Skip to main content
Version: main 🚧
Enterprise
Available in these plansFreeDevProdScale
Least Privilege Mode

Overview

Platform configs are the content in the values.yaml under the config section. It controls the behavior of the vCluster Platform after it is installed on the host cluster. You can also configure the content in vCluster Platform UI via Admin > Config.

UI vs config section​

After the deployment, the behavior of the platform can be configured by the config section of the values.yaml or Admin > Config in vCluster Platform UI.

When using values.yaml, you should add the configuration under the config section of the vcluster-platform chart's values.yaml. For example:

config:
  vault:
    enabled: true

However, when using vCluster Platform UI, you can directly only add the configuration content.

vault:
  enabled: true

Manage sensitive information​

Many configuration options require sensitive information such as API keys or tokens. Rather than storing these directly in your values.yaml file, use environment variable placeholders.

Use secret references​

Store sensitive values in a Kubernetes secret and reference it in your configuration using envValueFrom:

Store sensitive values using Kubernetes secrets
# Secret references
envValueFrom:
  CLIENT_ID:
    secretKeyRef:
      name: github-auth-secret
      key: client_id
  CLIENT_SECRET:
    secretKeyRef:
      name: github-auth-secret
      key: client_secret

# Platform configuration
config:
  auth:
    github:
      clientId: $CLIENT_ID
      clientSecret: $CLIENT_SECRET
      redirectURI: https://my-platform.example.com/auth/github/callback

Configure custom HTTP headers​

You can configure the platform to add custom HTTP headers to all API responses. This is useful for security-related headers or when integrating with specific environments.

Adding custom HTTP headers
config:
  auth:
    customHttpHeaders:
      X-Frame-Options: SAMEORIGIN
      X-XSS-Protection: 1; mode=block
      Content-Security-Policy: default-src 'self'

Reference​

The complete list of platform configuration fields is as follows:

auth object ​

Authentication holds the information for authentication

oidc object ​

OIDC holds oidc authentication configuration

issuerUrl string ​

IssuerURL is the URL the provider signs ID Tokens as. This will be the "iss" field of all tokens produced by the provider and is used for configuration discovery.

The URL is usually the provider's URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com".

The provider must implement configuration discovery. See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig

clientId string ​

ClientID the JWT must be issued for, the "sub" field. This plugin only trusts a single client to ensure the plugin can be used with public providers.

The plugin supports the "authorized party" OpenID Connect claim, which allows specialized providers to issue tokens to a client for a different client. See: https://openid.net/specs/openid-connect-core-1_0.html#IDToken

clientSecret string ​

ClientSecret to issue tokens from the OIDC provider

redirectURI string ​

loft redirect uri. E.g. https://loft.my.domain/auth/oidc/callback

postLogoutRedirectURI string ​

Loft URI to be redirected to after successful logout by OIDC Provider

caFile string ​

Path to a PEM encoded root certificate of the provider. Optional

insecureCa boolean ​

Specify whether to communicate without validating SSL certificates

preferredUsername string ​

Configurable key which contains the preferred username claims

loftUsernameClaim string ​

LoftUsernameClaim is the JWT field to use as the user's username.

usernameClaim string ​

UsernameClaim is the JWT field to use as the user's id.

emailClaim string ​

EmailClaim is the JWT field to use as the user's email.

allowedExtraClaims string[] ​

AllowedExtraClaims are claims of interest that are not part of User by default but may be provided by the OIDC provider.

usernamePrefix string ​

UsernamePrefix, if specified, causes claims mapping to username to be prefix with the provided value. A value "oidc:" would result in usernames like "oidc:john".

groupsClaim string ​

GroupsClaim, if specified, causes the OIDCAuthenticator to try to populate the user's groups with an ID Token field. If the GroupsClaim field is present in an ID Token the value must be a string or list of strings.

groups string[] ​

If required groups is non empty, access is denied if the user is not part of at least one of the specified groups.

scopes string[] ​

Scopes that should be sent to the server. If empty, defaults to "email" and "profile".

getUserInfo boolean ​

GetUserInfo, if specified, tells the OIDCAuthenticator to try to populate the user's information from the UserInfo.

groupsPrefix string ​

GroupsPrefix, if specified, causes claims mapping to group names to be prefixed with the value. A value "oidc:" would result in groups like "oidc:engineering" and "oidc:marketing".

type string ​

Type of the OIDC to show in the UI. Only for displaying purposes

resource string ​

Resource, if specified, is the value that is set for the "resource" URL parameter when making a request to the /token endpoint of the OIDC provider.

github object ​

Github holds github authentication configuration

clientId string ​

ClientID holds the github client id

clientSecret required string ​

ClientID holds the github client secret

redirectURI required string ​

RedirectURI holds the redirect URI. Should be https://loft.domain.tld/auth/github/callback

orgs object[] ​

Loft queries the following organizations for group information. Group claims are formatted as "(org):(team)". For example if a user is part of the "engineering" team of the "coreos" org, the group claim would include "coreos:engineering".

If orgs are specified in the config then user MUST be a member of at least one of the specified orgs to authenticate with loft.

name string ​

Organization name in github (not slug, full name). Only users in this github organization can authenticate.

teams string[] ​

Names of teams in a github organization. A user will be able to authenticate if they are members of at least one of these teams. Users in the organization can authenticate if this field is omitted from the config file.

hostName string ​

Required ONLY for GitHub Enterprise. This is the Hostname of the GitHub Enterprise account listed on the management console. Ensure this domain is routable on your network.

rootCA string ​

ONLY for GitHub Enterprise. Optional field. Used to support self-signed or untrusted CA root certificates.

gitlab object ​

Gitlab holds gitlab authentication configuration

clientId required string ​

Gitlab client id

clientSecret required string ​

Gitlab client secret

redirectURI required string ​

Redirect URI

baseURL string ​

BaseURL is optional, default = https://gitlab.com

groups string[] ​

Optional groups whitelist, communicated through the "groups" scope. If groups is omitted, all of the user's GitLab groups are returned. If groups is provided, this acts as a whitelist - only the user's GitLab groups that are in the configured groups below will go into the groups claim. Conversely, if the user is not in any of the configured groups, the user will not be authenticated.

google object ​

Google holds google authentication configuration

clientId required string ​

Google client id

clientSecret required string ​

Google client secret

redirectURI required string ​

loft redirect uri. E.g. https://loft.my.domain/auth/google/callback

scopes string[] ​

defaults to "profile" and "email"

hostedDomains string[] ​

Optional list of whitelisted domains If this field is nonempty, only users from a listed domain will be allowed to log in

groups string[] ​

Optional list of whitelisted groups If this field is nonempty, only users from a listed group will be allowed to log in

serviceAccountFilePath string ​

Optional path to service account json If nonempty, and groups claim is made, will use authentication from file to check groups with the admin directory api

adminEmail string ​

Required if ServiceAccountFilePath The email of a GSuite super user which the service account will impersonate when listing groups

microsoft object ​

Microsoft holds microsoft authentication configuration

clientId required string ​

Microsoft client id

clientSecret required string ​

Microsoft client secret

redirectURI required string ​

loft redirect uri. Usually https://loft.my.domain/auth/microsoft/callback

tenant string ​

tenant configuration parameter controls what kinds of accounts may be authenticated in loft. By default, all types of Microsoft accounts (consumers and organizations) can authenticate in loft via Microsoft. To change this, set the tenant parameter to one of the following:

common - both personal and business/school accounts can authenticate in loft via Microsoft (default) consumers - only personal accounts can authenticate in loft organizations - only business/school accounts can authenticate in loft tenant uuid or tenant name - only accounts belonging to specific tenant identified by either tenant uuid or tenant name can authenticate in loft

groups string[] ​

It is possible to require a user to be a member of a particular group in order to be successfully authenticated in loft.

onlySecurityGroups boolean ​

configuration option restricts the list to include only security groups. By default all groups (security, Office 365, mailing lists) are included.

useGroupsAsWhitelist boolean ​

Restrict the groups claims to include only the user’s groups that are in the configured groups

saml object ​

SAML holds saml authentication configuration

redirectURI string ​

If the response assertion status value contains a Destination element, it must match this value exactly. Usually looks like https://your-loft-domain/auth/saml/callback

ssoURL string ​

SSO URL used for POST value.

caData string ​

CAData is a base64 encoded string that holds the ca certificate for validating the signature of the SAML response. Either CAData, CA or InsecureSkipSignatureValidation needs to be defined.

usernameAttr string ​

Name of attribute in the returned assertions to map to username

emailAttr string ​

Name of attribute in the returned assertions to map to email

groupsAttr string ​

Name of attribute in the returned assertions to map to groups

ca string ​

CA to use when validating the signature of the SAML response.

insecureSkipSignatureValidation boolean ​

Ignore the ca cert

entityIssuer string ​

When provided Loft will include this as the Issuer value during AuthnRequest. It will also override the redirectURI as the required audience when evaluating AudienceRestriction elements in the response.

ssoIssuer string ​

Issuer value expected in the SAML response. Optional.

groupsDelim string ​

If GroupsDelim is supplied the connector assumes groups are returned as a single string instead of multiple attribute values. This delimiter will be used split the groups string.

allowedGroups string[] ​

List of groups to filter access based on membership

filterGroups boolean ​

If used with allowed groups, only forwards the allowed groups and not all groups specified.

nameIDPolicyFormat string ​

Requested format of the NameID. The NameID value is is mapped to the ID Token 'sub' claim.

This can be an abbreviated form of the full URI with just the last component. For example, if this value is set to "emailAddress" the format will resolve to:

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

If no value is specified, this value defaults to:

urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

password object ​

Password holds password authentication relevant information

disabled boolean ​

If true login via password is disabled

connectors object[] ​

Connectors are optional additional connectors for Loft.

id string ​

ID is the id that should show up in the url

displayName string ​

DisplayName is the name that should show up in the ui

oidc object ​

OIDC holds oidc authentication configuration

issuerUrl string ​

IssuerURL is the URL the provider signs ID Tokens as. This will be the "iss" field of all tokens produced by the provider and is used for configuration discovery.

The URL is usually the provider's URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com".

The provider must implement configuration discovery. See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig

clientId string ​

ClientID the JWT must be issued for, the "sub" field. This plugin only trusts a single client to ensure the plugin can be used with public providers.

The plugin supports the "authorized party" OpenID Connect claim, which allows specialized providers to issue tokens to a client for a different client. See: https://openid.net/specs/openid-connect-core-1_0.html#IDToken

clientSecret string ​

ClientSecret to issue tokens from the OIDC provider

redirectURI string ​

loft redirect uri. E.g. https://loft.my.domain/auth/oidc/callback

postLogoutRedirectURI string ​

Loft URI to be redirected to after successful logout by OIDC Provider

caFile string ​

Path to a PEM encoded root certificate of the provider. Optional

insecureCa boolean ​

Specify whether to communicate without validating SSL certificates

preferredUsername string ​

Configurable key which contains the preferred username claims

loftUsernameClaim string ​

LoftUsernameClaim is the JWT field to use as the user's username.

usernameClaim string ​

UsernameClaim is the JWT field to use as the user's id.

emailClaim string ​

EmailClaim is the JWT field to use as the user's email.

allowedExtraClaims string[] ​

AllowedExtraClaims are claims of interest that are not part of User by default but may be provided by the OIDC provider.

usernamePrefix string ​

UsernamePrefix, if specified, causes claims mapping to username to be prefix with the provided value. A value "oidc:" would result in usernames like "oidc:john".

groupsClaim string ​

GroupsClaim, if specified, causes the OIDCAuthenticator to try to populate the user's groups with an ID Token field. If the GroupsClaim field is present in an ID Token the value must be a string or list of strings.

groups string[] ​

If required groups is non empty, access is denied if the user is not part of at least one of the specified groups.

scopes string[] ​

Scopes that should be sent to the server. If empty, defaults to "email" and "profile".

getUserInfo boolean ​

GetUserInfo, if specified, tells the OIDCAuthenticator to try to populate the user's information from the UserInfo.

groupsPrefix string ​

GroupsPrefix, if specified, causes claims mapping to group names to be prefixed with the value. A value "oidc:" would result in groups like "oidc:engineering" and "oidc:marketing".

type string ​

Type of the OIDC to show in the UI. Only for displaying purposes

resource string ​

Resource, if specified, is the value that is set for the "resource" URL parameter when making a request to the /token endpoint of the OIDC provider.

github object ​

Github holds github authentication configuration

clientId string ​

ClientID holds the github client id

clientSecret required string ​

ClientID holds the github client secret

redirectURI required string ​

RedirectURI holds the redirect URI. Should be https://loft.domain.tld/auth/github/callback

orgs object[] ​

Loft queries the following organizations for group information. Group claims are formatted as "(org):(team)". For example if a user is part of the "engineering" team of the "coreos" org, the group claim would include "coreos:engineering".

If orgs are specified in the config then user MUST be a member of at least one of the specified orgs to authenticate with loft.

name string ​

Organization name in github (not slug, full name). Only users in this github organization can authenticate.

teams string[] ​

Names of teams in a github organization. A user will be able to authenticate if they are members of at least one of these teams. Users in the organization can authenticate if this field is omitted from the config file.

hostName string ​

Required ONLY for GitHub Enterprise. This is the Hostname of the GitHub Enterprise account listed on the management console. Ensure this domain is routable on your network.

rootCA string ​

ONLY for GitHub Enterprise. Optional field. Used to support self-signed or untrusted CA root certificates.

gitlab object ​

Gitlab holds gitlab authentication configuration

clientId required string ​

Gitlab client id

clientSecret required string ​

Gitlab client secret

redirectURI required string ​

Redirect URI

baseURL string ​

BaseURL is optional, default = https://gitlab.com

groups string[] ​

Optional groups whitelist, communicated through the "groups" scope. If groups is omitted, all of the user's GitLab groups are returned. If groups is provided, this acts as a whitelist - only the user's GitLab groups that are in the configured groups below will go into the groups claim. Conversely, if the user is not in any of the configured groups, the user will not be authenticated.

google object ​

Google holds google authentication configuration

clientId required string ​

Google client id

clientSecret required string ​

Google client secret

redirectURI required string ​

loft redirect uri. E.g. https://loft.my.domain/auth/google/callback

scopes string[] ​

defaults to "profile" and "email"

hostedDomains string[] ​

Optional list of whitelisted domains If this field is nonempty, only users from a listed domain will be allowed to log in

groups string[] ​

Optional list of whitelisted groups If this field is nonempty, only users from a listed group will be allowed to log in

serviceAccountFilePath string ​

Optional path to service account json If nonempty, and groups claim is made, will use authentication from file to check groups with the admin directory api

adminEmail string ​

Required if ServiceAccountFilePath The email of a GSuite super user which the service account will impersonate when listing groups

microsoft object ​

Microsoft holds microsoft authentication configuration

clientId required string ​

Microsoft client id

clientSecret required string ​

Microsoft client secret

redirectURI required string ​

loft redirect uri. Usually https://loft.my.domain/auth/microsoft/callback

tenant string ​

tenant configuration parameter controls what kinds of accounts may be authenticated in loft. By default, all types of Microsoft accounts (consumers and organizations) can authenticate in loft via Microsoft. To change this, set the tenant parameter to one of the following:

common - both personal and business/school accounts can authenticate in loft via Microsoft (default) consumers - only personal accounts can authenticate in loft organizations - only business/school accounts can authenticate in loft tenant uuid or tenant name - only accounts belonging to specific tenant identified by either tenant uuid or tenant name can authenticate in loft

groups string[] ​

It is possible to require a user to be a member of a particular group in order to be successfully authenticated in loft.

onlySecurityGroups boolean ​

configuration option restricts the list to include only security groups. By default all groups (security, Office 365, mailing lists) are included.

useGroupsAsWhitelist boolean ​

Restrict the groups claims to include only the user’s groups that are in the configured groups

saml object ​

SAML holds saml authentication configuration

redirectURI string ​

If the response assertion status value contains a Destination element, it must match this value exactly. Usually looks like https://your-loft-domain/auth/saml/callback

ssoURL string ​

SSO URL used for POST value.

caData string ​

CAData is a base64 encoded string that holds the ca certificate for validating the signature of the SAML response. Either CAData, CA or InsecureSkipSignatureValidation needs to be defined.

usernameAttr string ​

Name of attribute in the returned assertions to map to username

emailAttr string ​

Name of attribute in the returned assertions to map to email

groupsAttr string ​

Name of attribute in the returned assertions to map to groups

ca string ​

CA to use when validating the signature of the SAML response.

insecureSkipSignatureValidation boolean ​

Ignore the ca cert

entityIssuer string ​

When provided Loft will include this as the Issuer value during AuthnRequest. It will also override the redirectURI as the required audience when evaluating AudienceRestriction elements in the response.

ssoIssuer string ​

Issuer value expected in the SAML response. Optional.

groupsDelim string ​

If GroupsDelim is supplied the connector assumes groups are returned as a single string instead of multiple attribute values. This delimiter will be used split the groups string.

allowedGroups string[] ​

List of groups to filter access based on membership

filterGroups boolean ​

If used with allowed groups, only forwards the allowed groups and not all groups specified.

nameIDPolicyFormat string ​

Requested format of the NameID. The NameID value is is mapped to the ID Token 'sub' claim.

This can be an abbreviated form of the full URI with just the last component. For example, if this value is set to "emailAddress" the format will resolve to:

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

If no value is specified, this value defaults to:

urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

disableTeamCreation boolean ​

Prevents from team creation for the new groups associated with the user at the time of logging in through sso, Default behaviour is false, this means that teams will be created for new groups.

disableUserCreation boolean ​

DisableUserCreation prevents the SSO connectors from creating a new user on a users initial signin through sso. Default behaviour is false, this means that a new user object will be created once a user without a Kubernetes user object logs in.

accessKeyMaxTTLSeconds integer ​

AccessKeyMaxTTLSeconds is the global maximum lifespan of an accesskey in seconds. Leaving it 0 or unspecified will disable it. Specifying 2592000 will mean all keys have a Time-To-Live of 30 days.

loginAccessKeyTTLSeconds integer ​

LoginAccessKeyTTLSeconds is the time in seconds an access key is kept until it is deleted. Leaving it unspecified will default to 20 days. Setting it to zero will disable the ttl. Specifying 2592000 will mean all keys have a default Time-To-Live of 30 days.

customHttpHeaders object ​

CustomHttpHeaders are additional headers that should be set for the authentication endpoints

groupsFilters string[] ​

GroupsFilters is a regex expression to only save matching sso groups into the user resource

oidc object ​

DEPRECATED: Configure the OIDC clients using either the OIDC Client UI or a secret. By default, vCluster Platform as an OIDC Provider is enabled but does not function without OIDC clients.

enabled boolean ​

If true indicates that loft will act as an OIDC server

wildcardRedirect boolean ​

If true indicates that loft will allow wildcard '*' in client redirectURIs

clients object[] ​

The clients that are allowed to request loft tokens

name string ​

The client name

clientId string ​

The client id of the client

clientSecret string ​

The client secret of the client

redirectURIs required string[] ​

A registered set of redirect URIs. When redirecting from dex to the client, the URI requested to redirect to MUST match one of these values, unless the client is "public".

apps object ​

Apps holds configuration around apps

noDefault boolean ​

If this option is true, loft will not try to parse the default apps

repositories object[] ​

These are additional repositories that are parsed by loft

name string ​

Name is the name of the repository

url string ​

URL is the repository url

username string ​

Username of the repository

password string ​

Password of the repository

insecure boolean ​

Insecure specifies if the chart should be retrieved without TLS verification

predefinedApps object[] ​

Predefined apps that can be selected in the Spaces ) Space menu

chart string ​

Chart holds the repo/chart name of the predefined app

initialVersion string ​

InitialVersion holds the initial version of this app. This version will be selected automatically.

initialValues string ​

InitialValues holds the initial values for this app. The values will be prefilled automatically. There are certain placeholders that can be used within the values that are replaced by the loft UI automatically.

clusters string[] ​

Holds the cluster names where to display this app

title string ​

Title is the name that should be displayed for the predefined app. If empty the chart name is used.

iconUrl string ​

IconURL specifies an url to the icon that should be displayed for this app. If none is specified the icon from the chart metadata is used.

readmeUrl string ​

ReadmeURL specifies an url to the readme page of this predefined app. If empty an url will be constructed to artifact hub.

audit object ​

Audit holds audit configuration

enabled boolean ​

If audit is enabled and incoming api requests will be logged based on the supplied policy.

disableAgentSyncBack boolean ​

If true, the agent will not send back any audit logs to Loft itself.

level integer ​

Level is an optional log level for audit logs. Cannot be used together with policy

policy object ​

The audit policy to use and log requests. By default loft will not log anything

rules object[] ​

Rules specify the audit Level a request should be recorded at. A request may match multiple rules, in which case the FIRST matching rule is used. The default audit level is None, but can be overridden by a catch-all rule at the end of the list. PolicyRules are strictly ordered.

level required string ​

The Level that requests matching this rule are recorded at.

users string[] ​

The users (by authenticated user name) this rule applies to. An empty list implies every user.

userGroups string[] ​

The user groups this rule applies to. A user is considered matching if it is a member of any of the UserGroups. An empty list implies every user group.

verbs string[] ​

The verbs that match this rule. An empty list implies every verb.

resources object[] ​

Resources that this rule matches. An empty list implies all kinds in all API groups.

group string ​

Group is the name of the API group that contains the resources. The empty string represents the core API group.

resources string[] ​

Resources is a list of resources this rule applies to.

For example: 'pods' matches pods. 'pods/log' matches the log subresource of pods. '' matches all resources and their subresources. 'pods/' matches all subresources of pods. '*/scale' matches all scale subresources.

If wildcard is present, the validation rule will ensure resources do not overlap with each other.

An empty list implies all resources and subresources in this API groups apply.

resourceNames string[] ​

ResourceNames is a list of resource instance names that the policy matches. Using this field requires Resources to be specified. An empty list implies that every instance of the resource is matched.

namespaces string[] ​

Namespaces that this rule matches. The empty string "" matches non-namespaced resources. An empty list implies every namespace.

nonResourceURLs string[] ​

NonResourceURLs is a set of URL paths that should be audited. s are allowed, but only as the full, final step in the path. Examples: "/metrics" - Log requests for apiserver metrics "/healthz" - Log all health checks

omitStages string[] ​

OmitStages is a list of stages for which no events are created. Note that this can also be specified policy wide in which case the union of both are omitted. An empty list means no restrictions will apply.

requestTargets string[] ​

RequestTargets is a list of request targets for which events are created. An empty list implies every request.

clusters string[] ​

Clusters that this rule matches. Only applies to cluster requests. If this is set, no events for non cluster requests will be created. An empty list means no restrictions will apply.

omitStages string[] ​

OmitStages is a list of stages for which no events are created. Note that this can also be specified per rule in which case the union of both are omitted.

dataStoreEndpoint string ​

DataStoreEndpoint is an endpoint to store events in.

dataStoreTTL integer ​

DataStoreMaxAge is the maximum number of hours to retain old log events in the datastore

path string ​

The path where to save the audit log files. This is required if audit is enabled. Backup log files will be retained in the same directory.

maxAge integer ​

MaxAge is the maximum number of days to retain old log files based on the timestamp encoded in their filename. Note that a day is defined as 24 hours and may not exactly correspond to calendar days due to daylight savings, leap seconds, etc. The default is not to remove old log files based on age.

maxBackups integer ​

MaxBackups is the maximum number of old log files to retain. The default is to retain all old log files (though MaxAge may still cause them to get deleted.)

maxSize integer ​

MaxSize is the maximum size in megabytes of the log file before it gets rotated. It defaults to 100 megabytes.

compress boolean ​

Compress determines if the rotated log files should be compressed using gzip. The default is not to perform compression.

loftHost string ​

LoftHost holds the domain where the loft instance is hosted. This should not include https or http. E.g. loft.my-domain.com

projectNamespacePrefix string ​

ProjectNamespacePrefix holds the prefix for loft project namespaces. Omitted defaults to "p-"

devPodSubDomain string ​

DEPRECATED: DevPodSubDomain holds a subdomain in the following form *.workspace.my-domain.com DevPodSubDomain holds a subdomain in the following form *.workspace.my-domain.com

uiSettings object ​

UISettings holds the settings for modifying the Loft user interface

loftVersion string ​

LoftVersion holds the current loft version

logoURL string ​

LogoURL is url pointing to the logo to use in the vCluster Platform UI. This path must be accessible for clients accessing the vCluster Platform UI!

faviconURL string ​

FaviconURL is url pointing to the favicon to use in the vCluster Platform UI. This path must be accessible for clients accessing the vCluster Platform UI!

smallLogoURL string ​

SmallLogoURL is url pointing to the small logo to use in the vCluster Platform UI. This path must be accessible for clients accessing the vCluster Platform UI!

logoBackgroundColor string ​

LogoBackgroundColor is the color value (ex: "#12345") to use as the background color for the logo

legalTemplate string ​

LegalTemplate is a text (html) string containing the legal template to prompt to users when authenticating to Loft

primaryColor string ​

PrimaryColor is the color value (ex: "#12345") to use as the primary color

sidebarColor string ​

SidebarColor is the color value (ex: "#12345") to use for the sidebar

accentColor string ​

AccentColor is the color value (ex: "#12345") to use for the accent

customCss string[] ​

CustomCSS holds URLs with custom css files that should be included when loading the UI

customJavaScript string[] ​

CustomJavaScript holds URLs with custom js files that should be included when loading the UI

navBarButtons object[] ​

NavBarButtons holds extra nav bar buttons

position string ​

Position holds the position of the button, can be one of: TopStart, TopEnd, BottomStart, BottomEnd. Defaults to BottomEnd

text string ​

Text holds text for the button

Link holds the link of the navbar button

icon string ​

Icon holds the url of the icon to display

externalURLs object ​

External URLs that can be called from the UI

block boolean ​

Block determines if requests to external URLs from the UI should be blocked

allow string[] ​

Allow specifies which external URLs can be called. In addition to the predefined modules,

  • "vcluster" (license page, feature descriptions, ...)
  • "gtm" (google tag manager)
  • "featurebase" (changelog) any URL can be added to this list. This will allow the UI to make any request to this URL. This is only active when Block is true.

vault object ​

VaultIntegration holds the vault integration configuration

enabled boolean ​

Enabled indicates if the Vault Integration is enabled for the project -- this knob only enables the syncing of secrets to or from Vault, but does not setup Kubernetes authentication methods or Kubernetes secrets engines for vclusters.

address string ​

Address defines the address of the Vault instance to use for this project. Will default to the VAULT_ADDR environment variable if not provided.

skipTLSVerify boolean ​

SkipTLSVerify defines if TLS verification should be skipped when connecting to Vault.

namespace string ​

Namespace defines the namespace to use when storing secrets in Vault.

auth object ​

Auth defines the authentication method to use for this project.

token string ​

Token defines the token to use for authentication.

tokenSecretRef object ​

TokenSecretRef defines the Kubernetes secret to use for token authentication. Will be used if token is not provided.

Secret data should contain the token key.

name string ​

Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Drop kubebuilder:default when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.

key required string ​

The key of the secret to select from. Must be a valid secret key.

optional boolean ​

Specify whether the Secret or its key must be defined

syncInterval string ​

SyncInterval defines the interval at which to sync secrets from Vault. Defaults to 1m. See https://pkg.go.dev/time#ParseDuration for supported formats.

disableConfigEndpoint boolean ​

DisableLoftConfigEndpoint will disable setting config via the UI and config.management.loft.sh endpoint

authenticateVersionEndpoint boolean ​

AuthenticateVersionEndpoint will force authentication for the '/version' endpoint. Will only work with vCluster v0.27 & later

cloud object ​

Cloud holds the settings to be used exclusively in vCluster Cloud based environments and deployments.

releaseChannel string ​

ReleaseChannel specifies the release channel for the cloud configuration. This can be used to determine which updates or versions are applied.

maintenanceWindow object ​

MaintenanceWindow specifies the maintenance window for the cloud configuration. This is a structured representation of the time window during which maintenance can occur.

dayOfWeek string ​

DayOfWeek specifies the day of the week for the maintenance window. It should be a string representing the day, e.g., "Monday", "Tuesday", etc.

timeWindow string ​

TimeWindow specifies the time window for the maintenance. It should be a string representing the time range in 24-hour format, in UTC, e.g., "02:00-03:00".

costControl object ​

CostControl holds the settings related to the Cost Control ROI dashboard and its metrics gathering infrastructure

enabled boolean ​

Enabled specifies whether the ROI dashboard should be available in the UI, and if the metrics infrastructure that provides dashboard data is deployed

global object ​

Global are settings for globally managed components

metrics object ​

Metrics these settings apply to metric infrastructure used to aggregate metrics across all connected clusters

replicas integer ​

Replicas is the number of desired replicas.

resources object ​

Resources are compute resource required by the metrics backend

limits object ​

Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

requests object ​

Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

claims object[] ​

Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.

This field depends on the DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.

name required string ​

Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.

request string ​

Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.

retention string ​

Retention is the metrics data retention period. Default is 1y

storage object ​
storageClass string ​

StorageClass the storage class to use when provisioning the metrics backend's persistent volume If set to "-" or "" dynamic provisioning is disabled If set to undefined or null (the default), the cluster's default storage class is used for provisioning

size string ​

Size the size of the metrics backend's persistent volume

cluster object ​

Cluster are settings for each cluster's managed components. These settings apply to all connected clusters unless overridden by modifying the Cluster's spec

metrics object ​

Metrics are settings applied to metric infrastructure in each connected cluster. These can be overridden in individual clusters by modifying the Cluster's spec

replicas integer ​

Replicas is the number of desired replicas.

resources object ​

Resources are compute resource required by the metrics backend

limits object ​

Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

requests object ​

Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

claims object[] ​

Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.

This field depends on the DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.

name required string ​

Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.

request string ​

Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.

retention string ​

Retention is the metrics data retention period. Default is 1y

storage object ​
storageClass string ​

StorageClass the storage class to use when provisioning the metrics backend's persistent volume If set to "-" or "" dynamic provisioning is disabled If set to undefined or null (the default), the cluster's default storage class is used for provisioning

size string ​

Size the size of the metrics backend's persistent volume

opencost object ​

OpenCost are settings applied to OpenCost deployments in each connected cluster. These can be overridden in individual clusters by modifying the Cluster's spec

replicas integer ​

Replicas is the number of desired replicas.

resources object ​

Resources are compute resource required by the OpenCost backend

limits object ​

Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

requests object ​

Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

claims object[] ​

Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.

This field depends on the DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.

name required string ​

Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.

request string ​

Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.

settings object ​

Settings specify price-related settings that are taken into account for the ROI dashboard calculations.

priceCurrency string ​

PriceCurrency specifies the currency.

averageCPUPricePerNode object ​

AvgCPUPricePerNode specifies the average CPU price per node.

price number ​

Price specifies the price.

timePeriod string ​

TimePeriod specifies the time period for the price.

averageRAMPricePerNode object ​

AvgRAMPricePerNode specifies the average RAM price per node.

price number ​

Price specifies the price.

timePeriod string ​

TimePeriod specifies the time period for the price.

gpuSettings object ​

GPUSettings specifies GPU related settings.

enabled boolean ​

Enabled specifies whether GPU settings should be available in the UI.

averageGPUPrice object ​

AvgGPUPrice specifies the average GPU price.

price number ​

Price specifies the price.

timePeriod string ​

TimePeriod specifies the time period for the price.

controlPlanePricePerCluster object ​

ControlPlanePricePerCluster specifies the price of one physical cluster.

price number ​

Price specifies the price.

timePeriod string ​

TimePeriod specifies the time period for the price.

platformDB object ​

PlatformDB holds the settings related to the postgres database that platform uses to store data

storageClass string ​

StorageClass sets the storage class for the PersistentVolumeClaim used by the platform database statefulSet.

imageBuilder object ​

ImageBuilder holds the settings related to the image builder

enabled boolean ​

Enabled specifies whether the remote image builder should be available. If it's not available building ad-hoc images from a devcontainer.json is not supported

replicas integer ​

Replicas is the number of desired replicas.

resources object ​

Resources are compute resource required by the buildkit containers

limits object ​

Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

requests object ​

Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

claims object[] ​

Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.

This field depends on the DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.

name required string ​

Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.

request string ​

Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.

database object ​

Database represents the database connection settings when deploying the platform with an embedded Kubernetes backed by kine

enabled boolean ​

Enabled defines if the database should be used.

dataSource string ​

DataSource is the kine dataSource to use for the database. This depends on the database format. This is optional for the external database. Examples:

  • mysql: mysql://username:password@tcp(hostname:3306)/k3s
  • postgres: postgres://username:password@hostname:5432/k3s

identityProvider string ​

IdentityProvider is the kine identity provider to use when generating temporary authentication tokens for enhanced security. This is optional for the external database. Examples:

  • aws: RDS IAM Authentication

keyFile string ​

KeyFile is the key file to use for the database. This is optional.

certFile string ​

CertFile is the cert file to use for the database. This is optional.

caFile string ​

CaFile is the ca file to use for the database. This is optional.

extraArgs string[] ​

ExtraArgs are additional arguments to pass to Kine.