Skip to main content

Configuring SecureAuth Helm Charts

Learn how to configure SecureAuth Helm Charts and apply changes to your deployments.

Applying Changes to SecureAuth Helm Charts Configuration​

There are two ways to apply changes to the configuration:

  • Specify each parameter using the --set key=value[,key=value] argument to command helm install or helm upgrade.

    For example:

    helm install my-release --set certManager.enabled=true acp/acp

  • While installing the chart, provide the YAML file that specifies default parameter overrides.

    See below for an example of how to create myvalues.yaml file:

    certManager
      enabled: true

    helm install myrelease -f my_values.yaml acp/acp

    Result: cert-manager has been enabled in SecureAuth and is ready to be used.

Generic configuration​

  • Resources define compute resources available to a pod. It is also required for autoscaling. If no limits are specified, pod will be able to use all resources available on a node. It is not recommended to set CPU limit unless you use integer value to assign full vCPUs. CPU consumption highly depends on the number of incoming request while memory is more static value. Below example is good starting point for your deployment.

    resources:
      requests:
        cpu: 500m
        memory: 1.2Gi
      limits:
        memory: 2Gi

  • Affinity allows user to control scheduling of pods based on labels of other pods or nodes. SecureAuth is highly efficient and its not recommended to run more then one instance on a same node as this might lead to degraded performance (if there is no CPU limit set). Below example provides a way to force one SecureAuth instance per host.

    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/instance: acp
                app.kubernetes.io/name: acp-primary
            topologyKey: kubernetes.io/hostname

  • Topology Spread Constraints provides a way to spread pods across topology domain like cloud provider zone. For high availability purpose, SecureAuth should be spread across multiple zones as well as hosts in the same zone. Below example provides soft requirement for zone spread with a maximum distribution difference of 1 pod per zone.

    topologySpreadConstraints:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/instance: acp
            app.kubernetes.io/name: acp
        maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: ScheduleAnyway

  • Pod Disruption Budget is a feature that provides pods resilence to voluntary (application update) and involuntary (hardware failure) disruptions. It definies minimum number of pods that must be running at any times. Below example shows that SecureAuth should not be taken below 50% of desired replicas.

    podDisruptionBudget:
      minAvailable: 50%

Platform Configuration​

The SecureAuth platform configuration can be provided by including the required parameters via dedicated keys and optional parameters via the custom config.

If you wish to enable features behind a feature flag, it can be done in two ways:

  • You can enable System feature flags globally for all tenants within the deployment by configuring them in the features section of the Helm Chart.

  • Tenant feature flags can be turned on either in the features section of the Helm Chart, or in the Tenant Management view in the Admin Workspace in the System Tenant.

Learn more about platform configuration or see the SecureAuth Platform Configuration Reference to view all available settings.

SecureAuth Helm Chart Configuration Reference​

The chart's default values.yaml documents every chart setting. To see the values for the chart version you install, run:

helm repo add acp https://helm.secureauth.com
helm repo update
helm show values acp/acp --version <chart-version>

Leave out --version to see the values of the latest chart. The source is charts/acp/values.yaml in the iam-saas-helm-charts repository.