athenz-sia.env

#######################################################################################
# Guidelines for managing the env file here:
#   - If a default value is present, it must be provided with the URL where the default value is set
#   - Follow the order of env variables as listed on https://github.com/AthenZ/k8s-athenz-sia/blob/main/pkg/config/config.go
#######################################################################################
#
# Booting mode of SIA
# must be one of "init" or "refresh"
#   "init": SIA will exit after a single credential retrieval
#   "refresh": SIA will run as a continuous process to retrieve credentials periodically and also runs as an HTTP server to provide credentials and metrics
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L114
#
MODE=init
#
# Athenz ZTS URL for SIA to request for X.509 certificate
#   https://<ZTS HOST>:<ZTS PORT>/zts/v1 (e.g. "https://www.athenz.io:4443/zts/v1")
#
ENDPOINT=
#
# Athenz Service name for the cloud provider
#   <Athenz Domain>.<Athenz Service> (e.g. "cloud-provider-top-level-domain.cluster-name.identityd-service")
#
PROVIDER_SERVICE=
#
# Suffix restriction for SANs(Subject Alternative Names) DNS field in X.509 certificate
#   Subject Alternative Names:
#     "DNS: <any name>.<Provider DNS Suffix>"
#     "DNS: <Instance ID>.instanceid.athenz.<Provider DNS Suffix>"
# Note: <Provider DNS Suffix> must meat the suffix registered in Athenz (e.g. ".athenz.cloud")
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L42
#
DNS_SUFFIX=athenz.cloud
#
# Refresh interval for SIA to request to ZTS periodically in containers to get X.509 identity certificate
# Note: This only applies for refresh mode
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L115
#
REFRESH_INTERVAL=24h
#
# Delay interval for SIA to boot
# This may be useful when you want to prevent large number of SIA to make requests to ZTS concurrently in a short period
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L116
#
DELAY_JITTER_SECONDS=0
#
# File path to store X.509 certificate key file (e.g. /var/run/athenz/tls.key)
#
KEY_FILE=
#
# File path to store X.509 certificate file (e.g. /var/run/athenz/tls.crt)
#
CERT_FILE=
#
# File path to store X.509 ca certificate file that can verify CERT_FILE (e.g. /var/run/athenz/ca.crt)
#
CA_CERT_FILE=
#
# CertificateAuthorityBundle name to retrieve intermediate certificate
#
INTERMEDIATE_CERT_BUNDLE=
#
# Mode to store/load backup of X.509 certificate to/from Kubernetes Secret
# If write is specified, sia must be run uniquely per each secret to prevent conflict
# "": backup disabled
# "read": read backup from kubernetes secret
# "write": write backup into kubernetes secret
# "read+write": read & write backup from/into kubernetes secret
#
BACKUP=
#
# Kubernetes TLS Secret to backup and load X.509 certificate files
#
CERT_SECRET=
#
# Cloud users Athenz Domain to map to SIA
#
#   if <ATHENZ_DOMAIN> is not "", Athenz Domain would be:
#     "<ATHENZ_PREFIX><ATHENZ_DOMAIN><ATHENZ_SUFFIX>"
#   <ATHENZ_PREFIX> must end with "."
#   <ATHENZ_SUFFIX> must start with "."
#   Example:
#        ATHENZ_PREFIX="some-tld.foo."
#        ATHENZ_DOMAIN="cluster-bar"
#        ATHENZ_SUFFIX=".baz"
#
#   if <ATHENZ_DOMAIN> is "", Athenz Domain would be:
#     "<ATHENZ_PREFIX><NAMESPACE><ATHENZ_SUFFIX>"
#   <NAMESPACE> is Kubernetes Namespace set by default
#   <ATHENZ_PREFIX> must end with "."
#   <ATHENZ_SUFFIX> must start with "."
#   Example:
#        ATHENZ_PREFIX="some-tld.foo."
#        NAMESPACE="namespace-bar"
#        ATHENZ_SUFFIX=".baz"
#
# NAMESPACE may be extracted from metadata.namespace in Kubernetes manifests
#
NAMESPACE=
ATHENZ_DOMAIN=
ATHENZ_PREFIX=
ATHENZ_SUFFIX=
#
# Kubernetes Service Account as same name as Athenz Service
#
# SERVICEACCOUNT may be extracted from spec.serviceAccountName in Kubernetes manifests
#
SERVICEACCOUNT=
#
# File path for Kubernetes Service Account Token
# The default is usually "/var/run/secrets/kubernetes.io/bound-serviceaccount/token"
#
SA_TOKEN_FILE=
#
# Kubernetes Pod IP
#
# POD_IP may be extracted from status.podIP in Kubernetes manifests
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L85
#
POD_IP=
#
# Kubernetes Pod UID
#
# POD_UID may be extracted from metadata.uid in Kubernetes manifests
#
POD_UID=
#
# Kubernetes Pod Name
#
# POD_NAME may be extracted from metadata.name in Kubernetes manifests
# At this point in Mar 2024, POD_NAME is only used for token cache features
#
POD_NAME=
#
# CA certificate to verify ZTS server certificate
#
SERVER_CA_CERT=
#
# Comma separated Athenz Roles to retrieve role certificates
#   <Domain>:role.<Role>,<Domain>:role.<Role>...
#
TARGET_DOMAIN_ROLES=
#
# Directory path to store Athenz X.509 role certificate files (e.g. /var/run/athenz/rolecerts)
#
ROLECERT_DIR=
#
# Naming format for the file that outputs the role certificate(e.g. /var/run/athenz/rolecerts/{{domain}}{{delimiter}}{{role}}.cert.pem)
#
ROLE_CERT_NAMING_FORMAT=
#
# File name delimiter for Athenz X.509 role certificate files
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L43
#
ROLE_CERT_FILENAME_DELIMITER=:role.
#
# Outputs private key specifically for role certificates (e.g. true or false)
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/dbbf93b9e22dbb0a38146ccfd9205f5169595144/pkg/config/default.go#L92
#
ROLE_CERT_KEY_FILE_OUTPUT=false
#
# Naming format for the file that outputs the private key specifically for role certificates(e.g. /var/run/athenz/rolecerts/{{domain}}{{delimiter}}{{role}}.key.pem)
#
ROLE_CERT_KEY_NAMING_FORMAT=
#
# Athenz Role Auth Header to retrieve role tokens
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L41
#
ROLE_AUTH_HEADER=Athenz-Role-Auth
#
# Token type for Athenz role tokens
# Available values are: roletoken, accesstoken, roletoken+accesstoken
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L94
#
TOKEN_TYPE=accesstoken
#
# Refresh interval for SIA to request to ZTS periodically in containers to get role tokens
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L31
#
TOKEN_REFRESH_INTERVAL=30m
#
# Token expiry duration (0 to use Athenz server's default expiry)
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L32
#
TOKEN_EXPIRY=0
#
# Server address to listen as token provider sidecar (e.g. :8080)
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L97
#
TOKEN_SERVER_ADDR=
#
# Enable token server RESTful API
# Available values are: true, false
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L98
#
TOKEN_SERVER_REST_API=false
#
# Token server timeout
#
TOKEN_SERVER_TIMEOUT=3s
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L34
#
# Token server TLS CA path (if set, enable TLS Client Authentication)
#
TOKEN_SERVER_TLS_CA_PATH=
#
# Token server TLS certificate path (if empty, disable TLS)
#
TOKEN_SERVER_TLS_CERT_PATH=
#
# Token server TLS certificate key path (if empty, disable TLS)
#
TOKEN_SERVER_TLS_KEY_PATH=
#
# Directory path to store Athenz role token files (e.g. /var/run/athenz)
#
TOKEN_DIR=
#
# Naming format for the file that outputs the AccessToken(e.g. /var/run/athenz/accesstokens/{{domain}}{{delimiter}}{{role}}.accesstoken)
#
ACCESS_TOKEN_NAMING_FORMAT=
#
# File name delimiter for Athenz AccessToken files
#
ACCESS_TOKEN_FILENAME_DELIMITER=:role.
#
# Naming format for the file that outputs the RoleToken(e.g. /var/run/athenz/roletokens/{{domain}}{{delimiter}}{{role}}.roletoken)
#
ROLE_TOKEN_NAMING_FORMAT=
#
# File name delimiter for Athenz RoleToken files
ROLE_TOKEN_FILENAME_DELIMITER=:role.
#
# Server address to listen as metrics exporter sidecar (e.g. :9999)
#
METRICS_SERVER_ADDR=
#
# Delete Instance ID at container shutdown
#
DELETE_INSTANCE_ID=false
#
# Enable token server
# When enabled, runs a server that appends AccessToken and RoleToken to the request headers,
# aligning with the de facto standard adopted by widely-used proxies such as Envoy, nginx, etc.
# Available values are: true, false
#
USE_TOKEN_SERVER=
#
# Directory to store the log files (e.g. /var/log/athenz-sia)
#
LOG_DIR=
#
# Log level to print logs
# Available values are: TRACE, DEBUG, INFO, WARNING, ERROR, FATAL or PANIC
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L112
#
LOG_LEVEL=INFO
#
# HTTP server address to provide health check (e.g. :6080)
#
HEALTH_CHECK_ADDR=
#
# HTTP server endpoint to provide health check (e.g. /healthz)
#
HEALTH_CHECK_ENDPOINT=
#
# Graceful shutdown timeout
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L47
#
SHUTDOWN_TIMEOUT=5s
#
# Graceful shutdown delay
# Default value for binary: https://github.com/AthenZ/k8s-athenz-sia/blob/c8478297a9d228ffc0a6a1ea469ad0ef8a682dc8/pkg/config/default.go#L48
#
SHUTDOWN_DELAY=0