chore(prismacloud):CD-2242

cks/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
-name: cks
+appVersion: v1.18.0
 description: A service for Virtru customers who wish to manage their own keys
+name: cks
 type: application
-version: 0.8.8
-appVersion: v1.16.0
+version: 1.0.0

cks/README.md

@@ -69,3 +69,38 @@ Use a standard [helm install](https://helm.sh/docs/helm/helm_install/) command t
 ```sh
 helm install -n virtru -f ./values.yaml cks ./ --create-namespace
 ```
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` | Optional: Controls scheduling rules to optimize workload distribution. |
+| appConfig | object | `{"authTokenStoreageMemoryEncoding":"base64","authTokenStoreageType":"in-memory","hmacAuthEnabled":true,"jwtAuthEnabled":true,"jwtAuthIssuer":"https://api.virtru.com","jwtAuthJwksPath":"/acm/api/jwks","keyProviderType":"file","logRsyslogEnabled":false,"logStdoutEnabled":true,"noKeysRule":"importPEM","privateKeyPath":"/run/secrets/rsa001.pem","publicKeyPath":"/run/secrets/rsa001.pub","virtruOrgId":"<your org id>"}` | Application Configuration |
+| appConfig.virtruOrgId | string | `"<your org id>"` | The orgId will be provided to you by your Virtru representative. |
+| appSecrets | object | `{"virtruAuth":{"data":{"authTokenJson":"<base64-encoded-JSON-from-your-CKS>"},"name":"hmac-auth"},"virtruKeys":{"data":{"rsa001.pem":"<rsa001 private key>\n","rsa001.pub":"<rsa001 public key>\n"},"mountPath":"/app/keys","name":"cks-keys"}}` | Secrets Management  |
+| appSecrets.virtruAuth.data.authTokenJson | string | `"<base64-encoded-JSON-from-your-CKS>"` | This base64-encoded value for authTokenJson can be generated by running these steps here: https://support.virtru.com/hc/en-us/articles/17797745877655-Virtru-Private-Keystore-for-Virtru-Solutions-Install-First-Instance-Linux-Server |
+| appSecrets.virtruKeys.data."rsa001.pub" | string | `"<rsa001 public key>\n"` | The values for rsa001.pub and rsa001.pem can be generated by running these steps here: https://support.virtru.com/hc/en-us/articles/17797745877655-Virtru-Private-Keystore-for-Virtru-Solutions-Install-First-Instance-Linux-Server |
+| autoscaling | object | `{"enabled":false,"maxReplicas":100,"minReplicas":1,"targetCPUUtilizationPercentage":80}` | Autoscaling is disabled by default. |
+| autoscaling.maxReplicas | int | `100` | Maximum number of pods |
+| autoscaling.minReplicas | int | `1` | Minimum number of pods |
+| autoscaling.targetCPUUtilizationPercentage | int | `80` | CPU threshold for scaling. Default is 80% |
+| deployment | object | `{"port":9000}` | Internal application port used for the deployment. |
+| deployment.port | int | `9000` | The CKS will use the default internal port 9000. |
+| fullnameOverride | string | `""` | Optional override for the full resource name. |
+| image | object | `{"pullPolicy":"IfNotPresent","repository":"containers.virtru.com/cks","tag":""}` | For version, see https://support.virtru.com/hc/en-us/articles/360034039233-Release-Notes-Virtru-Private-Keystore-for-Virtru-Solutions-Formerly-Virtru-Customer-Key-Server-CKS. |
+| ingress | object | `{"annotations":null,"enabled":true,"hosts":[{"host":"fqdn.yourdomain.com","paths":[{"backend":{"serviceName":"cks","servicePort":443},"path":"/*","pathType":"ImplementationSpecific"}]}],"tls":[]}` | This is enabled by default. |
+| ingress.hosts[0] | object | `{"host":"fqdn.yourdomain.com","paths":[{"backend":{"serviceName":"cks","servicePort":443},"path":"/*","pathType":"ImplementationSpecific"}]}` | Change fqdn.yourdomain.com to match the FQDN of your CKS. |
+| nameOverride | string | `""` | Optional name override for the CKS release. |
+| nodeSelector | object | `{}` | Optional: Specifies node labels for pod placement. |
+| podAnnotations | object | `{}` | Optional annotations for pods, useful for monitoring or automation. |
+| podSecurityContext | object | `{}` | Defines security settings at the pod level (e.g., group permissions). Defaults to empty, can be customized to better fit your organization's needs. |
+| replicaCount | int | `3` | Number of instances (pods) to run for the application. Default is 3 but can be customized to fit your org's needs. |
+| resources | object | `{}` | Allows defining CPU/memory limits and requests for the application. Defaults to empty for flexibility. |
+| revisionHistoryLimit | int | `10` | Number of old deployments retained for rollback purposes. Default is 10. |
+| securityContext | object | `{}` | Defines security settings at the container level, such as running as a non-root user. Defaults to empty for flexibility. |
+| service | object | `{"annotations":{},"port":443,"protocol":"TCP","type":"ClusterIP"}` | Service Configuration |
+| service.type | string | `"ClusterIP"` | Service type is ClusterIP by default. |
+| serviceAccount.annotations | object | `{}` | Metadata annotations to add to the service account. Defaults to empty. |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created. A service account is created by default. |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is set to true, a name is generated using the fullname template. |
+| testerPod | object | `{"annotations":{"helm.sh/hook":"test"},"enabled":true}` | Test pod is created by default. |
+| tolerations | list | `[]` | Optional: Defines tolerations to allow pods to be scheduled on tainted nodes. |

cks/values.yaml

@@ -1,40 +1,49 @@
-# Default values for cks.
+# Default values for the Virtru Private Keystore (CKS).
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
+# --  Number of instances (pods) to run for the application. Default is 3 but can be customized to fit your org's needs.
 replicaCount: 3
 
+# -- Number of old deployments retained for rollback purposes. Default is 10.
 revisionHistoryLimit: 10
 
+# -- Location of container image. 
+# -- For the latest version, see https://support.virtru.com/hc/en-us/articles/360034039233-Release-Notes-Virtru-Private-Keystore-for-Virtru-Solutions-Formerly-Virtru-Customer-Key-Server-CKS.
 image:
   repository: containers.virtru.com/cks
   pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
+  # Overrides the image tag whose default is the Chart.yaml's appVersion.
   tag: ""
 
+# -- Optional name override for the CKS release.
 nameOverride: ""
+# -- Optional override for the full resource name.
 fullnameOverride: ""
 
 serviceAccount:
-  # Specifies whether a service account should be created
+  # -- Specifies whether a service account should be created. A service account is created by default.
   create: true
-  # Annotations to add to the service account
+  # -- Metadata annotations to add to the service account. Defaults to empty.
   annotations: {}
-  # The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template
+  # -- The name of the service account to use. If not set and create is set to true, a name is generated using the fullname template.
   name: ""
 
+# -- Optional annotations for pods, useful for monitoring or automation.
 podAnnotations: {}
 
+# -- Test pod is created by default.
 testerPod:
   enabled: true
   annotations:
     helm.sh/hook: test
 
+# -- Defines security settings at the pod level (e.g., group permissions). Defaults to empty, can be customized to better fit your organization's needs.
 podSecurityContext:
   {}
   # fsGroup: 2000
 
+# -- Defines security settings at the container level, such as running as a non-root user. Defaults to empty for flexibility.
 securityContext:
   {}
   # capabilities:
@@ -44,22 +53,29 @@ securityContext:
   # runAsNonRoot: true
   # runAsUser: 1000
 
+# -- Service Configuration
 service:
   annotations: {}
+  # -- Service type is ClusterIP by default.
   type: ClusterIP
   port: 443
   protocol: TCP
 
+# -- Internal application port used for the deployment.
 deployment:
+  # -- The CKS will use the default internal port 9000.
   port: 9000
 
+# -- Ingress Configuration. To serve traffic appropriately, you must have an ingress controller for your CKS service
+# -- This is enabled by default.
 ingress:
   enabled: true
   annotations:
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
   hosts:
-    - host: chart-example.local
+      # -- Change fqdn.yourdomain.com to match the FQDN of your CKS.
+    - host: fqdn.yourdomain.com
       paths:
         - path: /*
           pathType: ImplementationSpecific
@@ -71,10 +87,11 @@ ingress:
   #    hosts:
   #      - chart-example.local
 
+# -- Allows defining CPU/memory limits and requests for the application. Defaults to empty for flexibility.
 resources:
   {}
   # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
+  # choice for the customer. This also increases chances charts run on environments with little
   # resources, such as Minikube. If you do want to specify resources, uncomment the following
   # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
   # limits:
@@ -84,20 +101,29 @@ resources:
   #   cpu: 100m
   #   memory: 128Mi
 
+# -- Autoscaling is disabled by default.
 autoscaling:
   enabled: false
+  # -- Minimum number of pods
   minReplicas: 1
+  # -- Maximum number of pods
   maxReplicas: 100
+  # -- CPU threshold for scaling. Default is 80%
   targetCPUUtilizationPercentage: 80
   # targetMemoryUtilizationPercentage: 80
 
+# -- Optional: Specifies node labels for pod placement.
 nodeSelector: {}
 
+# -- Optional: Defines tolerations to allow pods to be scheduled on tainted nodes.
 tolerations: []
 
+# -- Optional: Controls scheduling rules to optimize workload distribution.
 affinity: {}
 
+# -- Application Configuration
 appConfig:
+  # -- The orgId will be provided to you by your Virtru representative.
   virtruOrgId: "<your org id>"
   authTokenStoreageType: in-memory
   authTokenStoreageMemoryEncoding: base64
@@ -117,21 +143,25 @@ appConfig:
 # While a simpler approach with fewer variables, it is recommended you use
 # a third party secret storage option.
 
+# -- Secrets Management 
 appSecrets:
   virtruAuth:
     name: hmac-auth
     data:
-      authTokenJson: <JSON from your CKS>
+     # -- This base64-encoded value for authTokenJson can be generated by running these steps here: https://support.virtru.com/hc/en-us/articles/17797745877655-Virtru-Private-Keystore-for-Virtru-Solutions-Install-First-Instance-Linux-Server
+      authTokenJson: <base64-encoded-JSON-from-your-CKS>
 
   virtruKeys:
     name: cks-keys
     mountPath: /app/keys
     data:
+      # -- The values for rsa001.pub and rsa001.pem can be generated by running these steps here: https://support.virtru.com/hc/en-us/articles/17797745877655-Virtru-Private-Keystore-for-Virtru-Solutions-Install-First-Instance-Linux-Server
       rsa001.pub: |
         <rsa001 public key>
       rsa001.pem: |
         <rsa001 private key>
 
+# -- Configuration for integrating with external secret management solutions.
 #https://external-secrets.io/v0.8.2/introduction/overview/
 #externalAppSecrets:
 #- name: <external secret object name> #secret object will be named the same.
@@ -140,4 +170,3 @@ appSecrets:
 #    kind: <SecretStore or ClusterSecretStore>
 #    name: <name of secret store>
 #  refreshInterval: <how often to reconcile with secret store>
-#