teleport/examples/chart/lib/teleport-proxy-lib

teleport-proxy-lib

Library chart to deploy the Teleport proxy.

See examples/chart/lib/README.md for the repo-wide library-chart conventions.

Public template

teleport-proxy-lib.all

Renders the manifests to deploy a Teleport proxy as a multi-document YAML stream; manifests for disabled features are omitted. Call it with the consumer's root context:

{{- include "teleport-proxy-lib.all" . -}}

Inputs are read from top-level .Values.* (plus .Release, .Chart, .Capabilities).

Values

• acme, acmeEmail, acmeURI — obtain the proxy certificate via ACME/Let's Encrypt (proxy_service.acme); mutually exclusive with tls.existingSecretName.
• annotations — per-manifest annotations, keyed by manifest (config, deployment, pod, service, serviceAccount, ingress, certSecret); applied only to the matching manifest.
• chartMode — config generation: standalone (full proxy config) or scratch (minimal — supply the rest via teleportConfig).
• clusterName — proxy hostname; default for proxy_service.public_addr (clusterName:443) and cert-manager SAN. Must not contain a port.
• extraArgs — extra teleport CLI args (container args).
• extraContainers — sidecar containers.
• extraEnv — extra container environment variables.
• extraLabels — per-manifest extra labels, keyed like annotations (plus job, jobPod, podDisruptionBudget).
• extraVolumes, extraVolumeMounts — extra pod volumes / mounts.
• goMemLimitRatio — sets GOMEMLIMIT to memory-limit × ratio (Go runtime).
• highAvailability.certManager — issue the proxy cert via cert-manager (issuerName/issuerKind/issuerGroup, addCommonName, addPublicAddrs).
• highAvailability.minReadySeconds — Deployment minReadySeconds.
• highAvailability.podDisruptionBudget — create a PodDisruptionBudget.
• highAvailability.replicaCount, forceHAReplicas — replica count; replicable deployments (cert-manager / existing TLS secret / ingress) are bumped to ≥2 unless forceHAReplicas honors the count as-is.
• highAvailability.requireAntiAffinity — require pods on separate nodes (hard anti-affinity).
• image, enterpriseImage, enterprise — container image; enterprise: true selects enterpriseImage. Tag comes from teleportVersionOverride/chart version.
• imagePullPolicy, imagePullSecrets — image pull policy and secrets.
• ingress — optionally create an Ingress routing to the Service (requires proxyListenerMode: multiplex); sub-keys useExisting, suppressAutomaticWildcards, spec.
• initContainers — extra init containers (Default teleport volume mounts are added unless skipDefaultVolumeMounts key is set. This non-k8s key is revmoed. All other keys are standard k8s init-container YAML.)
• insecureSkipProxyTLSVerify — adds --insecure to the teleport args; skips proxy TLS certificate verification (dev only).
• jobResources — resources for the validateConfigOnDeploy Job.
• kubePublicAddr — proxy_service.kube_public_addr.
• log, logLevel — teleport.log severity/output/format; logLevel is a legacy alias for log.level.
• mongoPublicAddr — proxy_service.mongo_public_addr.
• mysqlPublicAddr — proxy_service.mysql_public_addr.
• nameOverride — overrides the app.kubernetes.io/name label.
• nodeSelector, affinity, tolerations — pod scheduling; setting affinity replaces the chart's default anti-affinity.
• podSecurityContext, securityContext — pod / container security context.
• postgresPublicAddr — proxy_service.postgres_public_addr.
• postStart — container postStart lifecycle hook command.
• priorityClassName — pod priority class.
• probeTimeoutSeconds, readinessProbe — liveness/readiness probe timeout and readiness thresholds.
• proxyListenerMode — multiplex (single TLS port) vs separate per-protocol listeners (TLS routing); drives the listeners/ports in the config, Deployment, and Service.
• proxyProtocol — sets proxy_service.proxy_protocol.
• publicAddr — proxy_service.public_addr (defaults to clusterName:443).
• resources — main container resources (also the default for initContainers).
• separateMongoListener — expose a dedicated Mongo listener (proxy_service.mongo_listen_addr
  • port 27017) instead of multiplexing.
• separatePostgresListener — expose a dedicated Postgres listener (proxy_service.postgres_listen_addr
  • Service/Deployment port 5432) instead of multiplexing.
• service, service.type — the Service that exposes the proxy (default LoadBalancer); service.spec is merged in. Always created — the primary way to reach the proxy.
• serviceAccount — create the ServiceAccount and its name (used verbatim — no suffix appended).
• serviceAccountTokenAudience — optional audience for the projected Kubernetes service-account token mounted into the proxy pod.
• serviceAccountTokenExpirationSeconds — optional TTL for the projected Kubernetes service-account token mounted into the proxy pod.
• sshPublicAddr — proxy_service.ssh_public_addr.
• teleportAuthService — sets teleport.auth_server.
• teleportConfig — raw teleport.yaml overrides, deep-merged over the generated config.
• teleportVersionOverride — image tag / Teleport version (defaults to the chart version).
• terminationGracePeriodSeconds — pod termination grace period.
• tls.existingCASecretName, tls.existingCASecretKeyName — mount an extra CA Secret and point SSL_CERT_FILE at the named key (trust a private CA).
• tls.existingSecretName — mount an existing TLS Secret as the proxy keypair (proxy_service.https_keypairs) instead of ACME/cert-manager.
• tunnelPublicAddr — proxy_service.tunnel_public_addr.
• validateConfigOnDeploy — run a pre-install/pre-upgrade Helm hook Job that executes teleport configure --test on the rendered config before rollout.