text:
Infinite Redirect Loop with Duende IdentityServer using Terraform Helm Provider on AWS Kubernetes

Summary:
I'm experiencing an infinite redirect loop when deploying TheIdServer with Duende IdentityServer on a Kubernetes cluster in AWS (using Linux instances). The deployment is managed via the Terraform Helm provider.
Details:

Expected Behavior: After authenticating with Duende IdentityServer, I expect to be redirected back to my application's designated return URL and remain there.

Actual Behavior: After authentication, I'm caught in an infinite loop of redirects between my application and TheIdServer.

Reproduction Steps:

Followed the tutorial from this link.
Deployed TheIdServer on an AWS Kubernetes cluster (Linux instances) using Terraform Helm provider.
Started the authentication process from my application.
Completed the authentication on Duende IdentityServer.
Observed the infinite redirect loop between the application and TheIdServer.

Environment & Configuration:

OS: AWS Kubernetes Cluster with Linux instances.
Browser: Predominantly on Chrome, but the issue is reproducible on other browsers as well.
TheIdServer Version: Using image aguacongas/theidserver.duende:7.4.6
Terraform: v1.6.2 on linux_amd64
Providers:

registry.terraform.io/hashicorp/helm v2.11.0
registry.terraform.io/hashicorp/kubernetes v2.23.0
registry.terraform.io/hashicorp/random v3.5.1
registry.terraform.io/hashicorp/tls v4.0.4

Any custom configurations or setups, if any.

Additional Information:

I have ensured that the client application's redirect URL and post-logout redirect URL are correctly configured.
Cookie names have been checked for uniqueness to avoid any overlap.
The issue persists across different environments (dev, staging).

How did you configure your app ?
What's auth flow you use ?
Can you share browser log (console and network) ?

Sure, here's the configuration I'm using with the Terraform Helm provider:
module "theidserver" {
  source = "Aguafrommars/theidserver/helm"
  host = "myserver.mydomaine.com"
  tls_issuer_name = "letsencrypt-prod"
  tls_issuer_kind = "ClusterIssuer"
  create_namespace = true

  override_settings = local.values
  image = {
    repository = "aguacongas/theidserver.duende"
    pullPolicy = "Always"
    tag = "7.4.6"
  }
}

Additionally, here's the related configuration from my YAML file:

NAME: theidserver
LAST DEPLOYED: Mon Oct 30 13:45:05 2023
NAMESPACE: theidserver
STATUS: failed
REVISION: 1
CHART: theidserver
VERSION: 4.8.0
APP_VERSION: 4.5.2
USER-SUPPLIED VALUES:
adminSettings:
  apiBaseUrl: https://www.myserver.example.com/api
  providerOptions:
    authority: https://www.myserver.example.com
    postLogoutRedirectUri: https://www.myserver.example.com/authentication/logout-callback
    redirectUri: https://www.myserver.example.com/authentication/login-callback
  settingsOptions:
    apiUrl: https://www.myserver.example.com/api/api/configuration
  welcomeContenUrl: https://www.myserver.example.com/api/welcomefragment
appSettings:
  env:
    InitialData__Users__0__Password: '@s4foqGjoa9k4xMC'
  file:
    ApiAuthentication:
      ApiSecret: e14E5]V&@XeX%[Rh
      Authority: https://www.myserver.example.com
    BackchannelAuthenticationUserNotificationServiceOptions:
      ApiUrl: https://www.myserver.example.com/api/email
      Authority: https://www.myserver.example.com
      ClientSecret: '@%}51pk:Ze+157}4'
    EmailApiAuthentication:
      ApiUrl: https://www.myserver.example.com/api/email
      Authority: https://www.myserver.example.com
      ClientSecret: '@%}51pk:Ze+157}4'
    InitialData:
      Apis:
      - ApiSecrets:
        - Type: SharedSecret
          Value: e14E5]V&@XeX%[Rh
        DisplayName: TheIdServer admin API
        Name: theidserveradminapi
        Scopes:
        - theidserveradminapi
        - theidservertokenapi
        UserClaims:
        - name
        - role
      Clients:
      - AccessTokenType: Reference
        AllowedCorsOrigins:
        - https://www.myserver.example.com
        AllowedGrantTypes:
        - authorization_code
        AllowedScopes:
        - openid
        - profile
        - theidserveradminapi
        BackChannelLogoutSessionRequired: false
        ClientClaimsPrefix: null
        ClientId: theidserveradmin
        ClientName: TheIdServer admin SPA Client
        ClientUri: https://www.myserver.example.com
        FrontChannelLogoutSessionRequired: false
        PostLogoutRedirectUris:
        - https://www.myserver.example.com/authentication/logout-callback
        RedirectUris:
        - https://www.myserver.example.com/authentication/login-callback
        RequireClientSecret: false
        RequirePkce: true
      - AccessTokenType: Reference
        AllowedGrantTypes:
        - client_credentials
        AllowedScopes:
        - openid
        - profile
        - theidserveradminapi
        BackChannelLogoutSessionRequired: false
        Claims:
        - Type: role
          Value: Is4-Writer
        - Type: role
          Value: Is4-Reader
        ClientClaimsPrefix: null
        ClientId: public-server
        ClientName: Public server Credentials Client
        ClientSecrets:
        - Type: SharedSecret
          Value: '@%}51pk:Ze+157}4'
        FrontChannelLogoutSessionRequired: false
      - AllowAccessTokensViaBrowser: true
        AllowedCorsOrigins:
        - https://www.myserver.example.com
        AllowedGrantTypes:
        - implicit
        BackChannelLogoutSessionRequired: false
        ClientClaimsPrefix: null
        ClientId: theidserver-swagger
        ClientName: TheIdServer Swagger UI
        FrontChannelLogoutSessionRequired: false
        RedirectUris:
        - https://www.myserver.example.com/authentication/login-callback
        RequireClientSecret: false
      Users:
      - Claims:
        - ClaimType: name
          ClaimValue: TheIdServer Admin
        - ClaimType: given_name
          ClaimValue: Admin
        - ClaimType: nickname
          ClaimValue: Admin
        Email: admin@myserver.example.com
        EmailConfirmed: true
        Roles:
        - Is4-Writer
        - Is4-Reader
        UserName: admin@myserver.example.com
dataProtection:
  create: false
  crt: LS0tLS1CRUdJT.....
  key: LS0tLS1CRUdJT..
image:
  pullPolicy: Always
  repository: aguacongas/theidserver.duende
  tag: 7.4.6
ingress:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
    nginx.ingress.kubernetes.io/proxy-buffering: "on"
    nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  enabled: true
  hosts:
  - host: www.myserver.example.com
  tls:
    hosts:
    - www.myserver.example.com
mysql:
  architecture: replication
  auth:
    database: theidserver
    password: p5OoG9fKYDnUqyt1
    replicationPassword: $eMTZb}v=Pjw%${z
    replicationUser: theidserverReplication
    rootPassword: nRYfHb7dYscfjAfT
    username: theidserver
redis:
  auth:
    password: Y(c&vyj+1N6J#Ug8
  replica:
    replicaCount: 1
replicaCount: 3
seq:
  ingress:
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
    tls:
    - hosts:
      - seq.myserver.example.com
      secretName: theidserver-seq
  ui:
    ingress:
      enabled: true
      hosts:
      - seq.myserver.example.com
      path: /
service:
  ports:
    https: 443
signingKey:
  create: false
  crt: LS0tLS1C...
  key: LS0tLS1CRUdJTiBSU0Eg....
ssl:
  ca:
    create: false
    trust: false
  create: false
  issuer:
    enabled: true
    kind: ClusterIssuer
    ref: letsencrypt-prod

COMPUTED VALUES:
adminSettings:
  administratorEmail: aguacongas@gmail.com
  apiBaseUrl: https://www.myserver.example.com/api
  authenticationPaths:
    remoteProfilePath: /identity/account/manage
    remoteRegisterPath: /identity/account/register
  loggingOptions:
    minimum: Warning
  menuOptions:
    showSettings: true
  prerendered: true
  providerOptions:
    authority: https://www.myserver.example.com
    clientId: theidserveradmin
    defaultScopes:
    - theidserveradminapi
    postLogoutRedirectUri: https://www.myserver.example.com/authentication/logout-callback
    redirectUri: https://www.myserver.example.com/authentication/login-callback
    responseType: code
  settingsOptions:
    apiUrl: https://www.myserver.example.com/api/api/configuration
    typeName: Aguacongas.TheIdServer.BlazorApp.Models.ServerConfig, Aguacongas.TheIdServer.BlazorApp.Infrastructure
  userOptions:
    roleClaim: role
  welcomeContenUrl: https://www.myserver.example.com/api/welcomefragment
affinity: {}
appSettings:
  env:
    InitialData__Users__0__Password: '@s4foqGjoa9k4xMC'
  file:
    AccountOptions:
      AutomaticRedirectAfterSignOut: true
      ShowLogoutPrompt: false
    ApiAuthentication:
      ApiName: theidserveradminapi
      ApiSecret: e14E5]V&@XeX%[Rh
      Authority: https://www.myserver.example.com
      CacheDuration: "0:10:0"
      EnableCaching: true
      LegacyAudienceValidation: true
      RequireHttpsMetadata: false
      SupportedTokens: Both
    AuthenticatorIssuer: TheIdServer
    BackchannelAuthenticationUserNotificationServiceOptions:
      ApiUrl: https://www.myserver.example.com/api/email
      Authority: https://www.myserver.example.com
      ClientId: public-server
      ClientSecret: '@%}51pk:Ze+157}4'
      HttpClientName: ciba
      Scope: theidserveradminapi
    DataProtectionOptions:
      KeyProtectionOptions:
        KeyProtectionKind: X509
        X509CertificatePath: /usr/local/share/ca-certificates/dp.pfx
      StorageKind: EntityFramework
    DbType: MySql
    DynamicClientRegistrationOptions:
      AllowedContacts:
        AllowedHosts:
        - www.certification.openid.net
        Contact: certification@oidf.org
    DynamicConfigurationOptions:
      ProviderType: Aguacongas.DynamicConfiguration.Redis.RedisConfigurationProvider,
        Aguacongas.DynamicConfiguration.Redis
    EmailApiAuthentication:
      ApiUrl: https://www.myserver.example.com/api/email
      Authority: https://www.myserver.example.com
      ClientId: public-server
      ClientSecret: '@%}51pk:Ze+157}4'
      HttpClientName: email
      Scope: theidserveradminapi
    EnableOpenApiDoc: true
    IdentityOptions:
      SignInOptions:
        RequireConfirmedAccount: false
      UserOptions:
        AllowedUserNameCharacters: 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+ '
    IdentityServer:
      Key:
        KeyProtectionOptions:
          KeyProtectionKind: X509
          X509CertificatePath: /usr/local/share/ca-certificates/sk.pfx
        StorageKind: EntityFramework
        Type: KeysRotation
    IdentityServerOptions:
      Endpoints:
        EnableJwtRequestUri: true
    InitialData:
      ApiScopes:
      - DisplayName: TheIdServer admin API scope
        Name: theidserveradminapi
        UserClaims:
        - name
        - role
      - DisplayName: TheIdServer token API scope
        Name: theidservertokenapi
        UserClaims:
        - name
        - role
      Apis:
      - ApiSecrets:
        - Type: SharedSecret
          Value: e14E5]V&@XeX%[Rh
        DisplayName: TheIdServer admin API
        Name: theidserveradminapi
        Scopes:
        - theidserveradminapi
        - theidservertokenapi
        UserClaims:
        - name
        - role
      Clients:
      - AccessTokenType: Reference
        AllowedCorsOrigins:
        - https://www.myserver.example.com
        AllowedGrantTypes:
        - authorization_code
        AllowedScopes:
        - openid
        - profile
        - theidserveradminapi
        BackChannelLogoutSessionRequired: false
        ClientClaimsPrefix: null
        ClientId: theidserveradmin
        ClientName: TheIdServer admin SPA Client
        ClientUri: https://www.myserver.example.com
        FrontChannelLogoutSessionRequired: false
        PostLogoutRedirectUris:
        - https://www.myserver.example.com/authentication/logout-callback
        RedirectUris:
        - https://www.myserver.example.com/authentication/login-callback
        RequireClientSecret: false
        RequirePkce: true
      - AccessTokenType: Reference
        AllowedGrantTypes:
        - client_credentials
        AllowedScopes:
        - openid
        - profile
        - theidserveradminapi
        BackChannelLogoutSessionRequired: false
        Claims:
        - Type: role
          Value: Is4-Writer
        - Type: role
          Value: Is4-Reader
        ClientClaimsPrefix: null
        ClientId: public-server
        ClientName: Public server Credentials Client
        ClientSecrets:
        - Type: SharedSecret
          Value: '@%}51pk:Ze+157}4'
        FrontChannelLogoutSessionRequired: false
      - AllowAccessTokensViaBrowser: true
        AllowedCorsOrigins:
        - https://www.myserver.example.com
        AllowedGrantTypes:
        - implicit
        BackChannelLogoutSessionRequired: false
        ClientClaimsPrefix: null
        ClientId: theidserver-swagger
        ClientName: TheIdServer Swagger UI
        FrontChannelLogoutSessionRequired: false
        RedirectUris:
        - https://www.myserver.example.com/authentication/login-callback
        RequireClientSecret: false
      Users:
      - Claims:
        - ClaimType: name
          ClaimValue: TheIdServer Admin
        - ClaimType: given_name
          ClaimValue: Admin
        - ClaimType: nickname
          ClaimValue: Admin
        Email: admin@myserver.example.com
        EmailConfirmed: true
        Roles:
        - Is4-Writer
        - Is4-Reader
        UserName: admin@myserver.example.com
    Migrate: true
    RedisConfigurationOptions:
      Channel: Aguacongas.TheIdServer.Duende.Channel
      HashKey: Aguacongas.TheIdServer.Duende
    Seed: true
    Serilog:
      Enrich:
      - FromLogContext
      - WithMachineName
      - WithThreadId
      LevelSwitches:
        $controlSwitch: Information
      MinimumLevel:
        ControlledBy: $controlSwitch
      WriteTo:
      - Args:
          apiKey: DVYuookX2vOq078fuOyJ
          controlLevelSwitch: $controlSwitch
          serverUrl: http://localhost:5341
        Name: Seq
      - Args:
          outputTemplate: '[{Timestamp:HH:mm:ss} {Level}] {SourceContext}{NewLine}{Message:lj}{NewLine}{Exception}{NewLine}'
          theme: Serilog.Sinks.SystemConsole.Themes.AnsiConsoleTheme::Literate, Serilog.Sinks.Console
        Name: Console
      - Args:
          outputTemplate: '[{Timestamp:HH:mm:ss} {Level}] {SourceContext}{NewLine}{Message:lj}{NewLine}{Exception}{NewLine}'
        Name: Debug
    SignalR:
      HubOptions:
        EnableDetailedErrors: true
      RedisOptions:
        Configuration:
          ChannelPrefix: TheIdServer
      UseMessagePack: true
    SiteOptions:
      Name: TheIdServer
    SwaggerUiSettings:
      OAuth2Client:
        AppName: TheIdServer Swagger UI
        ClientId: theidserver-swagger
        UsePkceWithAuthorizationCodeGrant: true
      WithCredentials: true
    TokenCleanupInterval: "00:05:00"
autoscaling:
  enabled: false
  maxReplicas: 100
  minReplicas: 1
  targetCPUUtilizationPercentage: 80
connectionString: null
dataProtection:
  cn: null
  create: false
  crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFakNDQWZxZ0F3SUJBZ0lRVU42dGI2M1BCUCt4eElvZjNWbjd1ekFOQmdrcWhraUc5dzBCQVFzRkFEQXoKTVJjd0ZRWURWUVFLRXc1QlozVmhJR1p5YjIwZ1RXRnljekVZTUJZR0ExVUVBeE1QWVdkMVlXWnZiVzF0WVhKegpJRU5CTUNBWERUSXpNVEF6TURFM05EVXdNbG9ZRHpJeE1qTXhNREEyTVRjME5UQXlXakF6TVJjd0ZRWURWUVFLCkV3NUJaM1ZoSUdaeWIyMGdUV0Z5Y3pFWU1CWUdBMVVFQXhNUFlXZDFZV1p2YlcxdFlYSnpJRU5CTUlJQklqQU4KQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBcDNaWGlDZldjZ0FsczhldG5qTmthaWkwWHFScwpHZXk5VkJybXFTVWpNWmdsMDlJbWVXa3dUMWtrZGg3T0FkQTcvSUhwckp3VmRIS3JqTDJuNy9TQ2FDRVZxTDBTCldoOFAvZ3FzY05TSDhEOEFwNTlUVUlnemRjenhLTUx5VEpUcUw1MjVWbDJXM2pQNkJvbUc2M2ZzUTR3NU9VUmoKWC8xc3JZZ0VnSWtmTGVTcThrWlYyaGYwUnNJN2piN1RITmJLWEdVSnpXTWw0R1JQVXUzMEhEanR6T2lZQlFvOApZRXZoZGMyYzY5SVZ2RGRYTXBmYnFUcnBLZnh1NWdqUkRkeG50RDNLVHJpSUh2cGJOS0RNRU5RMkNOTStPSkpaCk11MTVNTGxYcUdwRWJQTFBsZXh1R0RVajM4LytVOStRVis3OEllcmxKMVVPUUtEWGpDYzdRMGhCb1FJREFRQUIKb3lBd0hqQU9CZ05WSFE4QkFmOEVCQU1DQkxBd0RBWURWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQVFFQWFFV1FEd2VDNjlaMGc2YXVIS3B3d3NoZm4xcHFlSlBTYjdESitBMWRDNjJPVkhFcXc3aFZSMDIrCjFaa3dPU0FUOTIzNXRGbW8rYnFZT1Z5MytETEphR0FHVmVxVDNWZ0YwWVZrN1FSTnZSVVY1eVhDK3JBZ1EwU2gKb1dDSHJORHR1N251RUhtRFExMXU4NXFiY2ROSXBWNHh6RGdUL0pQZFErSjFhRlVBMTZxczBBZ2NFN1FQUldmQwpaZXRjTWJselZxanpaeGh3Wlg5SlYxeFFjaGYrR3dGbU4wSFE1a3UxZDJpcmFKOEh1b3UzOGNPR3VuamlKbWVNCmw1U0RXY0IyM3hqM3k0K0tMa28wSzYyVEwwcmh3MmRzbTRZRWRrRkhyYXlDSGwzVkhiSTBJa0RqSFJiTWt3WngKYnI1ZUpxZmRiWi9Ma3pKN0s3b0ZBYlFBZkJSaTN3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  ipList: []
  key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBcDNaWGlDZldjZ0FsczhldG5qTmthaWkwWHFSc0dleTlWQnJtcVNVak1aZ2wwOUltCmVXa3dUMWtrZGg3T0FkQTcvSUhwckp3VmRIS3JqTDJuNy9TQ2FDRVZxTDBTV2g4UC9ncXNjTlNIOEQ4QXA1OVQKVUlnemRjenhLTUx5VEpUcUw1MjVWbDJXM2pQNkJvbUc2M2ZzUTR3NU9VUmpYLzFzcllnRWdJa2ZMZVNxOGtaVgoyaGYwUnNJN2piN1RITmJLWEdVSnpXTWw0R1JQVXUzMEhEanR6T2lZQlFvOFlFdmhkYzJjNjlJVnZEZFhNcGZiCnFUcnBLZnh1NWdqUkRkeG50RDNLVHJpSUh2cGJOS0RNRU5RMkNOTStPSkpaTXUxNU1MbFhxR3BFYlBMUGxleHUKR0RVajM4LytVOStRVis3OEllcmxKMVVPUUtEWGpDYzdRMGhCb1FJREFRQUJBb0lCQUdyUzlQZG40a1lLamdKbQo1L3U0OE44L1kvL1RoeG5xaU1Pei9Wdjgwcng2UC9jbFlXR2xsaW1ueGJpTDRnSUtJWm5zRFhJTWh5c25Vd09PCm9DaFRvelJsbG5selV0ZW1aUDg3TTlFdDRpR0JMeHUrYU5sQWFRTkdYcmdQMDV6Q2lia2lOZTQvK1ZONWVJN2UKLy9BSktlL1U3VlA0cWlPN2Q2NGl6Q3hxVERkclZMT0krMmxEZTJTN1lUVEJ1Q2Z5bG5Vc3AxcElBaHplVDkrSwpOTUJNL2d5SnFuWmhWNUw1bzdnbUVBZE5qNktDdnAybGtsejBxUHI1M2poT3R1eGdhWitQckRNYWhHaDdmczV2CkRTWXNQV2JJUU9UUThQM244Z3NYNWZaT2hSL3Zta1l2VkZibldmUlN3Rzk0YTBFOFJpV0NyUjBzVHdodGFXMmUKOWpGT3BMa0NnWUVBeG5ucXdxWktwRTMyS0R5ZkRpRXFXQnZ0VE52TEVabW8xbC84cllJRzlTdkJYelhDYUlZSQp3ZjhKNWNrQTNtbkRsVjBKMnZWSXUvWTRyQWtVdEdieGpzb2lCbUExVk10T0VhQmRkWXhyU2ZqVHpaNVVpWHFiCjlpOUNyckNqcGZmcnRBRnhNa3N3LzNaRWlSSTBBQmhjNWZ2YTVxWVlpSjg4dXljVlBrY1NhazhDZ1lFQTEvOVMKZFJqODNSZmdIS3c4aUQxaS80OUliS3U5cHBZZGROOGpkbC84ajBpRjZQSklxUjdtUXZVSWE1TmJuVDNXakJSYgpQUm9rTG9Dcnd3dTFBZkpnSUFJOVRKcWRxRGdCN0ZGK05rbXFIYUhjdTlSZDc4UHNRT1BLRGxLN1VZUzJOdmM0Ck1LZVVMODNVM0xmY2RpUEYwbU1Zd2x4S1pZbm1CQ2JOekQyRXlROENnWUVBZ2xPb0hlekg4cC9tMVlFSkNHUXEKdy9TQ25BZHZqcjBScXNNWXptNGxWM1JGNDlrUE1VZGlGTkQ5bE0rcUxHSFN0ZytEMnkxWmQyTTB6M0tmRDk3UgpHMndMYjVoWkxMYmJLcVBjK3NVYjVsVG43NHJhQS9SbzJQMHJrajRYRjNKMmFaclEwNitnR3Y5ei9YWGdnM2Q3CitPQ3FXdTRTQ2hSVjhxYTFRbEcwKyswQ2dZRUF0eURWdkVudk9WUmd3bTZVODcxNERjeGhUeUZjcmJ4Z1JSSmEKY3FaMjd0UkNGSG8yZUl5bUZPYkN1Tkk2dmxvTGFNQnBpcWg3UEtJQy9sOFNuQS91eDdTZVhEQktzckNwa0w2WApEMWZ0VHlwSWgwZEtUVm9ER0JFSTRwUHFGUGM3dGVac1VYUURBM1N6b0Y2U0grZThkTjlud29HVTRmbkVkb2lmCnV5WDlTcWtDZ1lCZFhFcnR4S05vV2xISUtUbW4xYU5CVjZnbzcxbno0UnRMa3EvU0lwVzl6cGhaODdXMCs2YjMKbnJmTDMwMWlxYURCQ1M5Y25aRWQ0SjlnM3RVYTdXcDNEdE5NblcvUXU5aUhNZXRsMEJYNEJCeDRHOTZvTDNjUQpld2x6dmRrNEhNTFpOb0RHWERMUmhzUzVwaUF2aEFvMlJ0RVFOVnQ0a24vSDR1WXZEZUZiaVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
  sanList: []
deploymentAnnotations: {}
fullnameOverride: ""
image:
  pullPolicy: Always
  repository: aguacongas/theidserver.duende
  tag: 7.4.6
imagePullSecrets: []
ingress:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
    nginx.ingress.kubernetes.io/proxy-buffering: "on"
    nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  enabled: true
  hosts:
  - host: www.myserver.example.com
  tls:
    hosts:
    - www.myserver.example.com
mysql:
  architecture: replication
  auth:
    customPasswordFiles: {}
    database: theidserver
    existingSecret: ""
    forcePassword: false
    name: theidserver
    password: p5OoG9fKYDnUqyt1
    replicationPassword: $eMTZb}v=Pjw%${z
    replicationUser: theidserverReplication
    rootPassword: nRYfHb7dYscfjAfT
    usePasswordFiles: false
    user: theidserver
    username: theidserver
  clusterDomain: cluster.local
  common:
    exampleValue: common-chart
    global:
      imagePullSecrets: []
      imageRegistry: ""
      storageClass: ""
  commonAnnotations: {}
  commonLabels: {}
  diagnosticMode:
    args:
    - infinity
    command:
    - sleep
    enabled: false
  enabled: true
  extraDeploy: []
  fullnameOverride: ""
  global:
    imagePullSecrets: []
    imageRegistry: ""
    storageClass: ""
  image:
    debug: false
    pullPolicy: IfNotPresent
    pullSecrets: []
    registry: docker.io
    repository: bitnami/mysql
    tag: 8.0.28-debian-10-r23
  initdbScripts: {}
  initdbScriptsConfigMap: ""
  metrics:
    enabled: false
    extraArgs:
      primary: []
      secondary: []
    image:
      pullPolicy: IfNotPresent
      pullSecrets: []
      registry: docker.io
      repository: bitnami/mysqld-exporter
      tag: 0.13.0-debian-10-r256
    livenessProbe:
      enabled: true
      failureThreshold: 3
      initialDelaySeconds: 120
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    readinessProbe:
      enabled: true
      failureThreshold: 3
      initialDelaySeconds: 30
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    resources:
      limits: {}
      requests: {}
    service:
      annotations:
        prometheus.io/port: '{{ .Values.metrics.service.port }}'
        prometheus.io/scrape: "true"
      port: 9104
      type: ClusterIP
    serviceMonitor:
      additionalLabels: {}
      enabled: false
      honorLabels: false
      interval: 30s
      namespace: ""
      relabellings: []
      scrapeTimeout: ""
  nameOverride: ""
  networkPolicy:
    allowExternal: true
    enabled: false
    explicitNamespacesSelector: {}
  primary:
    affinity: {}
    args: []
    command: []
    configuration: |-
      [mysqld]
      default_authentication_plugin=mysql_native_password
      skip-name-resolve
      explicit_defaults_for_timestamp
      basedir=/opt/bitnami/mysql
      plugin_dir=/opt/bitnami/mysql/lib/plugin
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      datadir=/bitnami/mysql/data
      tmpdir=/opt/bitnami/mysql/tmp
      max_allowed_packet=16M
      bind-address=0.0.0.0
      pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
      log-error=/opt/bitnami/mysql/logs/mysqld.log
      character-set-server=UTF8
      collation-server=utf8_general_ci

      [client]
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      default-character-set=UTF8
      plugin_dir=/opt/bitnami/mysql/lib/plugin

      [manager]
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
    containerSecurityContext:
      enabled: true
      runAsUser: 1001
    customLivenessProbe: {}
    customReadinessProbe: {}
    customStartupProbe: {}
    existingConfigmap: ""
    extraEnvVars: []
    extraEnvVarsCM: ""
    extraEnvVarsSecret: ""
    extraFlags: ""
    extraVolumeMounts: []
    extraVolumes: []
    hostAliases: []
    initContainers: []
    livenessProbe:
      enabled: true
      failureThreshold: 3
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    nodeAffinityPreset:
      key: ""
      type: ""
      values: []
    nodeSelector: {}
    pdb:
      enabled: false
      maxUnavailable: ""
      minAvailable: 1
    persistence:
      accessModes:
      - ReadWriteOnce
      annotations: {}
      enabled: true
      existingClaim: ""
      selector: {}
      size: 8Gi
      storageClass: ""
    podAffinityPreset: ""
    podAnnotations: {}
    podAntiAffinityPreset: soft
    podLabels: {}
    podSecurityContext:
      enabled: true
      fsGroup: 1001
    readinessProbe:
      enabled: true
      failureThreshold: 3
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    resources:
      limits: {}
      requests: {}
    rollingUpdatePartition: ""
    service:
      annotations: {}
      clusterIP: ""
      externalTrafficPolicy: Cluster
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      nodePort: ""
      port: 3306
      type: ClusterIP
    sidecars: []
    startupProbe:
      enabled: true
      failureThreshold: 10
      initialDelaySeconds: 15
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    tolerations: []
    updateStrategy: RollingUpdate
  rbac:
    create: false
  schedulerName: ""
  secondary:
    affinity: {}
    args: []
    command: []
    configuration: |-
      [mysqld]
      default_authentication_plugin=mysql_native_password
      skip-name-resolve
      explicit_defaults_for_timestamp
      basedir=/opt/bitnami/mysql
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      datadir=/bitnami/mysql/data
      tmpdir=/opt/bitnami/mysql/tmp
      max_allowed_packet=16M
      bind-address=0.0.0.0
      pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
      log-error=/opt/bitnami/mysql/logs/mysqld.log
      character-set-server=UTF8
      collation-server=utf8_general_ci

      [client]
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      default-character-set=UTF8

      [manager]
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
    containerSecurityContext:
      enabled: true
      runAsUser: 1001
    customLivenessProbe: {}
    customReadinessProbe: {}
    customStartupProbe: {}
    existingConfigmap: ""
    extraEnvVars: []
    extraEnvVarsCM: ""
    extraEnvVarsSecret: ""
    extraFlags: ""
    extraVolumeMounts: []
    extraVolumes: []
    hostAliases: []
    initContainers: []
    livenessProbe:
      enabled: true
      failureThreshold: 3
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    nodeAffinityPreset:
      key: ""
      type: ""
      values: []
    nodeSelector: {}
    pdb:
      enabled: false
      maxUnavailable: ""
      minAvailable: 1
    persistence:
      accessModes:
      - ReadWriteOnce
      annotations: {}
      enabled: true
      selector: {}
      size: 8Gi
      storageClass: ""
    podAffinityPreset: ""
    podAnnotations: {}
    podAntiAffinityPreset: soft
    podLabels: {}
    podSecurityContext:
      enabled: true
      fsGroup: 1001
    readinessProbe:
      enabled: true
      failureThreshold: 3
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    replicaCount: 1
    resources:
      limits: {}
      requests: {}
    rollingUpdatePartition: ""
    service:
      annotations: {}
      clusterIP: ""
      externalTrafficPolicy: Cluster
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      nodePort: ""
      port: 3306
      type: ClusterIP
    sidecars: []
    startupProbe:
      enabled: true
      failureThreshold: 15
      initialDelaySeconds: 15
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    tolerations: []
    updateStrategy: RollingUpdate
  serviceAccount:
    annotations: {}
    create: true
    name: ""
  volumePermissions:
    enabled: false
    image:
      pullPolicy: IfNotPresent
      pullSecrets: []
      registry: docker.io
      repository: bitnami/bitnami-shell
      tag: 10-debian-10-r349
    resources: {}
nameOverride: ""
nodeSelector: {}
podAnnotations: {}
podSecurityContext: {}
redis:
  architecture: replication
  auth:
    enabled: true
    existingSecret: ""
    existingSecretPasswordKey: ""
    password: Y(c&vyj+1N6J#Ug8
    sentinel: true
    usePasswordFiles: false
  clusterDomain: cluster.local
  common:
    exampleValue: common-chart
    global:
      imagePullSecrets: []
      imageRegistry: ""
      redis:
        password: ""
      storageClass: ""
  commonAnnotations: {}
  commonConfiguration: |-
    # Enable AOF https://redis.io/topics/persistence#append-only-file
    appendonly yes
    # Disable RDB persistence, AOF persistence already enabled.
    save ""
  commonLabels: {}
  diagnosticMode:
    args:
    - infinity
    command:
    - sleep
    enabled: false
  enabled: true
  existingConfigmap: ""
  extraDeploy: []
  fullnameOverride: ""
  global:
    imagePullSecrets: []
    imageRegistry: ""
    redis:
      password: ""
    storageClass: ""
  image:
    debug: false
    pullPolicy: IfNotPresent
    pullSecrets: []
    registry: docker.io
    repository: bitnami/redis
    tag: 6.2.6-debian-10-r146
  kubeVersion: ""
  master:
    affinity: {}
    args: []
    command: []
    configuration: ""
    containerPorts:
      redis: 6379
    containerSecurityContext:
      enabled: true
      runAsUser: 1001
    customLivenessProbe: {}
    customReadinessProbe: {}
    customStartupProbe: {}
    disableCommands:
    - FLUSHDB
    - FLUSHALL
    extraEnvVars: []
    extraEnvVarsCM: ""
    extraEnvVarsSecret: ""
    extraFlags: []
    extraVolumeMounts: []
    extraVolumes: []
    hostAliases: []
    initContainers: []
    kind: StatefulSet
    lifecycleHooks: {}
    livenessProbe:
      enabled: true
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 5
    nodeAffinityPreset:
      key: ""
      type: ""
      values: []
    nodeSelector: {}
    persistence:
      accessModes:
      - ReadWriteOnce
      annotations: {}
      dataSource: {}
      enabled: true
      existingClaim: ""
      medium: ""
      path: /data
      selector: {}
      size: 8Gi
      storageClass: ""
      subPath: ""
    podAffinityPreset: ""
    podAnnotations: {}
    podAntiAffinityPreset: soft
    podLabels: {}
    podSecurityContext:
      enabled: true
      fsGroup: 1001
    preExecCmds: []
    priorityClassName: ""
    readinessProbe:
      enabled: true
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 1
    resources:
      limits: {}
      requests: {}
    schedulerName: ""
    service:
      annotations: {}
      clusterIP: ""
      externalTrafficPolicy: Cluster
      extraPorts: []
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      nodePorts:
        redis: ""
      ports:
        redis: 6379
      type: ClusterIP
    shareProcessNamespace: false
    sidecars: []
    startupProbe:
      enabled: false
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 5
    terminationGracePeriodSeconds: 30
    tolerations: []
    topologySpreadConstraints: {}
    updateStrategy:
      rollingUpdate: {}
      type: RollingUpdate
  metrics:
    command: []
    containerSecurityContext:
      enabled: true
      runAsUser: 1001
    enabled: false
    extraArgs: {}
    extraVolumeMounts: []
    extraVolumes: []
    image:
      pullPolicy: IfNotPresent
      pullSecrets: []
      registry: docker.io
      repository: bitnami/redis-exporter
      tag: 1.35.1-debian-10-r16
    podAnnotations:
      prometheus.io/port: "9121"
      prometheus.io/scrape: "true"
    podLabels: {}
    prometheusRule:
      additionalLabels: {}
      enabled: false
      namespace: ""
      rules: []
    redisTargetHost: localhost
    resources:
      limits: {}
      requests: {}
    service:
      annotations: {}
      externalTrafficPolicy: Cluster
      extraPorts: []
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      port: 9121
      type: ClusterIP
    serviceMonitor:
      additionalLabels: {}
      enabled: false
      honorLabels: false
      interval: 30s
      metricRelabelings: []
      namespace: ""
      relabellings: []
      scrapeTimeout: ""
  nameOverride: ""
  networkPolicy:
    allowExternal: true
    enabled: false
    extraEgress: []
    extraIngress: []
    ingressNSMatchLabels: {}
    ingressNSPodMatchLabels: {}
  pdb:
    create: false
    maxUnavailable: ""
    minAvailable: 1
  podSecurityPolicy:
    create: false
    enabled: false
  rbac:
    create: false
    rules: []
  replica:
    affinity: {}
    args: []
    autoscaling:
      enabled: false
      maxReplicas: 11
      minReplicas: 1
      targetCPU: ""
      targetMemory: ""
    command: []
    configuration: ""
    containerPorts:
      redis: 6379
    containerSecurityContext:
      enabled: true
      runAsUser: 1001
    customLivenessProbe: {}
    customReadinessProbe: {}
    customStartupProbe: {}
    disableCommands:
    - FLUSHDB
    - FLUSHALL
    externalMaster:
      enabled: false
      host: ""
      port: 6379
    extraEnvVars: []
    extraEnvVarsCM: ""
    extraEnvVarsSecret: ""
    extraFlags: []
    extraVolumeMounts: []
    extraVolumes: []
    hostAliases: []
    initContainers: []
    lifecycleHooks: {}
    livenessProbe:
      enabled: true
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 5
    nodeAffinityPreset:
      key: ""
      type: ""
      values: []
    nodeSelector: {}
    persistence:
      accessModes:
      - ReadWriteOnce
      annotations: {}
      dataSource: {}
      enabled: true
      medium: ""
      path: /data
      selector: {}
      size: 8Gi
      storageClass: ""
      subPath: ""
    podAffinityPreset: ""
    podAnnotations: {}
    podAntiAffinityPreset: soft
    podLabels: {}
    podManagementPolicy: ""
    podSecurityContext:
      enabled: true
      fsGroup: 1001
    preExecCmds: []
    priorityClassName: ""
    readinessProbe:
      enabled: true
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 1
    replicaCount: 1
    resources:
      limits: {}
      requests: {}
    schedulerName: ""
    service:
      annotations: {}
      clusterIP: ""
      externalTrafficPolicy: Cluster
      extraPorts: []
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      nodePorts:
        redis: ""
      ports:
        redis: 6379
      type: ClusterIP
    shareProcessNamespace: false
    sidecars: []
    startupProbe:
      enabled: false
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 5
    terminationGracePeriodSeconds: 30
    tolerations: []
    topologySpreadConstraints: {}
    updateStrategy:
      rollingUpdate: {}
      type: RollingUpdate
  sentinel:
    args: []
    automateClusterRecovery: false
    command: []
    configuration: ""
    containerPorts:
      sentinel: 26379
    containerSecurityContext:
      enabled: true
      runAsUser: 1001
    customLivenessProbe: {}
    customReadinessProbe: {}
    customStartupProbe: {}
    downAfterMilliseconds: 60000
    enabled: false
    externalMaster:
      enabled: false
      host: ""
      port: 6379
    extraEnvVars: []
    extraEnvVarsCM: ""
    extraEnvVarsSecret: ""
    extraVolumeMounts: []
    extraVolumes: []
    failoverTimeout: 18000
    image:
      debug: false
      pullPolicy: IfNotPresent
      pullSecrets: []
      registry: docker.io
      repository: bitnami/redis-sentinel
      tag: 6.2.6-debian-10-r144
    lifecycleHooks: {}
    livenessProbe:
      enabled: true
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 5
    masterSet: mymaster
    parallelSyncs: 1
    persistence:
      accessModes:
      - ReadWriteOnce
      annotations: {}
      dataSource: {}
      enabled: false
      selector: {}
      size: 100Mi
      storageClass: ""
    preExecCmds: []
    quorum: 2
    readinessProbe:
      enabled: true
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 1
    resources:
      limits: {}
      requests: {}
    service:
      annotations: {}
      clusterIP: ""
      externalTrafficPolicy: Cluster
      extraPorts: []
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      nodePorts:
        redis: ""
        sentinel: ""
      ports:
        redis: 6379
        sentinel: 26379
      type: ClusterIP
    startupProbe:
      enabled: false
      failureThreshold: 5
      initialDelaySeconds: 20
      periodSeconds: 5
      successThreshold: 1
      timeoutSeconds: 5
    terminationGracePeriodSeconds: 30
  serviceAccount:
    annotations: {}
    automountServiceAccountToken: true
    create: true
    name: ""
  sysctl:
    command: []
    enabled: false
    image:
      pullPolicy: IfNotPresent
      pullSecrets: []
      registry: docker.io
      repository: bitnami/bitnami-shell
      tag: 10-debian-10-r355
    mountHostSys: false
    resources:
      limits: {}
      requests: {}
  tls:
    authClients: true
    autoGenerated: false
    certCAFilename: ""
    certFilename: ""
    certKeyFilename: ""
    certificatesSecret: ""
    dhParamsFilename: ""
    enabled: false
    existingSecret: ""
  useExternalDNS:
    additionalAnnotations: {}
    annotationKey: external-dns.alpha.kubernetes.io/
    enabled: false
    suffix: ""
  volumePermissions:
    containerSecurityContext:
      runAsUser: 0
    enabled: false
    image:
      pullPolicy: IfNotPresent
      pullSecrets: []
      registry: docker.io
      repository: bitnami/bitnami-shell
      tag: 10-debian-10-r355
    resources:
      limits: {}
      requests: {}
replicaCount: 3
resources: {}
securityContext: {}
seq:
  acceptEULA: "Y"
  affinity: {}
  cache:
    targetSize: 0.6
  enabled: true
  gelf:
    enabled: false
    image:
      pullPolicy: IfNotPresent
      repository: datalust/seq-input-gelf
    service:
      port: 12201
      protocol: TCP
  global: {}
  image:
    pullPolicy: IfNotPresent
    repository: datalust/seq
  imagePullSecrets: []
  ingestion:
    ingress:
      enabled: false
      hosts: []
      path: /
    service:
      port: 5341
  ingress:
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
    labels: {}
    tls:
    - hosts:
      - seq.myserver.example.com
      secretName: theidserver-seq
  livenessProbe:
    enabled: true
    failureThreshold: 3
    initialDelaySeconds: 0
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 1
  nodeSelector: {}
  persistence:
    accessMode: ReadWriteOnce
    enabled: true
    path: /data
    size: 8Gi
    subPath: ""
  rbac:
    create: false
    rules: []
  readinessProbe:
    enabled: true
    failureThreshold: 3
    initialDelaySeconds: 0
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 1
  resources: {}
  service:
    type: ClusterIP
  serviceAccount:
    create: false
  startupProbe:
    enabled: true
    failureThreshold: 30
    periodSeconds: 10
  syslog:
    enabled: false
    image:
      pullPolicy: IfNotPresent
      repository: datalust/seq-input-syslog
    service:
      port: 514
      protocol: UDP
  tolerations: []
  ui:
    ingress:
      enabled: true
      hosts:
      - seq.myserver.example.com
      path: /
    service:
      port: 80
service:
  ports:
    https: 443
  type: ClusterIP
serviceAccount:
  annotations: {}
  create: true
  name: ""
signingKey:
  cn: null
  create: false
  crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFakNDQWZxZ0F3SUJBZ0lRTk5lQWc1NHR5dmRQaDRSbjU0VmxmREFOQmdrcWhraUc5dzBCQVFzRkFEQXoKTVJjd0ZRWURWUVFLRXc1QlozVmhJR1p5YjIwZ1RXRnljekVZTUJZR0ExVUVBeE1QWVdkMVlXWnZiVzF0WVhKegpJRU5CTUNBWERUSXpNVEF6TURFM05EVXdNbG9ZRHpJeE1qTXhNREEyTVRjME5UQXlXakF6TVJjd0ZRWURWUVFLCkV3NUJaM1ZoSUdaeWIyMGdUV0Z5Y3pFWU1CWUdBMVVFQXhNUFlXZDFZV1p2YlcxdFlYSnpJRU5CTUlJQklqQU4KQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBcmovUXVEWG5oekJ2enYwMlEzMjlEalFDY1M0RgpVL2x1SUozdld3VWxEM3ljRUVxV3Q2RktncHg2WFNBQlB6T1AxTWNFZFFHZmdtMm1yTzk1RWlSa0lFZFdWS2lZCkRHS0tIRTM4UGZwbVdVVzRVUURmSUFxWFFOUHdxbno2a1ovL21ldC9mRENFeENyNFdlc2d1S1c2VGZ2TDZRMCsKb2xiMXFTa25EZFpmRXB0Vmlnd1pOUGdueTFqdWoxUGd2dHExTytVeTUwN3BqWnNBMUJWWmdUUDhHWWRvNnpnVQpHUWkyNHc0bUx3c0xpNlFuaGVxQWx0U2Y4RmZPMkpiRWpwRDRpWWo4dFhrcnpoWS9SZHIrdG5pZjFNbWRpcFpoCkd5QTl4YW91RVhKK1JRTitZU2w4SnRWaWlsbWRJQkdFYWltMEZzeER0TmtqenVydUN1V0NMaWVMSVFJREFRQUIKb3lBd0hqQU9CZ05WSFE4QkFmOEVCQU1DQkxBd0RBWURWUjBUQVFIL0JBSXdBREFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQVFFQUl4Mk1JMHRVVlIzbmwraFM3bTdESkZJZktRT2VGWUNLcVp3bDFnMmtXVVd4NnFueFJPREFaRTIyCkF3TVJ5NnZsY01Eck1RdmpmSlBQb0V3OVRMSktxVUFDQ3JDbWxxQXhzLzB1UFZiLzZ3QkFLaEpmSDNLTVRDUEwKVDZ1SStqb3ZzQzZJMXE0cjhqTUptNEFjQ2V3emw2NlRXRHZtS2VreDVmM28yK3BDNFZGTElHeWdENUlqaFZETwpaQmd1Q3ZvVjRJRmdhdDhFOVNEL21nbXZya2NycW1Xd0hMYmVwYW9CaWJIL3ozbWhsbVFUTENxekR1c3lHc3BsCmE3cEprQlZ0M2N0Q2ZkRHZsZ2hsMEtZUkpsVmdlRitHdUEvaDdXK3dCaFlqVUdxSXRrRG1adG9tMGZMZTJqbEoKMUtVcHB2enFxWjR5VDZ4TkozMXJKUFFZQktjeVRBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  ipList: []
  key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBcmovUXVEWG5oekJ2enYwMlEzMjlEalFDY1M0RlUvbHVJSjN2V3dVbEQzeWNFRXFXCnQ2RktncHg2WFNBQlB6T1AxTWNFZFFHZmdtMm1yTzk1RWlSa0lFZFdWS2lZREdLS0hFMzhQZnBtV1VXNFVRRGYKSUFxWFFOUHdxbno2a1ovL21ldC9mRENFeENyNFdlc2d1S1c2VGZ2TDZRMCtvbGIxcVNrbkRkWmZFcHRWaWd3WgpOUGdueTFqdWoxUGd2dHExTytVeTUwN3BqWnNBMUJWWmdUUDhHWWRvNnpnVUdRaTI0dzRtTHdzTGk2UW5oZXFBCmx0U2Y4RmZPMkpiRWpwRDRpWWo4dFhrcnpoWS9SZHIrdG5pZjFNbWRpcFpoR3lBOXhhb3VFWEorUlFOK1lTbDgKSnRWaWlsbWRJQkdFYWltMEZzeER0TmtqenVydUN1V0NMaWVMSVFJREFRQUJBb0lCQUF1a2tmS3REMkpXRnpKeQpjdHpCbXc5RzVGN2huMU9FR0JxdjB0MTNFNG5jWHFVc0JyUVFYK1VvUlhqUmVhUGFjeUxaaFcrNEF3dDQvaWtSCit6bitHbjZacGFnVWQ4eGtEU3hrL1pTNmxYb2prWFJBSmFpRGJLWFZRNEJ3eDJGUm1vZVRWN3BabDVWdjlaWTAKZ3NRenRxWWRTL3V2ZWQ3cEJwTWQvOUVKNE9KaVNHa1Q1eW85am9yclEyY0dDQ2k3MDI1KzBaMU5TNFhzL3Q0dAprUTNrdytSYTREdjNHQXZXcFJrUWJvV1N4eFF5WnFacmxPdThRWkUwU1AxQWR1VUFYL0x4MDRkaEhMd1FvbkQ5CkVJZ0tRbnkyM21HQ2hLOUpsMWtPVTByYWViUjJtZlNIR3ppQkFqYlp4WTZSTTg3THNuTVJIa3c0QjhLamZiTmYKdm04Q01KRUNnWUVBMzFoRTk5QjNIdjlLb3VZU3F1bE5PYXBSY200cUNxMDM0cWZ5MzhBUTh3Ny8wYmlrT1V2LwozTjdIUlZRcWdjNis0SCt5Qm4xRUdCKzF5bHc4eXR4YXpMclRVeTdWYmFIblF2eXZSSC96dTNTRzFySkN1ckhCCjJIcTBXRXE5QVUzcmQ0WEhhNnN2NjZKdjNVWmlOMEhaM0NuUmNKYXpJenJMS0o0UTRIWS9QRTBDZ1lFQXg3bnEKTVZnUmNmK3dKNkhyOXJYUEx0bHBMNW1uVHBVUExoOC9kV2JFVjE4aTFBR1JkUVpKS1lwYTVXb2xxTGsrTkkrbQpBenIrYTFGUVZoL0lERzlSRU9XVXVKaklrUWZNbi9DU3RIcEpsUHpiUzZWYTFGQ1FzWHpucXN3SzNlV1luYnloCkNwbnFhQUd4OURZZ0crQUdXQWIyTDFsb2x5SjJLQTV5NVgwdEpDVUNnWUVBeDdYOFpjUEk0TFRUSG5xd2NwZVAKY0dMMTFXYmd2UTlMQzZlMks1RnBGbzV3L2kwbTIvMHpXMkx4dVBLYjE5cnhIM25QekxHeWRBZlczSTVCNWZ2SQpUWTA1YmdaUTNtbUppNEs3am5zRGpMbVQ0T01oZkNONi9JSXNSVTcvVnUxQUFtNWpkY2xyWGo2djNLTVZLK2Y4ClVUd3JoWXVidjRMUkt3NjhkSm9IelhrQ2dZQUM5K0poSlZ2dEE4M01hUDJteHdEelEwdnE1eSt6WFVmQ2ViaHAKdUVOR3dTVTFYV2lhQXFQbnVDU3RzQ3dyRzhXdTVrdWpWS2NmVlRBS2Q2SnpmTndKa2ovcGxtdTByQmNBY1lUYwpwY3llS0R2aUhlMEJwc2pmdW1sL0FsVlBBdkNIdDV2MUdtQi9kemI3MkNvVi8vaFlLcEpTRmRRV0d1OENuV1JiCndNYUErUUtCZ1FETm9HYi9GMWRYTEVWbnhOM2pXemh5d3dMVW95em00YUVyRWlsK1lpaXQ1dWVpdW40TWdNSjMKbER2UmpSVHlWV3YveWc3U2liTFVMYlRhRFFoamRWTGtzVEVEaytvODNPOU8zVHNwR3FwbjhlT2FYT2RPczhpcwpsSDF3U00wNmtpRjRCNGdXaEN1MWZFSHB2QnZqOVkxakp6N1lYelQ2ZHJMZzRBZWsvZnpJdGc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
  sanList: []
ssl:
  ca:
    create: false
    crt: null
    issuer: null
    key: null
    trust: false
    validationPeriod: 3650
  cn: null
  create: false
  crt: null
  ipList: []
  issuer:
    duration: 2160h
    enabled: true
    kind: ClusterIssuer
    ref: letsencrypt-prod
    renewBefore: 360h
  key: null
  sanList: null
  validationPeriod: 365
tolerations: []
volumes: []

HOOKS:
---
# Source: theidserver/templates/tests/test-connection.yaml
apiVersion: v1
kind: Pod
metadata:
  name: "theidserver-test-connection"
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test-success
spec:
  containers:
    - name: wget
      image: busybox
      command: ['wget']
      args: ['theidserver:']
  restartPolicy: Never
MANIFEST:
---
# Source: theidserver/charts/mysql/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: theidserver-mysql
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
  annotations:
secrets:
  - name: theidserver-mysql
---
# Source: theidserver/charts/redis/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: theidserver-redis
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
---
# Source: theidserver/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: theidserver
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
---
# Source: theidserver/charts/mysql/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: theidserver-mysql
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  mysql-root-password: "blJZZkhiN2RZc2NmakFmVA=="
  mysql-password: "cDVPb0c5ZktZRG5VcXl0MQ=="
  mysql-replication-password: "JGVNVFpifXY9UGp3JSR7eg=="
---
# Source: theidserver/charts/redis/templates/secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: theidserver-redis
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  redis-password: "WShjJnZ5aisxTjZKI1VnOA=="
---
# Source: theidserver/templates/cert-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: theidserver-certs
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  dataProtection.crt: LS0tLS1CRUdJTi...
  dataProtection.key: LS0tLS1CRUdJT..
  signingKey.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FU....
  signingKey.key: LS0tLS1CRUdJTiBS...
---
# Source: theidserver/templates/secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: theidserver-opaque
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
data:
  ConnectionString: c2VydmVyPXRoZ....
  ssl.pwd: ZDZjZWY3YmYtYWZjZC00ZWYwLTg3YTUtNTQ1NmY0NjljNzcy
  dataProtection.pwd: NDVmZDg1N2EtNjRjOC00Yjk1LWE4YTUtY2U5ODQwODQ5ZjI0
  signingKey.pwd: OTM2NmY3NzUtZjk0ZC00ZTE1LTllZjQtZTRkMmU2NTViYTVi
type: Opaque
---
# Source: theidserver/charts/mysql/templates/primary/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: theidserver-mysql-primary
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: primary
data:
  my.cnf: |-

    [mysqld]
    default_authentication_plugin=mysql_native_password
    skip-name-resolve
    explicit_defaults_for_timestamp
    basedir=/opt/bitnami/mysql
    plugin_dir=/opt/bitnami/mysql/lib/plugin
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    datadir=/bitnami/mysql/data
    tmpdir=/opt/bitnami/mysql/tmp
    max_allowed_packet=16M
    bind-address=0.0.0.0
    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
    log-error=/opt/bitnami/mysql/logs/mysqld.log
    character-set-server=UTF8
    collation-server=utf8_general_ci

    [client]
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    default-character-set=UTF8
    plugin_dir=/opt/bitnami/mysql/lib/plugin

    [manager]
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
---
# Source: theidserver/charts/mysql/templates/secondary/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: theidserver-mysql-secondary
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: secondary
data:
  my.cnf: |-

    [mysqld]
    default_authentication_plugin=mysql_native_password
    skip-name-resolve
    explicit_defaults_for_timestamp
    basedir=/opt/bitnami/mysql
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    datadir=/bitnami/mysql/data
    tmpdir=/opt/bitnami/mysql/tmp
    max_allowed_packet=16M
    bind-address=0.0.0.0
    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
    log-error=/opt/bitnami/mysql/logs/mysqld.log
    character-set-server=UTF8
    collation-server=utf8_general_ci

    [client]
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    default-character-set=UTF8

    [manager]
    port=3306
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
---
# Source: theidserver/charts/redis/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: theidserver-redis-configuration
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
data:
  redis.conf: |-
    # User-supplied common configuration:
    # Enable AOF https://redis.io/topics/persistence#append-only-file
    appendonly yes
    # Disable RDB persistence, AOF persistence already enabled.
    save ""
    # End of common configuration
  master.conf: |-
    dir /data
    # User-supplied master configuration:
    rename-command FLUSHDB ""
    rename-command FLUSHALL ""
    # End of master configuration
  replica.conf: |-
    dir /data
    slave-read-only yes
    # User-supplied replica configuration:
    rename-command FLUSHDB ""
    rename-command FLUSHALL ""
    # End of replica configuration
---
# Source: theidserver/charts/redis/templates/health-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: theidserver-redis-health
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
data:
  ping_readiness_local.sh: |-
    #!/bin/bash

    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
    response=$(
      timeout -s 3 $1 \
      redis-cli \
        -h localhost \
        -p $REDIS_PORT \
        ping
    )
    if [ "$?" -eq "124" ]; then
      echo "Timed out"
      exit 1
    fi
    if [ "$response" != "PONG" ]; then
      echo "$response"
      exit 1
    fi
  ping_liveness_local.sh: |-
    #!/bin/bash

    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
    response=$(
      timeout -s 3 $1 \
      redis-cli \
        -h localhost \
        -p $REDIS_PORT \
        ping
    )
    if [ "$?" -eq "124" ]; then
      echo "Timed out"
      exit 1
    fi
    responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
    if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
      echo "$response"
      exit 1
    fi
  ping_readiness_master.sh: |-
    #!/bin/bash

    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
    response=$(
      timeout -s 3 $1 \
      redis-cli \
        -h $REDIS_MASTER_HOST \
        -p $REDIS_MASTER_PORT_NUMBER \
        ping
    )
    if [ "$?" -eq "124" ]; then
      echo "Timed out"
      exit 1
    fi
    if [ "$response" != "PONG" ]; then
      echo "$response"
      exit 1
    fi
  ping_liveness_master.sh: |-
    #!/bin/bash

    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
    response=$(
      timeout -s 3 $1 \
      redis-cli \
        -h $REDIS_MASTER_HOST \
        -p $REDIS_MASTER_PORT_NUMBER \
        ping
    )
    if [ "$?" -eq "124" ]; then
      echo "Timed out"
      exit 1
    fi
    responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
    if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
      echo "$response"
      exit 1
    fi
  ping_readiness_local_and_master.sh: |-
    script_dir="$(dirname "$0")"
    exit_status=0
    "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
    "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
    exit $exit_status
  ping_liveness_local_and_master.sh: |-
    script_dir="$(dirname "$0")"
    exit_status=0
    "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
    "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
    exit $exit_status
---
# Source: theidserver/charts/redis/templates/scripts-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: theidserver-redis-scripts
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
data:
  start-master.sh: |
    #!/bin/bash

    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
    if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then
        cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf
    fi
    if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then
        cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
    fi
    ARGS=("--port" "${REDIS_PORT}")
    ARGS+=("--requirepass" "${REDIS_PASSWORD}")
    ARGS+=("--masterauth" "${REDIS_PASSWORD}")
    ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
    ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf")
    exec redis-server "${ARGS[@]}"
  start-replica.sh: |
    #!/bin/bash

    get_port() {
        hostname="$1"
        type="$2"

        port_var=$(echo "${hostname^^}_SERVICE_PORT_$type" | sed "s/-/_/g")
        port=${!port_var}

        if [ -z "$port" ]; then
            case $type in
                "SENTINEL")
                    echo 26379
                    ;;
                "REDIS")
                    echo 6379
                    ;;
            esac
        else
            echo $port
        fi
    }

    get_full_hostname() {
        hostname="$1"
        echo "${hostname}.${HEADLESS_SERVICE}"
    }

    REDISPORT=$(get_port "$HOSTNAME" "REDIS")

    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
    if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then
        cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf
    fi
    if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then
        cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
    fi

    echo "" >> /opt/bitnami/redis/etc/replica.conf
    echo "replica-announce-port $REDISPORT" >> /opt/bitnami/redis/etc/replica.conf
    echo "replica-announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis/etc/replica.conf
    ARGS=("--port" "${REDIS_PORT}")
    ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}")
    ARGS+=("--requirepass" "${REDIS_PASSWORD}")
    ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}")
    ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
    ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf")
    exec redis-server "${ARGS[@]}"
---
# Source: theidserver/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: theidserver-config
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
data:
  SignalR__RedisConnectionString: "
theidserver-redis-headless:6379,password=Y(c&vyj+1N6J#Ug8"
  RedisConfigurationOptions__ConnectionString: "
theidserver-redis-headless:6379,password=Y(c&vyj+1N6J#Ug8"
  Serilog__WriteTo__0__Args__serverUrl: "http://theidserver-seq:5341"
  InitialData__Users__0__Password: "@s4foqGjoa9k4xMC"
  ASPNETCORE_URLS: "https://+:443"
  ASPNETCORE_HTTPS_PORT: "443"
  ASPNETCORE_Kestrel__Certificates__Default__Path: "/usr/local/share/ca-certificates/ssl.pfx"
---
# Source: theidserver/templates/files-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: theidserver-config-files
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
data:
  admin-appsettings.json: "{\"administratorEmail\":\"aguacongas@gmail.com\",\"apiBaseUrl\":\"https://www.myserver.example.com/api\",\"authenticationPaths\":{\"remoteProfilePath\":\"/identity/account/manage\",\"remoteRegisterPath\":\"/identity/account/register\"},\"loggingOptions\":{\"minimum\":\"Warning\"},\"menuOptions\":{\"showSettings\":true},\"prerendered\":true,\"providerOptions\":{\"authority\":\"https://www.myserver.example.com\",\"clientId\":\"theidserveradmin\",\"defaultScopes\":[\"theidserveradminapi\"],\"postLogoutRedirectUri\":\"https://www.myserver.example.com/authentication/logout-callback\",\"redirectUri\":\"https://www.myserver.example.com/authentication/login-callback\",\"responseType\":\"code\"},\"settingsOptions\":{\"apiUrl\":\"https://www.myserver.example.com/api/api/configuration\",\"typeName\":\"Aguacongas.TheIdServer.BlazorApp.Models.ServerConfig, Aguacongas.TheIdServer.BlazorApp.Infrastructure\"},\"userOptions\":{\"roleClaim\":\"role\"},\"welcomeContenUrl\":\"https://www.myserver.example.com/api/welcomefragment\"}"
  appsettings.json: "{\"AccountOptions\":{\"AutomaticRedirectAfterSignOut\":true,\"ShowLogoutPrompt\":false},\"ApiAuthentication\":{\"ApiName\":\"theidserveradminapi\",\"ApiSecret\":\"e14E5]V\\u0026@XeX%[Rh\",\"Authority\":\"https://www.myserver.example.com\",\"CacheDuration\":\"0:10:0\",\"EnableCaching\":true,\"LegacyAudienceValidation\":true,\"RequireHttpsMetadata\":false,\"SupportedTokens\":\"Both\"},\"AuthenticatorIssuer\":\"TheIdServer\",\"BackchannelAuthenticationUserNotificationServiceOptions\":{\"ApiUrl\":\"https://www.myserver.example.com/api/email\",\"Authority\":\"https://www.myserver.example.com\",\"ClientId\":\"public-server\",\"ClientSecret\":\"@%}51pk:Ze+157}4\",\"HttpClientName\":\"ciba\",\"Scope\":\"theidserveradminapi\"},\"DataProtectionOptions\":{\"KeyProtectionOptions\":{\"KeyProtectionKind\":\"X509\",\"X509CertificatePath\":\"/usr/local/share/ca-certificates/dp.pfx\"},\"StorageKind\":\"EntityFramework\"},\"DbType\":\"MySql\",\"DynamicClientRegistrationOptions\":{\"AllowedContacts\":{\"AllowedHosts\":[\"www.certification.openid.net\"],\"Contact\":\"certification@oidf.org\"}},\"DynamicConfigurationOptions\":{\"ProviderType\":\"Aguacongas.DynamicConfiguration.Redis.RedisConfigurationProvider, Aguacongas.DynamicConfiguration.Redis\"},\"EmailApiAuthentication\":{\"ApiUrl\":\"https://www.myserver.example.com/api/email\",\"Authority\":\"https://www.myserver.example.com\",\"ClientId\":\"public-server\",\"ClientSecret\":\"@%}51pk:Ze+157}4\",\"HttpClientName\":\"email\",\"Scope\":\"theidserveradminapi\"},\"EnableOpenApiDoc\":true,\"IdentityOptions\":{\"SignInOptions\":{\"RequireConfirmedAccount\":false},\"UserOptions\":{\"AllowedUserNameCharacters\":\"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+ \"}},\"IdentityServer\":{\"Key\":{\"KeyProtectionOptions\":{\"KeyProtectionKind\":\"X509\",\"X509CertificatePath\":\"/usr/local/share/ca-certificates/sk.pfx\"},\"StorageKind\":\"EntityFramework\",\"Type\":\"KeysRotation\"}},\"IdentityServerOptions\":{\"Endpoints\":{\"EnableJwtRequestUri\":true}},\"InitialData\":{\"ApiScopes\":[{\"DisplayName\":\"TheIdServer admin API scope\",\"Name\":\"theidserveradminapi\",\"UserClaims\":[\"name\",\"role\"]},{\"DisplayName\":\"TheIdServer token API scope\",\"Name\":\"theidservertokenapi\",\"UserClaims\":[\"name\",\"role\"]}],\"Apis\":[{\"ApiSecrets\":[{\"Type\":\"SharedSecret\",\"Value\":\"e14E5]V\\u0026@XeX%[Rh\"}],\"DisplayName\":\"TheIdServer admin API\",\"Name\":\"theidserveradminapi\",\"Scopes\":[\"theidserveradminapi\",\"theidservertokenapi\"],\"UserClaims\":[\"name\",\"role\"]}],\"Clients\":[{\"AccessTokenType\":\"Reference\",\"AllowedCorsOrigins\":[\"https://www.myserver.example.com\"],\"AllowedGrantTypes\":[\"authorization_code\"],\"AllowedScopes\":[\"openid\",\"profile\",\"theidserveradminapi\"],\"BackChannelLogoutSessionRequired\":false,\"ClientClaimsPrefix\":null,\"ClientId\":\"theidserveradmin\",\"ClientName\":\"TheIdServer admin SPA Client\",\"ClientUri\":\"https://www.myserver.example.com\",\"FrontChannelLogoutSessionRequired\":false,\"PostLogoutRedirectUris\":[\"https://www.myserver.example.com/authentication/logout-callback\"],\"RedirectUris\":[\"https://www.myserver.example.com/authentication/login-callback\"],\"RequireClientSecret\":false,\"RequirePkce\":true},{\"AccessTokenType\":\"Reference\",\"AllowedGrantTypes\":[\"client_credentials\"],\"AllowedScopes\":[\"openid\",\"profile\",\"theidserveradminapi\"],\"BackChannelLogoutSessionRequired\":false,\"Claims\":[{\"Type\":\"role\",\"Value\":\"Is4-Writer\"},{\"Type\":\"role\",\"Value\":\"Is4-Reader\"}],\"ClientClaimsPrefix\":null,\"ClientId\":\"public-server\",\"ClientName\":\"Public server Credentials Client\",\"ClientSecrets\":[{\"Type\":\"SharedSecret\",\"Value\":\"@%}51pk:Ze+157}4\"}],\"FrontChannelLogoutSessionRequired\":false},{\"AllowAccessTokensViaBrowser\":true,\"AllowedCorsOrigins\":[\"https://www.myserver.example.com\"],\"AllowedGrantTypes\":[\"implicit\"],\"BackChannelLogoutSessionRequired\":false,\"ClientClaimsPrefix\":null,\"ClientId\":\"theidserver-swagger\",\"ClientName\":\"TheIdServer Swagger UI\",\"FrontChannelLogoutSessionRequired\":false,\"RedirectUris\":[\"https://www.myserver.example.com/authentication/login-callback\"],\"RequireClientSecret\":false}],\"Users\":[{\"Claims\":[{\"ClaimType\":\"name\",\"ClaimValue\":\"TheIdServer Admin\"},{\"ClaimType\":\"given_name\",\"ClaimValue\":\"Admin\"},{\"ClaimType\":\"nickname\",\"ClaimValue\":\"Admin\"}],\"Email\":\"admin@myserver.example.com\",\"EmailConfirmed\":true,\"Roles\":[\"Is4-Writer\",\"Is4-Reader\"],\"UserName\":\"admin@myserver.example.com\"}]},\"Migrate\":true,\"RedisConfigurationOptions\":{\"Channel\":\"Aguacongas.TheIdServer.Duende.Channel\",\"HashKey\":\"Aguacongas.TheIdServer.Duende\"},\"Seed\":true,\"Serilog\":{\"Enrich\":[\"FromLogContext\",\"WithMachineName\",\"WithThreadId\"],\"LevelSwitches\":{\"$controlSwitch\":\"Information\"},\"MinimumLevel\":{\"ControlledBy\":\"$controlSwitch\"},\"WriteTo\":[{\"Args\":{\"apiKey\":\"DVYuookX2vOq078fuOyJ\",\"controlLevelSwitch\":\"$controlSwitch\",\"serverUrl\":\"http://localhost:5341\"},\"Name\":\"Seq\"},{\"Args\":{\"outputTemplate\":\"[{Timestamp:HH:mm:ss} {Level}] {SourceContext}{NewLine}{Message:lj}{NewLine}{Exception}{NewLine}\",\"theme\":\"Serilog.Sinks.SystemConsole.Themes.AnsiConsoleTheme::Literate, Serilog.Sinks.Console\"},\"Name\":\"Console\"},{\"Args\":{\"outputTemplate\":\"[{Timestamp:HH:mm:ss} {Level}] {SourceContext}{NewLine}{Message:lj}{NewLine}{Exception}{NewLine}\"},\"Name\":\"Debug\"}]},\"SignalR\":{\"HubOptions\":{\"EnableDetailedErrors\":true},\"RedisOptions\":{\"Configuration\":{\"ChannelPrefix\":\"TheIdServer\"}},\"UseMessagePack\":true},\"SiteOptions\":{\"Name\":\"TheIdServer\"},\"SwaggerUiSettings\":{\"OAuth2Client\":{\"AppName\":\"TheIdServer Swagger UI\",\"ClientId\":\"theidserver-swagger\",\"UsePkceWithAuthorizationCodeGrant\":true},\"WithCredentials\":true},\"TokenCleanupInterval\":\"00:05:00\"}"
---
# Source: theidserver/charts/seq/templates/pvc.yaml
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: theidserver-seq
  labels:
    app: theidserver-seq
    chart: "seq-2021.4.7192"
    release: "theidserver"
    heritage: "Helm"
spec:
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "8Gi"
---
# Source: theidserver/charts/mysql/templates/primary/svc-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver-mysql-primary-headless
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: primary
  annotations:
spec:
  type: ClusterIP
  clusterIP: None
  publishNotReadyAddresses: true
  ports:
    - name: mysql
      port: 3306
      targetPort: mysql
  selector:
    app.kubernetes.io/name: mysql
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/component: primary
---
# Source: theidserver/charts/mysql/templates/primary/svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver-mysql-primary
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: primary
  annotations:
spec:
  type: ClusterIP
  ports:
    - name: mysql
      port: 3306
      protocol: TCP
      targetPort: mysql
      nodePort: null
  selector:
    app.kubernetes.io/name: mysql
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/component: primary
---
# Source: theidserver/charts/mysql/templates/secondary/svc-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver-mysql-secondary-headless
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: secondary
  annotations:
spec:
  type: ClusterIP
  clusterIP: None
  publishNotReadyAddresses: true
  ports:
    - name: mysql
      port: 3306
      targetPort: mysql
  selector:
    app.kubernetes.io/name: mysql
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/component: secondary
---
# Source: theidserver/charts/mysql/templates/secondary/svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver-mysql-secondary
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: secondary
  annotations:
spec:
  type: ClusterIP
  ports:
    - name: mysql
      port: 3306
      protocol: TCP
      targetPort: mysql
      nodePort: null
  selector:
    app.kubernetes.io/name: mysql
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/component: secondary
---
# Source: theidserver/charts/redis/templates/headless-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver-redis-headless
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
  annotations:

spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis
  selector:
    app.kubernetes.io/name: redis
    app.kubernetes.io/instance: theidserver
---
# Source: theidserver/charts/redis/templates/master/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver-redis-master
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: master
spec:
  type: ClusterIP

  ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis
      nodePort: null
  selector:
    app.kubernetes.io/name: redis
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/component: master
---
# Source: theidserver/charts/redis/templates/replicas/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver-redis-replicas
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: replica
spec:
  type: ClusterIP
  ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis
      nodePort: null
  selector:
    app.kubernetes.io/name: redis
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/component: replica
---
# Source: theidserver/charts/seq/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver-seq
  labels:
    app: seq
    chart: seq-2021.4.7192
    release: theidserver
    heritage: Helm
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: ui
      protocol: TCP
      name: ui
    - port: 5341
      targetPort: ingestion
      protocol: TCP
      name: ingestion
  selector:
    app: seq
    release: theidserver
---
# Source: theidserver/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: theidserver
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 443
      targetPort: https
      protocol: TCP
      name: https
  selector:
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
---
# Source: theidserver/charts/seq/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: theidserver-seq
  labels:
    app: seq
    chart: seq-2021.4.7192
    release: theidserver
    heritage: Helm
spec:
  selector:
    matchLabels:
      app: seq
      release: theidserver
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: seq
        release: theidserver
    spec:
      containers:
        - name: seq
          image: "datalust/seq:2021.4.7192"
          imagePullPolicy: IfNotPresent
          env:
            - name: "ACCEPT_EULA"
              value: "Y"
            - name: "SEQ_CACHE_SYSTEMRAMTARGET"
              value: "0.6"
          ports:
            - name: ingestion
              containerPort: 5341
              protocol: TCP
            - name: ui
              containerPort: 80
              protocol: TCP
          securityContext:
            runAsUser: 0
            capabilities:
              add:
                - NET_BIND_SERVICE
          livenessProbe:
            httpGet:
              path: /
              port: ui
            failureThreshold: 3
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          readinessProbe:
            httpGet:
              path: /
              port: ui
            failureThreshold: 3
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          startupProbe:
            httpGet:
              path: /
              port: ui
            failureThreshold: 30
            periodSeconds: 10
          volumeMounts:
          - name: seq-data
            mountPath: /data
            subPath:
          resources:
            {}
      serviceAccountName: "default"
      volumes:
      - name: seq-data
        persistentVolumeClaim:
          claimName: theidserver-seq
---
# Source: theidserver/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: theidserver
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: theidserver
      app.kubernetes.io/instance: theidserver
  template:
    metadata:
      labels:
        app.kubernetes.io/name: theidserver
        app.kubernetes.io/instance: theidserver
    spec:
      serviceAccountName: theidserver
      securityContext:
        {}
      hostAliases:
      - ip: "127.0.0.1"
        hostnames:
        - "www.myserver.example.com"
      containers:
        - name: theidserver
          securityContext:
            {}
          image: "aguacongas/theidserver.duende:7.4.6"
          imagePullPolicy: Always
          ports:
            - containerPort: 443
              name: https
          envFrom:
          - configMapRef:
              name: theidserver-config
          env:
          - name: ConnectionStrings__DefaultConnection
            valueFrom:
              secretKeyRef:
                name: theidserver-opaque
                key: ConnectionString
          - name: ASPNETCORE_Kestrel__Certificates__Default__Password
            valueFrom:
              secretKeyRef:
                name: theidserver-opaque
                key: ssl.pwd
          - name: IdentityServer__Key__KeyProtectionOptions__X509CertificatePassword
            valueFrom:
              secretKeyRef:
                name: theidserver-opaque
                key: dataProtection.pwd
          - name: DataProtectionOptions__KeyProtectionOptions__X509CertificatePassword
            valueFrom:
              secretKeyRef:
                name: theidserver-opaque
                key: signingKey.pwd
          volumeMounts:
          - name: certificates-secret
            mountPath: /usr/local/share/certificates
          - name: pxf-volume
            mountPath: /usr/local/share/ca-certificates
          - name: config
            mountPath: /usr/local/share/config
          lifecycle:
            postStart:
              exec:
                command:
                - "/bin/bash"
                - "-c"
                - "cp /usr/local/share/config/appsettings.json /app/appsettings.json; cp /usr/local/share/config/admin-appsettings.json /app/wwwroot/appsettings.json; openssl pkcs12 -export -out /usr/local/share/ca-certificates/ssl.pfx -inkey /usr/local/share/certificates/tls.key -in /usr/local/share/certificates/tls.crt -password pass:$ASPNETCORE_Kestrel__Certificates__Default__Password; openssl pkcs12 -export -out /usr/local/share/ca-certificates/dp.pfx -inkey /usr/local/share/certificates/dataProtection.key -in /usr/local/share/certificates/dataProtection.crt -password pass:$DataProtectionOptions__KeyProtectionOptions__X509CertificatePassword; openssl pkcs12 -export -out /usr/local/share/ca-certificates/sk.pfx -inkey /usr/local/share/certificates/signingKey.key -in /usr/local/share/certificates/signingKey.crt -password pass:$IdentityServer__Key__KeyProtectionOptions__X509CertificatePassword"
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: https
          readinessProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: https
          startupProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: https
            failureThreshold: 30
            periodSeconds: 10
          resources:
            {}
      volumes:
      - name: certificates-secret
        secret:
          secretName: theidserver-certs
      - name: pxf-volume
        emptyDir: {}
      - name: config
        configMap:
          name: theidserver-config-files
          items:
          - key: admin-appsettings.json
            path: admin-appsettings.json
          - key: appsettings.json
            path: appsettings.json
---
# Source: theidserver/charts/mysql/templates/primary/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: theidserver-mysql-primary
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: primary
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: mysql
      app.kubernetes.io/instance: theidserver
      app.kubernetes.io/component: primary
  serviceName: theidserver-mysql-primary
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      annotations:
        checksum/configuration: dbd7929c85ae22a31f7ec0f7679df19b88f0fa93bf4996ec8e34054702b808a3
      labels:
        app.kubernetes.io/name: mysql
        helm.sh/chart: mysql-8.8.26
        app.kubernetes.io/instance: theidserver
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: primary
    spec:

      serviceAccountName: theidserver-mysql
      affinity:
        podAffinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: mysql
                    app.kubernetes.io/instance: theidserver
                    app.kubernetes.io/component: primary
                namespaces:
                  - "theidserver"
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:

      securityContext:
        fsGroup: 1001
      containers:
        - name: mysql
          image: docker.io/bitnami/mysql:8.0.28-debian-10-r23
          imagePullPolicy: "IfNotPresent"
          securityContext:
            runAsUser: 1001
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: theidserver-mysql
                  key: mysql-root-password
            - name: MYSQL_USER
              value: "theidserver"
            - name: MYSQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: theidserver-mysql
                  key: mysql-password
            - name: MYSQL_DATABASE
              value: "theidserver"
            - name: MYSQL_REPLICATION_MODE
              value: "master"
            - name: MYSQL_REPLICATION_USER
              value: "theidserverReplication"
            - name: MYSQL_REPLICATION_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: theidserver-mysql
                  key: mysql-replication-password
          ports:
            - name: mysql
              containerPort: 3306
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
            exec:
              command:
                - /bin/bash
                - -ec
                - |
                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
                  fi
                  mysqladmin status -uroot -p"${password_aux}"
          readinessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
            exec:
              command:
                - /bin/bash
                - -ec
                - |
                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
                  fi
                  mysqladmin status -uroot -p"${password_aux}"
          startupProbe:
            failureThreshold: 10
            initialDelaySeconds: 15
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
            exec:
              command:
                - /bin/bash
                - -ec
                - |
                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
                  fi
                  mysqladmin status -uroot -p"${password_aux}"
          resources:
            limits: {}
            requests: {}
          volumeMounts:
            - name: data
              mountPath: /bitnami/mysql
            - name: config
              mountPath: /opt/bitnami/mysql/conf/my.cnf
              subPath: my.cnf
      volumes:
        - name: config
          configMap:
            name: theidserver-mysql-primary
  volumeClaimTemplates:
    - metadata:
        name: data
        labels:
          app.kubernetes.io/name: mysql
          app.kubernetes.io/instance: theidserver
          app.kubernetes.io/component: primary
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "8Gi"
---
# Source: theidserver/charts/mysql/templates/secondary/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: theidserver-mysql-secondary
  namespace: theidserver
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.8.26
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: secondary
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: mysql
      app.kubernetes.io/instance: theidserver
      app.kubernetes.io/component: secondary
  serviceName: theidserver-mysql-secondary
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      annotations:
        checksum/configuration: ee60691d5e277966e011fd2b90269f9ae91a70624ac9d6356e58ab9e048b94d1
      labels:
        app.kubernetes.io/name: mysql
        helm.sh/chart: mysql-8.8.26
        app.kubernetes.io/instance: theidserver
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: secondary
    spec:

      serviceAccountName: theidserver-mysql
      affinity:
        podAffinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: mysql
                    app.kubernetes.io/instance: theidserver
                    app.kubernetes.io/component: secondary
                namespaces:
                  - "theidserver"
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:

      securityContext:
        fsGroup: 1001
      containers:
        - name: mysql
          image: docker.io/bitnami/mysql:8.0.28-debian-10-r23
          imagePullPolicy: "IfNotPresent"
          securityContext:
            runAsUser: 1001
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: MYSQL_REPLICATION_MODE
              value: "slave"
            - name: MYSQL_MASTER_HOST
              value: theidserver-mysql-primary
            - name: MYSQL_MASTER_PORT_NUMBER
              value: "3306"
            - name: MYSQL_MASTER_ROOT_USER
              value: "root"
            - name: MYSQL_REPLICATION_USER
              value: "theidserverReplication"
            - name: MYSQL_MASTER_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: theidserver-mysql
                  key: mysql-root-password
            - name: MYSQL_REPLICATION_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: theidserver-mysql
                  key: mysql-replication-password
          ports:
            - name: mysql
              containerPort: 3306
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
            exec:
              command:
                - /bin/bash
                - -ec
                - |
                  password_aux="${MYSQL_MASTER_ROOT_PASSWORD:-}"
                  if [[ -f "${MYSQL_MASTER_ROOT_PASSWORD_FILE:-}" ]]; then
                      password_aux=$(cat "$MYSQL_MASTER_ROOT_PASSWORD_FILE")
                  fi
                  mysqladmin status -uroot -p"${password_aux}"
          readinessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
            exec:
              command:
                - /bin/bash
                - -ec
                - |
                  password_aux="${MYSQL_MASTER_ROOT_PASSWORD:-}"
                  if [[ -f "${MYSQL_MASTER_ROOT_PASSWORD_FILE:-}" ]]; then
                      password_aux=$(cat "$MYSQL_MASTER_ROOT_PASSWORD_FILE")
                  fi
                  mysqladmin status -uroot -p"${password_aux}"
          startupProbe:
            failureThreshold: 15
            initialDelaySeconds: 15
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
            exec:
              command:
                - /bin/bash
                - -ec
                - |
                  password_aux="${MYSQL_MASTER_ROOT_PASSWORD:-}"
                  if [[ -f "${MYSQL_MASTER_ROOT_PASSWORD_FILE:-}" ]]; then
                      password_aux=$(cat "$MYSQL_MASTER_ROOT_PASSWORD_FILE")
                  fi
                  mysqladmin status -uroot -p"${password_aux}"
          resources:
            limits: {}
            requests: {}
          volumeMounts:
            - name: data
              mountPath: /bitnami/mysql
            - name: config
              mountPath: /opt/bitnami/mysql/conf/my.cnf
              subPath: my.cnf
      volumes:
        - name: config
          configMap:
            name: theidserver-mysql-secondary
  volumeClaimTemplates:
    - metadata:
        name: data
        labels:
          app.kubernetes.io/name: mysql
          app.kubernetes.io/instance: theidserver
          app.kubernetes.io/component: secondary
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "8Gi"
---
# Source: theidserver/charts/redis/templates/master/application.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: theidserver-redis-master
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: master
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: redis
      app.kubernetes.io/instance: theidserver
      app.kubernetes.io/component: master
  serviceName: theidserver-redis-headless
  updateStrategy:
    rollingUpdate: {}
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: redis
        helm.sh/chart: redis-16.5.2
        app.kubernetes.io/instance: theidserver
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: master
      annotations:
        checksum/configmap: b08eff233d1603f20ad8e3da52dcd965e55c741f1f9133ee9577cdd707c96d11
        checksum/health: 42c0fb1242e389ec52f4582870667a8acd624b7a431e705582e3c4dbe77ed18e
        checksum/scripts: 535471d7eae1ad120c2107a08e6dfe4abf5db411a65f99dbb9d5ef965aa98a5a
        checksum/secret: c30bf1a956d89af0fa078e54fdddaafa23696b08325420771a44fc36ee17fe0a
    spec:

      securityContext:
        fsGroup: 1001
      serviceAccountName: theidserver-redis
      affinity:
        podAffinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: redis
                    app.kubernetes.io/instance: theidserver
                    app.kubernetes.io/component: master
                namespaces:
                  - "theidserver"
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:

      terminationGracePeriodSeconds: 30
      containers:
        - name: redis
          image: docker.io/bitnami/redis:6.2.6-debian-10-r146
          imagePullPolicy: "IfNotPresent"
          securityContext:
            runAsUser: 1001
          command:
            - /bin/bash
          args:
            - -c
            - /opt/bitnami/scripts/start-scripts/start-master.sh
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: REDIS_REPLICATION_MODE
              value: master
            - name: ALLOW_EMPTY_PASSWORD
              value: "no"
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: theidserver-redis
                  key: redis-password
            - name: REDIS_TLS_ENABLED
              value: "no"
            - name: REDIS_PORT
              value: "6379"
          ports:
            - name: redis
              containerPort: 6379
          livenessProbe:
            initialDelaySeconds: 20
            periodSeconds: 5
            # One second longer than command timeout should prevent generation of zombie processes.
            timeoutSeconds: 6
            successThreshold: 1
            failureThreshold: 5
            exec:
              command:
                - sh
                - -c
                - /health/ping_liveness_local.sh 5
          readinessProbe:
            initialDelaySeconds: 20
            periodSeconds: 5
            timeoutSeconds: 2
            successThreshold: 1
            failureThreshold: 5
            exec:
              command:
                - sh
                - -c
                - /health/ping_readiness_local.sh 1
          resources:
            limits: {}
            requests: {}
          volumeMounts:
            - name: start-scripts
              mountPath: /opt/bitnami/scripts/start-scripts
            - name: health
              mountPath: /health
            - name: redis-data
              mountPath: /data
              subPath:
            - name: config
              mountPath: /opt/bitnami/redis/mounted-etc
            - name: redis-tmp-conf
              mountPath: /opt/bitnami/redis/etc/
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: start-scripts
          configMap:
            name: theidserver-redis-scripts
            defaultMode: 0755
        - name: health
          configMap:
            name: theidserver-redis-health
            defaultMode: 0755
        - name: config
          configMap:
            name: theidserver-redis-configuration
        - name: redis-tmp-conf
          emptyDir: {}
        - name: tmp
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: redis-data
        labels:
          app.kubernetes.io/name: redis
          app.kubernetes.io/instance: theidserver
          app.kubernetes.io/component: master
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "8Gi"
---
# Source: theidserver/charts/redis/templates/replicas/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: theidserver-redis-replicas
  namespace: "theidserver"
  labels:
    app.kubernetes.io/name: redis
    helm.sh/chart: redis-16.5.2
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: replica
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: redis
      app.kubernetes.io/instance: theidserver
      app.kubernetes.io/component: replica
  serviceName: theidserver-redis-headless
  updateStrategy:
    rollingUpdate: {}
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: redis
        helm.sh/chart: redis-16.5.2
        app.kubernetes.io/instance: theidserver
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: replica
      annotations:
        checksum/configmap: b08eff233d1603f20ad8e3da52dcd965e55c741f1f9133ee9577cdd707c96d11
        checksum/health: 42c0fb1242e389ec52f4582870667a8acd624b7a431e705582e3c4dbe77ed18e
        checksum/scripts: 535471d7eae1ad120c2107a08e6dfe4abf5db411a65f99dbb9d5ef965aa98a5a
        checksum/secret: c30bf1a956d89af0fa078e54fdddaafa23696b08325420771a44fc36ee17fe0a
    spec:

      securityContext:
        fsGroup: 1001
      serviceAccountName: theidserver-redis
      affinity:
        podAffinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: redis
                    app.kubernetes.io/instance: theidserver
                    app.kubernetes.io/component: replica
                namespaces:
                  - "theidserver"
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:

      terminationGracePeriodSeconds: 30
      containers:
        - name: redis
          image: docker.io/bitnami/redis:6.2.6-debian-10-r146
          imagePullPolicy: "IfNotPresent"
          securityContext:
            runAsUser: 1001
          command:
            - /bin/bash
          args:
            - -c
            - /opt/bitnami/scripts/start-scripts/start-replica.sh
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: REDIS_REPLICATION_MODE
              value: slave
            - name: REDIS_MASTER_HOST
              value: theidserver-redis-master-0.theidserver-redis-headless.theidserver.svc.cluster.local
            - name: REDIS_MASTER_PORT_NUMBER
              value: "6379"
            - name: ALLOW_EMPTY_PASSWORD
              value: "no"
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: theidserver-redis
                  key: redis-password
            - name: REDIS_MASTER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: theidserver-redis
                  key: redis-password
            - name: REDIS_TLS_ENABLED
              value: "no"
            - name: REDIS_PORT
              value: "6379"
          ports:
            - name: redis
              containerPort: 6379
          livenessProbe:
            initialDelaySeconds: 20
            periodSeconds: 5
            timeoutSeconds: 6
            successThreshold: 1
            failureThreshold: 5
            exec:
              command:
                - sh
                - -c
                - /health/ping_liveness_local_and_master.sh 5
          readinessProbe:
            initialDelaySeconds: 20
            periodSeconds: 5
            timeoutSeconds: 2
            successThreshold: 1
            failureThreshold: 5
            exec:
              command:
                - sh
                - -c
                - /health/ping_readiness_local_and_master.sh 1
          resources:
            limits: {}
            requests: {}
          volumeMounts:
            - name: start-scripts
              mountPath: /opt/bitnami/scripts/start-scripts
            - name: health
              mountPath: /health
            - name: redis-data
              mountPath: /data
              subPath:
            - name: config
              mountPath: /opt/bitnami/redis/mounted-etc
            - name: redis-tmp-conf
              mountPath: /opt/bitnami/redis/etc
      volumes:
        - name: start-scripts
          configMap:
            name: theidserver-redis-scripts
            defaultMode: 0755
        - name: health
          configMap:
            name: theidserver-redis-health
            defaultMode: 0755
        - name: config
          configMap:
            name: theidserver-redis-configuration
        - name: redis-tmp-conf
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: redis-data
        labels:
          app.kubernetes.io/name: redis
          app.kubernetes.io/instance: theidserver
          app.kubernetes.io/component: replica
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "8Gi"
---
# Source: theidserver/charts/seq/templates/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: theidserver-seq
  labels:
    app: seq
    chart: seq-2021.4.7192
    release: theidserver
    heritage: Helm
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
    - hosts:
        - "seq.myserver.example.com"
      secretName: theidserver-seq
  rules:
    - host: seq.myserver.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: theidserver-seq
                port:
                  number: 80
---
# Source: theidserver/templates/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: theidserver
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
    nginx.ingress.kubernetes.io/proxy-buffering: "on"
    nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  rules:
    - host: "www.myserver.example.com"
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: theidserver
                port:
                  number: 443
---
# Source: theidserver/templates/certificate-resource.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: theidserver-cr
  labels:
    helm.sh/chart: theidserver-4.8.0
    app.kubernetes.io/name: theidserver
    app.kubernetes.io/instance: theidserver
    app.kubernetes.io/version: "4.5.2"
    app.kubernetes.io/managed-by: Helm
spec:
  secretName: theidserver-certs
  duration: 2160h
  renewBefore: 360h
  subject:
    organizations:
    - "theidserver"
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
  - server auth
  - client auth
  dnsNames:
  - "www.myserver.example.com"
  ipAddresses:
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer

Are you able to launch and connect to the admin app ?

Yes, I was able to launch the admin app, but after accessing the website and Sign in, it automatically redirects me back to the login page repeatedly.

Do you have an HTTPS certificate issue ?

No, the cert-manager and Let's Encrypt are working properly, and the certificate doesn't appear to be the source of the issue.

Do you have CORS issue ?

The issue is in the adminSettings : the client doesn't ask for scope openid and profile so the serveur doen't return an id_token.
Update your configuration to set defaultScopes with openid and profile :
adminSettings:
...
  providerOptions:
...
    defaultScopes:
    - openid
    - profile
    - theidserveradminapi

The request to /appsettings.json should reflect your changes and it should return a json like :
{
...
  "providerOptions": {
...
    "defaultScopes": [
      "openid",
      "profile",
      "theidserveradminapi"
    ],
...
}

It's a bug of the Helm chart I'm going to fix soon.

authors: aguacongas lirei-lab lirei-user

repo: Aguafrommars/TheIdServer