSecrets Specify docker-registry secret names as an array ## @param image.debug Specify if debug logs should be enabled ## image: registry: gitea.infrastructure.helmholz.cloud repository: gitea_admin/freeradius-server tag: "3.2.7" ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace) ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ## Example: ## pullSecrets: ## - myRegistryKeySecretName ## pullSecrets: [] ## Set to true if you would like to see extra information on logs ## It turns BASH and/or NAMI debugging in the image ## debug: false ## @param architecture FreeRADIUS architecture (`standalone` or `replication`) ## architecture: standalone auth: ## @param auth.createClientUser Create client user on boot ## createClientUser: true ## @param auth.clientUser FreeRADIUS administrator user ## clientUser: user ## @param auth.clientPassword FreeRADIUS administrator password for the new user ## clientUserPassword: "" ## @param auth.existingSecret An already existing secret containing auth info ## e.g: ## existingSecret: ## name: mySecret ## keyMapping: ## client-user-password: myPasswordKey ## existingSecret: "" ## @param auth.existingSecretPerPassword Override `existingSecret` and other secret values ## e.g: ## existingSecretPerPassword: ## keyMapping: ## clientUserPassword: FREERADIUS_ADMIN_PASSWORD ## databasePassword: password ## databasePassword: ## name: freeradius.pocwatt-freeradius-cluster.credentials ## existingSecretPerPassword: {} ## @param configuration FreeRADIUS Configuration. Auto-generated based on other parameters when not specified ## Specify content for keycloak.conf ## NOTE: This will override configuring FreeRADIUS based on environment variables (including those set by the chart) ## The radiusd.conf is auto-generated based on other parameters when this parameter is not specified ## ## Example: ## configuration: |- ## foo: bar ## baz: ## configuration: "" ## @param configurationConfigMap ConfigMap with the FreeRADIUS configuration files (Note: Overrides `radiusdConfiguration`). The value is evaluated as a template. ## configurationConfigMap: "" ## @param existingConfigmap Name of existing ConfigMap with FreeRADIUS configuration ## NOTE: When it's set the configuration parameter is ignored ## existingConfigmap: "" ## @param extraStartupArgs Extra default startup args ## extraStartupArgs: "" ## initdb scripts ## @param initdbScripts Specify dictionary of scripts to be run at first boot ## Alternatively, you can put your scripts under the files/docker-entrypoint-initdb.d directory ## e.g: ## initdbScripts: ## my_init_script.sh: | ## #!/bin/sh ## echo "Do something." ## initdbScripts: {} ## @param initdbScriptsConfigMap ConfigMap with the initdb scripts (Note: Overrides `initdbScripts`) ## initdbScriptsConfigMap: "" ## @param primary.command Override default container command on FreeRADIUS container(s) (useful when using custom images) ## command: [] ## @param primary.args Override default container args on FreeRADIUS container(s) (useful when using custom images) ## args: [] ## @param primary.lifecycleHooks for the FreeRADIUS container(s) to automate configuration before or after startup ## lifecycleHooks: {} ## @param primary.hostAliases Add deployment host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## hostAliases: [] ## @param primary.configuration [string] FreeRADIUS configuration to be injected as ConfigMap ## ref: https://mysql.com/kb/en/mysql/configuring-mysql-with-mycnf/#example-of-configuration-file ## ## @section FreeRADIUS Deployment parameters ## @param replicaCount Desired number of cluster nodes ## replicaCount: 1 ## @param updateStrategy.type updateStrategy for FreeRADIUS Master StatefulSet ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies ## updateStrategy: type: RollingUpdate ## @param podLabels Extra labels for FreeRADIUS pods ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## podLabels: {} ## @param podAnnotations Annotations for FreeRADIUS pods ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## podAnnotations: {} ## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAffinityPreset: "" ## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAntiAffinityPreset: soft ## Node affinity preset ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity ## nodeAffinityPreset: ## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` ## type: "" ## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set. ## E.g. ## key: "kubernetes.io/e2e-az-name" ## key: "" ## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set. ## E.g. ## values: ## - e2e-az1 ## - e2e-az2 ## values: [] ## @param affinity Affinity for FreeRADIUS pods assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set ## affinity: {} ## @param nodeSelector Node labels for FreeRADIUS pods assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} ## @param tolerations Tolerations for FreeRADIUS pods assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## tolerations: [] ## @param topologySpreadConstraints Topology Spread Constraints for FreeRADIUS pods assignment ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## E.g. ## topologySpreadConstraints: ## - maxSkew: 1 ## topologyKey: topology.kubernetes.io/zone ## whenUnsatisfiable: DoNotSchedule ## topologySpreadConstraints: {} ## @param priorityClassName Priority class for FreeRADIUS pods assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ ## priorityClassName: "" ## @param schedulerName Name of the k8s scheduler (other than default) ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ ## schedulerName: "" ## @param podManagementPolicy podManagementPolicy to manage scaling operation of FreeRADIUS pods ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies ## podManagementPolicy: "" ## @param containerPorts.auth FreeRADIUS Auth container port ## @param containerPorts.acct FreeRADIUS Accounting container port ## @param containerPorts.status FreeRADIUS Status HTTP container port ## containerPorts: auth: 1812 acct: 1813 coa: 3799 radsec: 2083 status: 18121 ## FreeRADIUS Pod security context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod ## @param podSecurityContext.enabled Enable security context for FreeRADIUS pods ## @param podSecurityContext.fsGroup Group ID for the mounted volumes' filesystem ## podSecurityContext: enabled: false fsGroup: 101 runAsUser: 101 ## FreeRADIUS container security context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container ## @param containerSecurityContext.enabled FreeRADIUS container securityContext ## @param containerSecurityContext.runAsUser User ID for the FreeRADIUS container ## @param containerSecurityContext.runAsNonRoot Set Controller container's Security Context runAsNonRoot ## containerSecurityContext: enabled: true allowPrivilegeEscalation: false capabilities: add: - SYS_PTRACE drop: - ALL privileged: false readOnlyRootFilesystem: true runAsUser: 101 runAsNonRoot: true ## Resource requests and limits ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ ## We usually recommend not to specify default resources and to leave this as a conscious ## choice for the user. This also increases chances charts run on environments with little ## resources, such as Minikube. If you do want to specify resources, uncomment the following ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. ## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). ## More information: https://github.com/startechnica/apps/blob/main/charts/common/templates/_resources.tpl#L15 ## resourcesPreset: "nano" ## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) ## Example: ## resources: ## requests: ## cpu: 2 ## memory: 512Mi ## limits: ## cpu: 3 ## memory: 1024Mi ## resources: {} ## Configure extra options for FreeRADIUS containers' liveness, readiness and startup probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) ## @param startupProbe.enabled Enable startupProbe ## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe ## @param startupProbe.periodSeconds Period seconds for startupProbe ## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe ## @param startupProbe.failureThreshold Failure threshold for startupProbe ## @param startupProbe.successThreshold Success threshold for startupProbe ## startupProbe: enabled: false initialDelaySeconds: 120 periodSeconds: 15 timeoutSeconds: 5 failureThreshold: 10 successThreshold: 1 ## Configure extra options for liveness probe ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes ## @param livenessProbe.enabled Enable livenessProbe ## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param livenessProbe.periodSeconds Period seconds for livenessProbe ## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe ## @param livenessProbe.failureThreshold Failure threshold for livenessProbe ## @param livenessProbe.successThreshold Success threshold for livenessProbe ## livenessProbe: enabled: true initialDelaySeconds: 120 periodSeconds: 60 timeoutSeconds: 2 failureThreshold: 3 successThreshold: 1 ## @param readinessProbe.enabled Enable readinessProbe ## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param readinessProbe.periodSeconds Period seconds for readinessProbe ## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe ## @param readinessProbe.failureThreshold Failure threshold for readinessProbe ## @param readinessProbe.successThreshold Success threshold for readinessProbe ## readinessProbe: enabled: true initialDelaySeconds: 30 periodSeconds: 10 timeoutSeconds: 1 failureThreshold: 3 successThreshold: 1 ## @param customStartupProbe Override default startup probe for FreeRADIUS containers ## customStartupProbe: {} ## @param customLivenessProbe Override default liveness probe for FreeRADIUS containers ## customLivenessProbe: {} ## @param customReadinessProbe Override default readiness probe for FreeRADIUS containers ## customReadinessProbe: {} ## @param startupWaitOptions Override default builtin startup wait check options for FreeRADIUS containers ## `bitnami/mariadb` Docker image has built-in startup check mechanism, ## which periodically checks if FreeRADIUS service has started up and stops it ## if all checks have failed after X tries. Use these to control these checks. ## ref: https://github.com/bitnami/bitnami-docker-mariadb/pull/240 ## Example (with default options): ## startupWaitOptions: ## retries: 300 ## waitTime: 2 ## startupWaitOptions: {} ## @param extraFlags FreeRADIUS additional command line flags ## Can be used to specify command line flags, for example: ## E.g. ## extraFlags: "--max-connect-errors=1000 --max_connections=155" ## extraFlags: "" ## @param extraEnvVars Extra environment variables to be set on FreeRADIUS containers ## E.g. ## extraEnvVars: ## - name: TZ ## value: "Europe/Paris" ## extraEnvVars: [] ## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars for FreeRADIUS containers ## extraEnvVarsCM: "" ## @param extraEnvVarsSecret Name of existing Secret containing extra env vars for FreeRADIUS containers ## extraEnvVarsSecret: "" ## @section Persistence Parameters ## Persistence Parameters ## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/ ## persistence: ## @param persistence.enabled Enable persistence on FreeRADIUS replicas using a `PersistentVolumeClaim` ## enabled: false ## @param persistence.existingClaim Name of an existing `PersistentVolumeClaim` for FreeRADIUS primary replicas ## NOTE: When it's set the rest of persistence parameters are ignored ## existingClaim: "" ## @param persistence.subPath Subdirectory of the volume to mount at ## subPath: "" ## @param persistence.mountPath Path to mount the volume at ## mountPath: /startechnica/freeradius ## @param persistence.storageClass FreeRADIUS persistent volume storage Class ## If defined, storageClassName: ## If set to "-", storageClassName: "", which disables dynamic provisioning ## If undefined (the default) or set to null, no storageClassName spec is ## set, choosing the default provisioner. (gp2 on AWS, standard on ## GKE, AWS & OpenStack) ## storageClass: "" ## @param persistence.annotations FreeRADIUS persistent volume claim annotations ## annotations: {} ## @param persistence.accessModes FreeRADIUS persistent volume access Modes ## accessModes: - ReadWriteOnce ## @param persistence.size FreeRADIUS persistent volume size ## size: 8Gi ## @param persistence.selector Selector to match an existing Persistent Volume ## selector: ## matchLabels: ## app: my-app ## selector: {} ## 'volumePermissions' init container parameters ## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values ## based on the podSecurityContext/containerSecurityContext parameters ## volumePermissions: ## @param volumePermissions.enabled Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` ## enabled: false ## Bitnami Shell image ## ref: https://hub.docker.com/r/bitnami/bitnami-shell/tags/ ## @param volumePermissions.image.registry Bitnami Shell image registry ## @param volumePermissions.image.repository Bitnami Shell image repository ## @param volumePermissions.image.tag Bitnami Shell image tag (immutable tags are recommended) ## @param volumePermissions.image.pullPolicy Bitnami Shell image pull policy ## @param volumePermissions.image.pullSecrets Bitnami Shell image pull secrets ## image: registry: docker.io repository: bitnami/os-shell tag: "11" digest: "" pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ## e.g: ## pullSecrets: ## - myRegistryKeySecretName ## pullSecrets: [] ## Init container's resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ ## @param volumePermissions.resources.limits The resources limits for the init container ## @param volumePermissions.resources.requests The requested resources for the init container ## resources: limits: {} requests: {} ## Init container Container Security Context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container ## @param volumePermissions.securityContext.runAsUser Set init container's Security Context runAsUser ## NOTE: when runAsUser is set to special value "auto", init container will try to chown the ## data folder to auto-determined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` ## "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed) ## securityContext: runAsUser: 0 ## @param extraVolumes Optionally specify extra list of additional volumes to the FreeRADIUS pod(s) ## extraVolumes: [] ## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for the FreeRADIUS container(s) ## extraVolumeMounts: [] ## @param initContainers Add additional init containers for the FreeRADIUS pod(s) ## initContainers: [] ## @param sidecars Add additional sidecar containers for the FreeRADIUS pod(s) ## sidecars: [] ## @section Traffic Exposure Parameters ## FreeRADIUS service parameters ## service: ## @param service.type FreeRADIUS Kubernetes service type ## type: ClusterIP ## @param service.ports.auth FreeRADIUS Kubernetes service port ## ports: auth: 1812 acct: 1813 coa: 3799 radsec: 2083 status: 18121 ## @param service.nodePorts.mysql FreeRADIUS Kubernetes service node port ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport ## nodePorts: auth: "" acct: "" coa: "" radsec: "" status: "" ## @param service.clusterIP FreeRADIUS Kubernetes service clusterIP IP ## clusterIP: "" ## @param service.loadBalancerIP FreeRADIUS loadBalancerIP if service type is `LoadBalancer` ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer ## loadBalancerIP: "" ## @param service.ipFamilyPolicy FreeRADIUS Kubernetes service ipFamilyPolicy policy ## ipFamilyPolicy: SingleStack ## @param service.externalTrafficPolicy Enable client source IP preservation ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip ## externalTrafficPolicy: Cluster ## @param service.allocateLoadBalancerNodePorts Allow users to disable node ports for Service Type=LoadBalancer. This is useful for ## bare metal / on-prem environments that rely on VIP based LB implementations. ## ref https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation ## allocateLoadBalancerNodePorts: "false" ## @param service.loadBalancerClass Enables to use a load balancer implementation other than the cloud provider default. ## https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class ## loadBalancerClass: "" ## @param service.loadBalancerSourceRanges Address that are allowed when FreeRADIUS service is LoadBalancer ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service ## E.g. ## loadBalancerSourceRanges: ## - 10.10.10.0/24 ## loadBalancerSourceRanges: [] ## @param service.extraPorts Extra ports to expose (normally used with the `sidecar` value) ## extraPorts: [] ## @param service.annotations Provide any additional annotations which may be required ## annotations: {} ## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" ## If "ClientIP", consecutive client requests will be directed to the same Pod ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies ## sessionAffinity: None ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity ## sessionAffinityConfig: ## clientIP: ## timeoutSeconds: 300 sessionAffinityConfig: {} ## Configure the ingress resource that allows you to access the FreeRADIUS installation ## ref: https://kubernetes.io/docs/user-guide/ingress/ ## ingress: ## @param ingress.enabled Enable ingress record generation for FreeRADIUS ## enabled: false ## @param ingress.pathType Ingress path type ## pathType: ImplementationSpecific ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) ## apiVersion: "" ## @param ingress.hostname Default host for the ingress record ## hostname: freeradius.local ## @param ingress.path Default path for the ingress record ## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers ## path: / ## @param ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. ## For a full list of possible ingress annotations, please see ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md ## Use this parameter to set the required annotations for cert-manager, see ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations ## ## e.g: ## annotations: ## kubernetes.io/ingress.class: nginx ## cert-manager.io/cluster-issuer: cluster-issuer-name ## annotations: {} ## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}` ## You can: ## - Use the `ingress.secrets` parameter to create this TLS secret ## - Rely on cert-manager to create it by setting the corresponding annotations ## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true` ## tls: false ## DEPRECATED: Use ingress.annotations instead of ingress.certManager ## certManager: false ## ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm ## selfSigned: false ## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record ## e.g: ## extraHosts: ## - name: freeradius.local ## path: / ## extraHosts: [] ## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host ## e.g: ## extraPaths: ## - path: /* ## backend: ## serviceName: ssl-redirect ## servicePort: use-annotation ## extraPaths: [] ## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls ## e.g: ## extraTls: ## - hosts: ## - freeradius.local ## secretName: freeradius.local-tls ## extraTls: [] ## @param ingress.secrets Custom TLS certificates as secrets ## NOTE: 'key' and 'certificate' are expected in PEM format ## NOTE: 'name' should line up with a 'secretName' set further up ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days ## It is also possible to create and manage the certificates outside of this helm chart ## Please see README.md for more information ## e.g: ## secrets: ## - name: freeradius.local-tls ## key: |- ## -----BEGIN RSA PRIVATE KEY----- ## ... ## -----END RSA PRIVATE KEY----- ## certificate: |- ## -----BEGIN CERTIFICATE----- ## ... ## -----END CERTIFICATE----- ## secrets: [] ## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster . ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ ## ingressClassName: "" ## @param ingress.extraRules Additional rules to be covered with this ingress record ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules ## e.g: ## extraRules: ## - host: example.local ## http: ## path: / ## backend: ## service: ## name: example-svc ## port: ## name: http ## extraRules: [] ## @param revisionHistoryLimit Maximum number of revisions that will be maintained in the Deployment ## revisionHistoryLimit: 3 ## @section RBAC parameter # ## Specifies whether a ServiceAccount should be created ## serviceAccount: ## @param serviceAccount.create Enable the creation of a ServiceAccount for Adminer pods ## create: true ## @param serviceAccount.name Name of the created ServiceAccount ## If not set and create is true, a name is generated using the fullname template ## name: "" ## @param serviceAccount.automountServiceAccountToken Auto-mount the service account token in the pod ## automountServiceAccountToken: false ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount ## annotations: {} ## Role Based Access ## Ref: https://kubernetes.io/docs/admin/authorization/rbac/ ## rbac: ## @param rbac.create Specify whether RBAC resources should be created and used ## create: false ## @param rbac.rules Custom RBAC rules ## Example: ## rules: ## - apiGroups: ## - "" ## resources: ## - pods ## verbs: ## - get ## - list ## rules: [] ## Network Policy configuration ## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ ## networkPolicy: ## @param networkPolicy.enabled Enable the default NetworkPolicy policy ## enabled: false ## @param networkPolicy.allowExternal Don't require client label for connections ## The Policy model to apply. When set to false, only pods with the correct ## client label will have network access to the ports Keycloak is listening ## on. When true, Keycloak will accept connections from any source ## (with the correct destination port). ## allowExternal: true ## @param networkPolicy.additionalRules Additional NetworkPolicy rules ## Note that all rules are OR-ed. ## Example: ## additionalRules: ## - matchLabels: ## - role: frontend ## - matchExpressions: ## - key: role ## operator: In ## values: ## - frontend ## additionalRules: {} ## Pod disruption budget configuration ## podDisruptionBudget: ## @param podDisruptionBudget.create Specifies whether a Pod disruption budget should be created ## create: false ## @param podDisruptionBudget.minAvailable Minimum number / percentage of pods that should remain scheduled ## minAvailable: 1 ## @param podDisruptionBudget.maxUnavailable Maximum number / percentage of pods that may be made unavailable ## maxUnavailable: "" ## MariaDB chart configuration ## ref: https://github.com/bitnami/charts/blob/master/bitnami/mariadb/values.yaml ## @param mariadb.enabled Switch to enable or disable the MariaDB helm chart ## @param mariadb.auth.username Name for a custom user to create ## @param mariadb.auth.password Password for the custom user to create ## @param mariadb.auth.database Name for a custom database to create ## @param mariadb.auth.existingSecret Name of existing secret to use for MariaDB credentials ## @param mariadb.architecture MariaDB architecture (`standalone` or `replication`) ## mariadb: enabled: false auth: username: freeradius_user password: "" database: freeradius_db existingSecret: "" architecture: standalone ## External Database configuration ## All of these values are only used when mariadb.enabled is set to false ## @param externalDatabase.host Database host ## @param externalDatabase.port Database port number ## @param externalDatabase.user Non-root username for FreeRADIUS ## @param externalDatabase.password Password for the non-root username for FreeRADIUS ## @param externalDatabase.database FreeRADIUS database name ## @param externalDatabase.existingSecret Name of an existing secret resource containing the database credentials ## @param externalDatabase.existingSecretPasswordKey Name of an existing secret key containing the database credentials ## externalDatabase: host: "" port: 3306 user: freeradius_user database: freeradius_db password: "" existingSecret: "" existingSecretPasswordKey: "" modsEnabled: sql: enabled: true dialect: mysql table: acct1: radacct acct2: radacct authcheck: radcheck authreply: radreply client: nas groupcheck: radgroupcheck groupreply: radgroupreply postauth: radpostauth usergroup: radusergroup sqlippool: radippool ## @param modsEnabled.sql.groupAttribute The group attribute specific to this instance of rlm_sql ## groupAttribute: SQL-Group ## @param modsEnabled.sql.readClients Set to 'true' to read radius clients from the database ('nas' table) ## readClients: true ## @param modsEnabled.sql.tls.enabled ## @param modsEnabled.sql.tls.autoGenerated Generate automatically self-signed SQL TLS certificates ## @param modsEnabled.sql.tls.certificatesSecret ## @param modsEnabled.sql.tls.certFilename ## @param modsEnabled.sql.tls.certKeyFilename ## @param modsEnabled.sql.tls.certCAFilename ## @param modsEnabled.sql.tls.existingTlsSecret ## @param modsEnabled.sql.tls.privateKeyPassword ## tls: enabled: false ciphers: "" autoGenerated: true certificatesSecret: "" certFilename: "" certKeyFilename: "" certCAFilename: "" existingTlsSecret: "" privateKeyPassword: whatever ## @param modsEnabled.sql.sqllite.filename ## @param modsEnabled.sql.sqllite.busyTimeout ## sqlite: filename: /startechnica/freeradius/freeradius.db busyTimeout: "200" sitesEnabled: coa: enabled: false status: enabled: true listen: 127.0.0.1 secret: adminsecret tls: ## @param sitesEnabled.tls.enabled Enable TLS support for radsec traffic ## enabled: false privateKeyPassword: "" cipher: "DEFAULT" clients: localhost: ipv4addr: "127.0.0.1" ipv6addr: "" proto: udp secret: password nasType: other virtualServer: default coaServer: coa limit: maxConnections: 16 lifetime: 0 idleTimeout: 30 existingConfigMapName: "" tls: ## @param tls.enabled Enable TLS support for FreeRADIUS ## enabled: false ## @param tls.autoGenerated Generate automatically self-signed TLS certificates ## autoGenerated: true autoGenerator: certmanager: enabled: false issuerKind: ClusterIssuer issuerName: selfsigned-issuer ## @param tls.certificatesSecret Name of the secret that contains the certificates ## certificatesSecret: "" ## @param tls.certFilename Certificate filename ## certFilename: "" ## @param tls.certKeyFilename Certificate key filename ## certKeyFilename: "" ## @param tls.certCAFilename CA Certificate filename ## certCAFilename: "" secretName: ~ existingSecret: "" gateway: enabled: false dedicated: false gatewayApi: false name: "" namespace: "" gatewayClassName: istio ## @param gateway.listeners ## listeners: [] existingGateway: ~ existingVirtualService: ~ ## @param gateway.extraRoute Array of extra Kubernetes Gateway API Route to deploy with the release ## extraRoute: [] ## Prometheus exporter configuration ## metrics: ## @param metrics.enabled Start a side-car prometheus exporter ## enabled: false ## Bitnami FreeRADIUS Prometheus exporter image ## ref: ## @param metrics.image.registry FreeRADIUS Prometheus exporter image registry ## @param metrics.image.repository FreeRADIUS Prometheus exporter image repository ## @param metrics.image.tag FreeRADIUS Prometheus exporter image tag (immutable tags are recommended) ## @param metrics.image.pullPolicy FreeRADIUS Prometheus exporter image pull policy ## @param metrics.image.pullSecrets FreeRADIUS Prometheus exporter image pull secrets ## image: registry: docker.io repository: tag: pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace) ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ## Example: ## pullSecrets: ## - myRegistryKeySecretName ## pullSecrets: [] ## Prometheus Operator PrometheusRule configuration ## prometheusRules: ## @param metrics.prometheusRules.enabled if `true`, creates a Prometheus Operator PrometheusRule (also requires `metrics.enabled` to be `true`, and makes little sense without ServiceMonitor) ## enabled: false ## @param metrics.prometheusRules.additionalLabels [object] Additional labels to add to the PrometheusRule so it is picked up by the operator ## If using the [Helm Chart](https://github.com/helm/charts/tree/master/stable/prometheus-operator) this is the name of the Helm release and 'app: prometheus-operator' ## additionalLabels: app: prometheus-operator release: prometheus ## @param metrics.prometheusRules.rules PrometheusRule rules to configure ## e.g: ## - alert: FreeRADIUS-Down ## annotations: ## message: 'FreeRADIUS instance {{ $labels.instance }} is down' ## summary: FreeRADIUS instance is down ## expr: absent(up{job="freeradius"} == 1) ## labels: ## severity: warning ## service: freeradius ## for: 5m ## rules: {}