Skip to content

guacamole values

Every value of chart guacamole 0.1.1, read from values.yaml and values.schema.json. A map is listed with its keys; a map without a description of its own is listed by its keys only. Every value has a default: the chart installs with none given.

Value Type Default Description
fullnameOverride string "" empty: objects are named <release>-guacamole
image.guacamole string guacamole/guacamole:1.6.0 web application, Tomcat on port 8080
image.guacd string guacamole/guacd:1.6.0 proxy daemon that speaks VNC, RDP and SSH to the remote desktops
image.postgres string ghcr.io/cloudnative-pg/postgresql:17.6 psql of the database job
image.rclone string rclone/rclone:1.71 copies the recordings to the bucket
resources.guacamole.requests.cpu string 100m
resources.guacamole.requests.memory string 512Mi
resources.guacamole.limits.cpu string 2
resources.guacamole.limits.memory string 1Gi
resources.guacd.requests.cpu string 100m
resources.guacd.requests.memory string 128Mi
resources.guacd.limits.cpu string 2
resources.guacd.limits.memory string 1Gi
resources.rclone.requests.cpu string 10m
resources.rclone.requests.memory string 64Mi
resources.rclone.limits.cpu string 500m
resources.rclone.limits.memory string 256Mi
resources.job.requests.cpu string 10m
resources.job.requests.memory string 64Mi
resources.job.limits.cpu string 500m
resources.job.limits.memory string 256Mi
route.hostname string "" empty: OpenShift assigns a host under the default application domain
route.annotations object used when a hostname is set; certificate issued by cert-manager
route.annotations.cert-manager.io/issuer-kind string ClusterIssuer
route.annotations.cert-manager.io/issuer-name string letsencrypt
route.labels object {} extra labels on the Route, for example to select it for a router shard or a policy
database.instances integer 1 PostgreSQL instances of the CloudNativePG cluster
database.size string 1Gi
database.storageClassName string "" empty: the default storage class
database.resources.requests.cpu string 50m
database.resources.requests.memory string 256Mi
database.resources.limits.memory string 512Mi
oidc.enabled boolean false true: users sign in at an OpenID Connect issuer (implicit flow, no client secret)
oidc.issuerUrl string "" issuer, for example https://login.example.com/realms/example
oidc.clientId string ""
oidc.authorizationEndpoint string "" empty: <issuerUrl>/protocol/openid-connect/auth, the Keycloak address
oidc.jwksEndpoint string "" empty: <issuerUrl>/protocol/openid-connect/certs, the Keycloak address
oidc.usernameClaim string preferred_username token claim that holds the Guacamole user name
oidc.groupsClaim string groups token claim that holds the user's group names, for adminGroups and connections[].groups
oidc.scope string openid email profile
oidc.primary boolean true true: straight to the issuer, no login form. false: the form, with a link to the issuer
admins array [] administrators by user name, signing in like any other user: every system permission and READ on every connection. A name removed from the list loses them on the next upgrade. guacadmin is not one of them: it stays the break-glass administrator with the password of the Secret - admin@example.com
adminGroups array [] groups of the issuer, by name as oidc.groupsClaim gives them: their members are administrators like the names in admins, without a database account. A group removed from the list loses the permissions on the next upgrade - admins
connections array [] connections managed by the chart. Each one is created or updated on every install and upgrade; its parameters and its users are exactly the ones here - name: desktop protocol: vnc hostname: desktop port: 5900 # Guacamole connection parameters, all values as strings. # disable-copy and disable-paste are "true" unless set here parameters: color-depth: "24" # Guacamole parameter: key of the Secret <release>-guacamole that holds its value secretParameters: password: vncPassword # users that may open the connection, READ permission only users: - user@example.com # groups of the issuer whose members may open the connection, READ only groups: - desktop-users
recording.enabled boolean true true: every session of a managed connection is recorded and can be played back from the connection history
recording.size string 10Gi
recording.storageClassName string "" empty: the default storage class
recording.s3.enabled boolean false true: recordings are copied to a bucket every 5 minutes, never deleted there
recording.s3.storageClassName string "" storage class of the ObjectBucketClaim; required with s3.enabled
recording.s3.expiryDays integer 180 days after which the bucket must expire a recording; see the Delivery instructions
recording.s3.region string us-east-1 region given to the S3 client
watermark.enabled boolean false true: the user name and the time are tiled faintly over every page
kiosk.enabled boolean false true: a locked-down Firefox desktop, Service <release>-kiosk on VNC port 5900, for a connection with hostname <release>-kiosk and secretParameters password: vncPassword
kiosk.replicas integer 1 0 stops the desktop and keeps its profile; at most 1, one Firefox per profile
kiosk.image string "" empty: built in the project from files/kiosk/Containerfile
kiosk.registry string image-registry.openshift-image-registry.svc:5000 registry of the cluster, where the build pushes and the pod pulls
kiosk.homepage string about:blank first page; must match allowedUrls unless it is an about: page
kiosk.allowedUrls array [] Firefox WebsiteFilter exceptions (match patterns); everything else is blocked. No port: http://10.0.0.1/* matches every port of the host - https://code.example.com/*
kiosk.connectTimeout integer 5 seconds Firefox waits for a TCP connection (its default is 90). A page that loads a stylesheet or font from a host the egress firewall drops stays blank, or keeps showing the previous page, this long
kiosk.policies object {} extra Firefox enterprise policies; a key the chart sets keeps the chart value
kiosk.preferences object {} extra Firefox preferences, each locked; a name the chart sets keeps its value
kiosk.geometry string 1600x900
kiosk.profileSize string 1Gi Firefox profile with the saved logins, kept across restarts
kiosk.storageClassName string "" empty: the default storage class
kiosk.egressFirewall.enabled boolean true true: EgressFirewall "default" for the whole project: only the entries below are reachable outside the cluster. The project may hold one only
kiosk.egressFirewall.allowedDnsNames array [] - code.example.com
kiosk.egressFirewall.allowedCidrs array [] - 192.0.2.10/32
kiosk.resources.requests.cpu string 200m
kiosk.resources.requests.memory string 1Gi
kiosk.resources.limits.cpu string 2
kiosk.resources.limits.memory string 3Gi
kiosk.build.resources.requests.cpu string 200m
kiosk.build.resources.requests.memory string 512Mi
kiosk.build.resources.limits.cpu string 2
kiosk.build.resources.limits.memory string 2Gi
secrets.type string kubernetes kubernetes: a Secret from the values below. externalSecret: from a secret store One of: kubernetes, externalSecret.
secrets.adminPassword string "" password of the guacadmin user. Empty: generated once and kept on upgrade
secrets.vncPassword string "" VNC password for a desktop, read through connections[].secretParameters. Empty: generated once and kept on upgrade
secrets.externalSecret.storeKind string ClusterSecretStore
secrets.externalSecret.storeName string ""
secrets.externalSecret.refreshInterval string 1h
secrets.externalSecret.items object one vault item per secret; the value is read from the item's password
secrets.externalSecret.items.adminPassword string guacamole-admin-password
secrets.externalSecret.items.vncPassword string guacamole-vnc-password