262 lines
6.5 KiB
YAML
262 lines
6.5 KiB
YAML
image:
|
|
repository: tccr.io/truecharts/guacamole-client
|
|
pullPolicy: IfNotPresent
|
|
tag: 1.5.2@sha256:d705e385677c11624381df0c3779616edac98fdc8e508374257327516bde061b
|
|
guacdImage:
|
|
repository: tccr.io/truecharts/guacamole-server
|
|
pullPolicy: IfNotPresent
|
|
tag: v1.5.2@sha256:f7f62adecb244a91c974ac0bab7376335304145789fb43baeff75c1e2c88c630
|
|
|
|
guacamole:
|
|
ldap:
|
|
LDAP_HOSTNAME: ""
|
|
LDAP_USER_BASE_DN: ""
|
|
LDAP_PORT: 389
|
|
LDAP_ENCRYPTION_METHOD: none
|
|
LDAP_MAX_SEARCH_RESULTS: 1000
|
|
LDAP_SEARCH_BIND_DN: ""
|
|
LDAP_USER_ATTRIBUTES: ""
|
|
LDAP_SEARCH_BIND_PASSWORD: ""
|
|
LDAP_USERNAME_ATTRIBUTE: uid
|
|
LDAP_MEMBER_ATTRIBUTE: member
|
|
LDAP_USER_SEARCH_FILTER: "(objectClass=*)"
|
|
LDAP_CONFIG_BASE_DN: ""
|
|
LDAP_GROUP_BASE_DN: ""
|
|
LDAP_GROUP_SEARCH_FILTER: "(objectClass=*)"
|
|
LDAP_MEMBER_ATTRIBUTE_TYPE: dn
|
|
LDAP_GROUP_NAME_ATTRIBUTE: cn
|
|
LDAP_DEREFERENCE_ALIASES: never
|
|
LDAP_FOLLOW_REFERRALS: false
|
|
LDAP_MAX_REFERRAL_HOPS: 5
|
|
LDAP_OPERATION_TIMEOUT: 30
|
|
header:
|
|
HEADER_ENABLED: false
|
|
HTTP_AUTH_HEADER: REMOTE_USER
|
|
saml:
|
|
SAML_IDP_METADATA_URL: ""
|
|
SAML_IDP_URL: ""
|
|
SAML_ENTITY_ID: ""
|
|
SAML_CALLBACK_URL: ""
|
|
SAML_STRICT: true
|
|
SAML_DEBUG: false
|
|
SAML_COMPRESS_REQUEST: true
|
|
SAML_COMPRESS_RESPONSE: true
|
|
SAML_GROUP_ATTRIBUTE: groups
|
|
proxy:
|
|
REMOTE_IP_VALVE_ENABLED: false
|
|
PROXY_ALLOWED_IPS_REGEX: ""
|
|
PROXY_IP_HEADER: ""
|
|
PROXY_PROTOCOL_HEADER: ""
|
|
PROXY_BY_HEADER: ""
|
|
general:
|
|
EXTENSION_PRIORITY: ""
|
|
totp:
|
|
TOTP_ENABLED: false
|
|
TOTP_ISSUER: Apache Guacamole
|
|
TOTP_DIGITS: 6
|
|
TOTP_PERIOD: 30
|
|
TOTP_MODE: sha1
|
|
duo:
|
|
DUO_API_HOSTNAME: ""
|
|
DUO_INTEGRATION_KEY: ""
|
|
DUO_SECRET_KEY: ""
|
|
DUO_APPLICATION_KEY: ""
|
|
api:
|
|
API_SESSION_TIMEOUT: 60
|
|
radius:
|
|
RADIUS_SHARED_SECRET: ""
|
|
RADIUS_AUTH_PROTOCOL: eap-tls
|
|
RADIUS_HOSTNAME: ""
|
|
RADIUS_AUTH_PORT: 1812
|
|
RADIUS_KEY_FILE: ""
|
|
RADIUS_KEY_TYPE: pkcs12
|
|
RADIUS_KEY_PASSWORD: ""
|
|
RADIUS_CA_FILE: ""
|
|
RADIUS_CA_TYPE: pem
|
|
RADIUS_CA_PASSWORD: ""
|
|
RADIUS_TRUST_ALL: false
|
|
RADIUS_RETRIES: 5
|
|
RADIUS_TIMEOUT: 60
|
|
RADIUS_EAP_TTLS_INNER_PROTOCOL: eap-tls
|
|
RADIUS_NAS_IP: ""
|
|
openid:
|
|
OPENID_AUTHORIZATION_ENDPOINT: ""
|
|
OPENID_JWKS_ENDPOINT: ""
|
|
OPENID_ISSUER: ""
|
|
OPENID_CLIENT_ID: ""
|
|
OPENID_REDIRECT_URI: ""
|
|
OPENID_USERNAME_CLAIM_TYPE: email
|
|
OPENID_GROUPS_CLAIM_TYPE: groups
|
|
OPENID_SCOPE: openid email profile
|
|
OPENID_ALLOWED_CLOCK_SKEW: 30
|
|
OPENID_MAX_TOKEN_VALIDITY: 300
|
|
OPENID_MAX_NONCE_VALIDITY: 300
|
|
cas:
|
|
CAS_AUTHORIZATION_ENDPOINT: ""
|
|
CAS_REDIRECT_URI: ""
|
|
CAS_CLEARPASS_KEY: ""
|
|
CAS_GROUP_ATTRIBUTE: ""
|
|
CAS_GROUP_FORMAT: plain
|
|
CAS_GROUP_LDAP_BASE_DN: ""
|
|
CAS_GROUP_LDAP_ATTRIBUTE: ""
|
|
json:
|
|
JSON_SECRET_KEY: ""
|
|
JSON_TRUSTED_NETWORKS: ""
|
|
|
|
workload:
|
|
main:
|
|
podSpec:
|
|
containers:
|
|
main:
|
|
securityContext:
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
readOnlyRootFilesystem: false
|
|
envFrom:
|
|
- configMapRef:
|
|
name: guacamole-config
|
|
probes:
|
|
liveness:
|
|
type: http
|
|
port: "{{ .Values.service.main.ports.main.targetPort }}"
|
|
readiness:
|
|
type: http
|
|
port: "{{ .Values.service.main.ports.main.targetPort }}"
|
|
startup:
|
|
type: tcp
|
|
port: "{{ .Values.service.main.ports.main.targetPort }}"
|
|
# zz is used to ensure that the initContainers are run after db-waits
|
|
initContainers:
|
|
1-create-seed:
|
|
enabled: true
|
|
type: install
|
|
imageSelector: image
|
|
securityContext:
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
readOnlyRootFilesystem: false
|
|
envFrom:
|
|
- configMapRef:
|
|
name: guacamole-config
|
|
command:
|
|
- /bin/sh
|
|
args:
|
|
- -c
|
|
- /tc-scripts/create-seed.sh
|
|
2-apply-seed:
|
|
enabled: true
|
|
type: install
|
|
imageSelector: postgresClientImage
|
|
securityContext:
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
readOnlyRootFilesystem: false
|
|
envFrom:
|
|
- configMapRef:
|
|
name: guacamole-config
|
|
command:
|
|
- /bin/sh
|
|
args:
|
|
- -c
|
|
- /tc-scripts/apply-seed.sh
|
|
|
|
guacd:
|
|
enabled: true
|
|
type: Deployment
|
|
strategy: RollingUpdate
|
|
podSpec:
|
|
containers:
|
|
guacd:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: guacdImage
|
|
command:
|
|
- /opt/guacamole/sbin/guacd
|
|
args:
|
|
# Listen Address
|
|
- -b
|
|
- "0.0.0.0"
|
|
# Listen Port
|
|
- -l
|
|
- "{{ .Values.service.guacd.ports.guacd.port }}"
|
|
# Log Level
|
|
- -L
|
|
- info
|
|
# Foreground
|
|
- -f
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
readOnlyRootFilesystem: false
|
|
probes:
|
|
liveness:
|
|
type: tcp
|
|
port: "{{ .Values.service.guacd.ports.guacd.port }}"
|
|
readiness:
|
|
type: tcp
|
|
port: "{{ .Values.service.guacd.ports.guacd.port }}"
|
|
startup:
|
|
type: tcp
|
|
port: "{{ .Values.service.guacd.ports.guacd.port }}"
|
|
|
|
service:
|
|
main:
|
|
ports:
|
|
main:
|
|
port: 10123
|
|
targetPort: 8080
|
|
guacd:
|
|
enabled: true
|
|
targetSelector: guacd
|
|
ports:
|
|
guacd:
|
|
enabled: true
|
|
targetSelector: guacd
|
|
port: 10124
|
|
|
|
persistence:
|
|
recordings:
|
|
enabled: true
|
|
# Check how this works and
|
|
# which containers need it mounted
|
|
targetSelector:
|
|
main:
|
|
main:
|
|
mountPath: /var/lib/guacamole/recordings
|
|
readOnly: true
|
|
guacd:
|
|
guacd:
|
|
mountPath: /var/lib/guacamole/recordings
|
|
tc-init:
|
|
enabled: true
|
|
type: emptyDir
|
|
targetSelector:
|
|
main:
|
|
1-create-seed:
|
|
mountPath: /tc-init
|
|
2-apply-seed:
|
|
mountPath: /tc-init
|
|
db-seed:
|
|
enabled: true
|
|
type: configmap
|
|
objectName: db-init
|
|
defaultMode: "0770"
|
|
targetSelector:
|
|
main:
|
|
1-create-seed:
|
|
mountPath: /tc-scripts/create-seed.sh
|
|
subPath: create-seed.sh
|
|
2-apply-seed:
|
|
mountPath: /tc-scripts/apply-seed.sh
|
|
subPath: apply-seed.sh
|
|
|
|
cnpg:
|
|
main:
|
|
enabled: true
|
|
user: guacamole
|
|
database: guacamole
|
|
|
|
portal:
|
|
open:
|
|
enabled: true
|