You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A Helm chart for an Agent-Enabled Tractus-X Eclipse Data Space Connector configured against Azure Vault. This is a variant of [the Tractus-X Azure Vault Connector Helm Chart](https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector-azure-vault) which allows
26
26
to deal with several data (and agent) planes. The connector deployment consists of at least two runtime consists of a
@@ -46,6 +46,15 @@ You should set your BPNL in the folloing property:
46
46
- 'vault.azure.tenant': Id of the subscription that the vault runs into
47
47
- 'vault.azure.secret' or 'vault.azure.certificate': the secret/credential to use when interacting with Azure Vault
48
48
49
+
### Setting up the transfer token encryption
50
+
51
+
Transfer tokens handed out from the provider to the consumer should be signed and encrypted. For that purpose
52
+
you should setup a private/public certificate as well as a symmetric AES key.
| networkPolicy.dataplane.from | list |`[{"namespaceSelector":{}}]`| Specify from rule network policy for dp (defaults to all namespaces) |
345
354
| networkPolicy.enabled | bool |`false`| If `true` network policy will be created to restrict access to control- and dataplane |
346
355
| participant.id | string |`""`| BPN Number |
347
-
| postgresql | object |`{"auth":{"database":"edc","password":"password","username":"user"},"jdbcUrl":"jdbc:postgresql://postgresql:5432/edc","primary":{"persistence":{"enabled":false}},"readReplicas":{"persistence":{"enabled":false}}}`| Standard settings for persistence, "jdbcUrl", "username" and "password" need to be overridden |
356
+
| postgresql | object |`{"auth":{"database":"edc","password":"password","username":"user"},"jdbcUrl":"jdbc:postgresql://{{ .Release.Name }}-postgresql:5432/edc","primary":{"persistence":{"enabled":false}},"readReplicas":{"persistence":{"enabled":false}}}`| Standard settings for persistence, "jdbcUrl", "username" and "password" need to be overridden |
348
357
| serviceAccount.annotations | object |`{}`||
349
358
| serviceAccount.create | bool |`true`||
350
359
| serviceAccount.imagePullSecrets | list |`[]`| Existing image pull secret bound to the service account to use to [obtain the container image from private registries](https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry)|
Copy file name to clipboardExpand all lines: charts/agent-connector-azure-vault/values.yaml
+3-4Lines changed: 3 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -134,7 +134,7 @@ controlplane:
134
134
# -- The client ID for KeyCloak
135
135
id: ""
136
136
# -- The alias under which the client secret is stored in the vault.
137
-
secretAlias: "client-secret"
137
+
secretAlias: ""
138
138
139
139
service:
140
140
# -- [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service.
@@ -561,7 +561,7 @@ dataplanes:
561
561
562
562
# -- Standard settings for persistence, "jdbcUrl", "username" and "password" need to be overridden
A Helm chart for an Agent-Enabled Tractus-X Eclipse Data Space Connector using In-Memory Persistence. This is a variant of [the Tractus-X In-Memory Connector Helm Chart](https://github.com/eclipse-tractusx/tractusx-edc/tree/main/charts/tractusx-connector-memory) which allows
26
26
to deal with several data (and agent) planes. The connector deployment consists of at least two runtime consists of a
@@ -40,9 +40,19 @@ You should set your BPNL in the folloing property:
40
40
41
41
## Setting up Hashicorp Vault
42
42
43
-
You should set your BPNL in the folloing property:
43
+
You should set configure access to required secrets as follows:
44
44
- 'vault.hashicorp.url': URL of the vault API
45
45
- 'vault.hashicorp.token': A valid, generated access token.
46
+
- 'vault.hashicorp.paths.secret': Api path to the folder hosting the secrets (usually prepended with /v1)
47
+
48
+
### Setting up the transfer token encryption
49
+
50
+
Transfer tokens handed out from the provider to the consumer should be signed and encrypted. For that purpose
51
+
you should setup a private/public certificate as well as a symmetric AES key.
| tests | object |`{"hookDeletePolicy":"before-hook-creation,hook-succeeded"}`| Configurations for Helm tests |
342
352
| tests.hookDeletePolicy | string |`"before-hook-creation,hook-succeeded"`| Configure the hook-delete-policy for Helm tests |
343
-
| vault | object |`{"hashicorp":{"healthCheck":{"enabled":true,"standbyOk":true},"paths":{"health":"/v1/sys/health","secret":"/v1/secret"},"timeout":30,"token":"","url":"http://{{ .Release.Name }}-vault:8200"},"injector":{"enabled":false},"secretNames":{"transferProxyTokenEncryptionAesKey":"transfer-proxy-token-encryption-aes-key","transferProxyTokenSignerPrivateKey":null,"transferProxyTokenSignerPublicKey":null},"server":{"dev":{"devRootToken":"root","enabled":true},"postStart":null}}`| Standard settings for persistence, "jdbcUrl", "username" and "password" need to be overridden |
353
+
| vault | object |`{"hashicorp":{"healthCheck":{"enabled":true,"standbyOk":true},"paths":{"health":"/v1/sys/health","secret":"/v1/secret"},"timeout":30,"token":"","url":"http://{{ .Release.Name }}-vault:8200"},"injector":{"enabled":false},"secretNames":{"transferProxyTokenEncryptionAesKey":null,"transferProxyTokenSignerPrivateKey":null,"transferProxyTokenSignerPublicKey":null},"server":{"dev":{"devRootToken":"root","enabled":true},"postStart":null}}`| Standard settings for persistence, "jdbcUrl", "username" and "password" need to be overridden |
354
+
| vault.hashicorp.paths.health | string |`"/v1/sys/health"`| Default health api |
355
+
| vault.hashicorp.paths.secret | string |`"/v1/secret"`| Path to secrets needs to be changed if install.vault=false |
356
+
| vault.hashicorp.token | string |`""`| Access token to the vault service needs to be changed if install.vault=false |
357
+
| vault.hashicorp.url | string |`"http://{{ .Release.Name }}-vault:8200"`| URL to the vault service, needs to be changed if install.vault=false |
358
+
| vault.secretNames.transferProxyTokenEncryptionAesKey | string |`nil`| encrypt handed out tokens with this symmetric key |
359
+
| vault.secretNames.transferProxyTokenSignerPrivateKey | string |`nil`| sign handed out tokens with this key |
360
+
| vault.secretNames.transferProxyTokenSignerPublicKey | string |`nil`| sign handed out tokens with this certificate |
344
361
345
362
----------------------------------------------
346
363
Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
0 commit comments