Platform, sign-in and licence
Chart values: platform, oidc, auth, masterKey, signingKey, license.
charts/harthelm/values.yaml at v1.5.0platform
| Value | Type | Default | Description |
|---|---|---|---|
platform.host | string | "" | Console and API host, e.g. console.example.org. |
platform.workspaceDomain | string | "" | Workspace domain; workspace hosts are <ws>-<port>.<workspaceDomain> and ide-<ws>.<workspaceDomain>. Must be a different registrable domain from the console. |
oidc
Single sign-on through any OIDC provider (code flow with PKCE). With an empty issuer OIDC login is off and break-glass (auth.breakGlass) is the only way in.
| Value | Type | Default | Description |
|---|---|---|---|
oidc.issuer | string | "" | |
oidc.displayName | string | "" | "Sign in with <displayName>"; core's default applies when empty |
oidc.groupsClaim | string | "" | core's default: groups |
oidc.adminGroup | string | "" | members become cluster admins; core's default: harthelm-admins |
oidc.existingSecret | string | "" | Secret in the release namespace with the confidential client's id and secret (required with an issuer). |
oidc.clientIDKey | string | "clientID" | |
oidc.clientSecretKey | string | "clientSecret" | |
oidc.caConfigMap | string | "" | ConfigMap with an extra CA (PEM) for the issuer's HTTPS, for an issuer behind a private CA. |
oidc.caKey | string | "ca.crt" | |
oidc.trustEmailVerified | boolean | true | Invitations attach to a user only by an email address the issuer marks as verified (email_verified). false treats every address of this issuer as unverified: nothing attaches and invitations cannot be accepted, so use it only for an issuer that cannot tell. Authentik sends the claim (the default scope mapping), Dex only for connectors that verify addresses. |
auth
| Value | Type | Default | Description |
|---|---|---|---|
auth.breakGlass.enabled | boolean | false | A local admin for when the IdP is down. The Secret holds the keys username and password-hash (argon2id PHC string, e.g. echo -n "$PASSWORD" | argon2 "$(openssl rand -base64 16)" -id -t 3 -m 16 -p 4 -e). |
auth.breakGlass.existingSecret | string | "" |
masterKey
Secrets core generates on first start unless they exist. Bring your own (GitOps, restore) with existingSecret; core then refuses to generate a new master key. Secrets: master key (entries active and key.<id>), signing keys.
| Value | Type | Default | Description |
|---|---|---|---|
masterKey.existingSecret | string | "" |
signingKey
| Value | Type | Default | Description |
|---|---|---|---|
signingKey.existingSecret | string | "" |
license
The licence. Every installation needs one; without a valid licence it runs restricted (new teams, workspaces and users are paused, everything that exists keeps running). Install it with hart admin license install, on the console's Licence page, or here: the name of a Secret in the release namespace that holds the licence file under secretKey. While existingSecret is set, the Secret is the only source (the console and hart show the licence read-only) and the preflight refuses a Secret without an accepted licence.
| Value | Type | Default | Description |
|---|---|---|---|
license.existingSecret | string | "" | |
license.secretKey | string | "license" |