You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Before installing CircleCI, it is recommended to create a new `values.yaml` file unique to your installation. xref:server-admin:installation:installation-reference.adoc#example-manifests[The Installation Reference section] contains some example `values.yaml` files that are a good place to start. The following describes the minimum required values to include in `values.yaml`. Additional customizations are available, see the provided `values.yaml` for all available options.
68
+
Before installing CircleCI, it is recommended to create a new `values.yaml` file unique to your installation. xref:server-admin:installation:installation-reference.adoc#example-manifests[The Installation Reference Section] contains some example `values.yaml` files that are a good place to start. The following describes the minimum required values to include in `values.yaml`. Additional customizations are available, see the provided `values.yaml` for all available options.
69
69
70
70
For sensitive data there are two options:
71
71
72
-
* Add into the `values.yaml` file
73
-
* Add them as Kubernetes Secrets directly
72
+
* Add into the `values.yaml` file.
73
+
* Add them as Kubernetes Secrets directly.
74
74
75
75
This flexibility allows you to manage Kubernetes Secrets using whichever process you prefer. Whichever option you choose, this sensitive information is stored as a Kubernetes Secret within CircleCI.
76
76
@@ -79,7 +79,7 @@ NOTE: During the installation process, you may use the following command to gene
79
79
[#api-token]
80
80
=== a. API token
81
81
82
-
The application requires a Kubernetes Secret containing an API token. This API token is used to facilitate internal API communication to api-service. Use a random string and store it securely. CircleCI will not be able to recover this value if lost. There are two options depending on whether you want to create the Kubernetes Secret, or if you want CircleCI to create it for you.
82
+
The application requires a Kubernetes Secret containing an API token. This API token is used to facilitate internal API communication to the API service. Use a random string and store it securely. CircleCI will not be able to recover this value if lost. You have two options depending on whether you want to create the Kubernetes Secret, or if you want CircleCI to create it for you.
83
83
84
84
[tabs]
85
85
====
@@ -107,15 +107,15 @@ CircleCI creates Secret::
107
107
--
108
108
**Option 2:** CircleCI creates the Kubernetes Secret for you.
109
109
110
-
CircleCI will create the Kubernetes Secret "api-token" automatically.
110
+
CircleCI will create the Kubernetes Secret `api-token` automatically.
111
111
112
112
--
113
113
====
114
114
115
115
[#session-cookie]
116
116
=== b. Session cookie
117
117
118
-
The application requires a session cookie key Kubernetes Secret, which CircleCI uses to sign session cookies. The Secret must be exactly 16 characters long. Use a random string and store it securely. CircleCI will not be able to recover this value if lost. There are two options depending on whether you want to create the Kubernetes Secret, or if you want CircleCI to create it for you.
118
+
The application requires a session cookie key Kubernetes Secret, which CircleCI uses to sign session cookies. The Secret must be exactly 16 characters long. Use a random string and store it securely. CircleCI will not be able to recover this value if lost. You have two options depending on whether you want to create the Kubernetes Secret, or if you want CircleCI to create it for you.
119
119
120
120
[tabs]
121
121
====
@@ -151,7 +151,7 @@ CircleCI will create the Kubernetes Secret "session-cookie" automatically.
151
151
[#encryption]
152
152
=== c. Encryption
153
153
154
-
The application requires a Kubernetes Secret containing signing and encryption keysets. These keysets are used to encrypt and sign artifacts generated by CircleCI. These keys were created during the prerequisites phase (xref:server-admin:installation:phase-1-gcp-prerequisites.adoc#encryption-signing-keys[GCP prerequisites], xref:server-admin:installation:phase-1-aws-prerequisites.adoc#encryption-signing-keys[AWS prerequisites]). CircleCI will not be able to recover the values if lost. Depending on how you prefer to manage Kubernetes Secrets, there are two options.
154
+
The application requires a Kubernetes Secret containing signing and encryption keysets. These keysets are used to encrypt and sign artifacts generated by CircleCI. These keys were created during the prerequisites phase (xref:server-admin:installation:phase-1-gcp-prerequisites.adoc#encryption-signing-keys[GCP Prerequisites], xref:server-admin:installation:phase-1-aws-prerequisites.adoc#encryption-signing-keys[AWS Prerequisites]). CircleCI will not be able to recover the values if lost. Depending on how you prefer to manage Kubernetes Secrets, you have two options.
155
155
156
156
[tabs]
157
157
====
@@ -188,7 +188,7 @@ keyset:
188
188
189
189
[#postgres-credentials]
190
190
==== i. Credentials
191
-
The application requires a Kubernetes Secret containing PostgreSQL credentials. This is true when using either the internal (default) or an externally hosted instance of PostgreSQL. CircleCI will not be able to recover the values if lost. Based on how you prefer to manage Kubernetes Secrets there are two options.
191
+
The application requires a Kubernetes Secret containing PostgreSQL credentials. This requirement applies when using either the internal (default) or an externally hosted instance of PostgreSQL. CircleCI will not be able to recover the values if lost. Based on how you prefer to manage Kubernetes Secrets you have two options.
192
192
193
193
[tabs]
194
194
====
@@ -264,7 +264,7 @@ postgresql:
264
264
265
265
=== e. MongoDB credentials
266
266
267
-
The application requires a Kubernetes Secret containing MongoDB credentials. This is true when using either the internal (default) or an externally hosted instance of MongoDB. CircleCI will not be able to recover the values if lost. Based on how you prefer to manage Kubernetes Secrets there are two options.
267
+
The application requires a Kubernetes Secret containing MongoDB credentials. This requirement applies when using either the internal (default) or an externally hosted instance of MongoDB. CircleCI will not be able to recover the values if lost. Based on how you prefer to manage Kubernetes Secrets you have two options.
268
268
269
269
[tabs]
270
270
====
@@ -479,7 +479,7 @@ Lets Encrypt::
479
479
--
480
480
*Let's Encrypt*
481
481
482
-
https://letsencrypt.org/[Let's Encrypt] will request and manage certificates for you. This is a good option when the load balancer is publicly accessible. The following snippet (using your own email) can be added to `values.yaml`:
482
+
https://letsencrypt.org/[Let's Encrypt] will request and manage certificates for you. Let's Encrypt is a good option when the load balancer is publicly accessible. The following snippet (using your own email) can be added to `values.yaml`:
483
483
484
484
[source,yaml]
485
485
----
@@ -649,11 +649,11 @@ github:
649
649
=== l. Object storage
650
650
651
651
ifndef::env-gcp[]
652
-
Regardless of your storage provider, the bucket name you xref:server-admin:installation:phase-1-aws-prerequisites.adoc#object-storage-and-permissions[created during the prerequisites phase] will need to be included.
652
+
Regardless of your storage provider, the bucket name you xref:server-admin:installation:phase-1-aws-prerequisites.adoc#object-storage-and-permissions[Created During the Prerequisites Phase] will need to be included.
653
653
endif::env-gcp[]
654
654
655
655
ifndef::env-aws[]
656
-
Regardless of your storage provider, the bucket name you xref:server-admin:installation:phase-1-gcp-prerequisites.adoc#object-storage-and-permissions[created during the prerequisites phase] will need to be included.
656
+
Regardless of your storage provider, the bucket name you xref:server-admin:installation:phase-1-gcp-prerequisites.adoc#object-storage-and-permissions[Created During the Prerequisites Phase] will need to be included.
657
657
endif::env-aws[]
658
658
659
659
[source,yaml]
@@ -719,7 +719,7 @@ object_storage:
719
719
----
720
720
721
721
**Disable Presigned Mode (Optional)**
722
-
If you wish to store artifacts larger than 5GB, you will need to xref:installation:phase-1-aws-prerequisites.adoc#s3-storage[update your trust policy for your IRSA role]. Then disable presigned mode by adding the following to the `object_storage.s3` section:
722
+
If you wish to store artifacts larger than 5GB, you will need to xref:installation:phase-1-aws-prerequisites.adoc#s3-storage[Update Your Trust Policy for Your IRSA Role]. Then disable presigned mode by adding the following to the `object_storage.s3` section:
Depending on your security requirements, you might want to install CircleCI server behind a proxy. Installing behind a proxy gives you the power to monitor and control access between your installation and the broader Internet. For further information including limitations of installation behind a proxy, see the xref:server-admin:installation:installing-server-behind-a-proxy.adoc#[Installing server behind a proxy] guide.
817
+
Depending on your security requirements, you might want to install CircleCI server behind a proxy. Installing behind a proxy gives you the power to monitor and control access between your installation and the broader Internet. For further information including limitations of installation behind a proxy, see the xref:server-admin:installation:installing-server-behind-a-proxy.adoc#[Installing Server Behind a Proxy] guide.
818
818
819
819
The following fields need to be configured in your `values.yaml`:
820
820
821
-
* Toggle `proxy.enabled` to `"1"`
821
+
* Toggle `proxy.enabled` to `"1"`.
822
822
* Enter details for `proxy.http.host` and `proxy.https.host`, along with their associated ports. These values can be the same but they both need to be configured.
823
823
* For authentication you will need to configure `proxy.http.auth.enabled` and `proxy.https.auth.enabled` as `"1"`. You will also need to configure the respective username and password for both HTTP and HTTPS.
824
824
* configure the `no_proxy` hosts and subnets. This should include localhost, your GitHub Enterprise host (optional), the hostname of your CircleCI installation (see xref:server-admin:installation:installing-server-behind-a-proxy.adoc#known-limitations[Known Limitations] for an explanation), and the CIDR of Nomad.
@@ -920,13 +920,13 @@ WARNING: If your Tink keyset is somehow lost, you will need to generate a new ke
920
920
921
921
=== o. Setting up OIDC (optional)
922
922
923
-
CircleCI server optionally supports xref:guides:permissions-authentication:openid-connect-tokens.adoc#[OpenID Connect (OIDC) tokens] in jobs.
923
+
CircleCI server optionally supports xref:guides:permissions-authentication:openid-connect-tokens.adoc#[Using OpenID Connect Tokens in Jobs] in jobs.
924
924
925
925
This feature is not enabled by default and requires a few additional steps to set up, as follows:
926
926
927
927
. Generate a https://mkjwk.org/[JSON Web Key (JWK)] using the default parameters and copy the `Public and Private Keypair Set` to a secure and convenient location (for example, `~/oidc-service-jwk.json`). This key pair will be used by `oidc-service` to sign the OIDC tokens used in jobs.
928
928
929
-
. The JWK will need to be base64 encoded without line wrapping before using it on server:
929
+
. The JWK will need to be base64 encoded without line wrapping before using it on server.
0 commit comments