Source defaults and startup expressions¶

These tables are generated from the published component sources selected by this documentation's cohort. They describe source configuration, not measured platform support. Helm overrides, environment inputs, validation and later startup logic can change effective settings.

Reference	Published source
`chart_defaults`	`cloudtaser-helm@v1.0.361:charts/cloudtaser/values.yaml:1`
`wrapper_config_defaults`	`cloudtaser-wrapper@v0.2.209:internal/config/config.go:1`
`ebpf_config_defaults`	`cloudtaser-ebpf@v0.13.168:internal/config/config.go:1`
`operator_flag_defaults`	`cloudtaser-operator@v0.13.212:main.go:1`
`ca_validity_days`	`cloudtaser-operator@v0.13.212:internal/certs/certs.go:18`
`leaf_validity_days`	`cloudtaser-operator@v0.13.212:internal/certs/certs.go:22`
`rotation_threshold_days`	`cloudtaser-operator@v0.13.212:internal/certs/rotation.go:19`

Chart defaults¶

Every leaf in charts/cloudtaser/values.yaml, including empty containers, is included. Descriptions and examples on other pages link to this source.

Chart value	Default from values.yaml
`admission.audienceFence.allow`	`[]`
`admission.audienceFence.brokerAddresses`	`[]`
`admission.audienceFence.enabled`	`true`
`admission.audienceFence.hostPathAllow`	`[]`
`admission.audienceFence.storeAddresses`	`[]`
`admission.enforceSignature`	`true`
`admission.excludeLabels`	`{}`
`admission.matchLabels`	`{}`
`admission.mode`	`"vap"`
`admission.requireDigest`	`false`
`admission.signature.additionalImageReferences`	`[]`
`admission.signature.ignoreTlog`	`false`
`admission.signature.publicKey`	`""`
`admission.signature.publicKeyURL`	`"https://releases.cloudtaser.io/keys/release.pub"`
`admission.signature.rekorURL`	`"https://rekor.sigstore.dev"`
`cloudtaserpolicies`	`[]`
`cosign.enforced`	`true`
`cosign.publicKey`	`"-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEORWOI3V47dAPvCBNec5aDeoGd0my\nSxOZVlFj9e3OyEC2KD00sLeZoLKH4hewaY/+dmzYk1iuZXwNW56YmnNz2A==\n-----END PUBLIC KEY-----\n"`
`cosign.requireKey`	`true`
`crdAdoptHook.enabled`	`true`
`crdAdoptHook.image.digest`	`"bfb8f4ab8abfd7754ef9368731f38680dc266f3091ba8198423a05e9403f8552"`
`crdAdoptHook.image.pullPolicy`	`"IfNotPresent"`
`crdAdoptHook.image.repository`	`"alpine/k8s"`
`crdAdoptHook.image.tag`	`"1.32.9"`
`createNamespace`	`false`
`dbproxy.image.digest`	`"ea227dac9f34c389cb6064c0afc05b9345a6fa8c98541d2c15728fd657765a1d"`
`dbproxy.image.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-db-proxy"`
`dbproxy.image.tag`	`"v0.1.56"`
`dbproxy.imagePullPolicy`	`"IfNotPresent"`
`dbproxy.vault.allowInsecure`	`false`
`dbproxy.vault.skipVerify`	`false`
`ebpf.affinity`	`{}`
`ebpf.allowDebugger`	`false`
`ebpf.allowDisabledEnforcement`	`false`
`ebpf.allowInsecureDisable`	`false`
`ebpf.allowNamespaceOptOut`	`false`
`ebpf.allowPrivilegedWithoutNodeScoping`	`false`
`ebpf.bpffsPin.enabled`	`true`
`ebpf.bpffsPin.uninstallCleanup.enabled`	`true`
`ebpf.bpffsPin.uninstallCleanup.timeoutSeconds`	`240`
`ebpf.bpffsPin.uninstallCleanup.unreachableNodes`	`"fail"`
`ebpf.brokerCAConfigMap`	`""`
`ebpf.brokerURL`	`""`
`ebpf.cgroupEnforce`	`true`
`ebpf.confidentialComputeNodeSelectorTerms`	`[]`
`ebpf.connectAllowlistEnforce`	`false`
`ebpf.criticalPriorityQuota.create`	`true`
`ebpf.criticalPriorityQuota.pods`	`1000`
`ebpf.enabled`	`true`
`ebpf.enforceMode`	`true`
`ebpf.enforcementProfile`	`"strict"`
`ebpf.failClosedOnEnforcementGap`	`null`
`ebpf.globalPrivescDetect`	`true`
`ebpf.healthPort`	`19099`
`ebpf.healthTLS.caConfigMap`	`"cloudtaser-agent-health-ca"`
`ebpf.healthTLS.certFile`	`"tls.crt"`
`ebpf.healthTLS.clientCIDRs`	`[]`
`ebpf.healthTLS.demoPort`	`19102`
`ebpf.healthTLS.driver`	`"secrets-store.csi.k8s.io"`
`ebpf.healthTLS.enabled`	`false`
`ebpf.healthTLS.issuer.driverReady`	`false`
`ebpf.healthTLS.issuer.egressCIDR`	`""`
`ebpf.healthTLS.issuer.enabled`	`false`
`ebpf.healthTLS.issuer.tlsCAConfigMap`	`""`
`ebpf.healthTLS.issuer.url`	`""`
`ebpf.healthTLS.keyFile`	`"tls.key"`
`ebpf.healthTLS.localProbePort`	`19101`
`ebpf.healthTLS.volumeAttributes.secretProviderClass`	`"cloudtaser-ebpf-health-tls"`
`ebpf.image.digest`	`"e3ca22ceb24091c0cd3dbe934d883b483d7671453765db33ef19285f29f33848"`
`ebpf.image.pullPolicy`	`"IfNotPresent"`
`ebpf.image.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-ebpf"`
`ebpf.image.tag`	`"v0.13.168"`
`ebpf.kernelSideKill`	`true`
`ebpf.legacyCaps`	`false`
`ebpf.livenessProbe.failureThreshold`	`3`
`ebpf.livenessProbe.periodSeconds`	`30`
`ebpf.livenessProbe.timeoutSeconds`	`3`
`ebpf.logAll`	`false`
`ebpf.monitoredPidsMapSize`	`65536`
`ebpf.nodeSelector`	`{}`
`ebpf.podAnnotations`	`{}`
`ebpf.priorityClassName`	`""`
`ebpf.reactiveKill`	`true`
`ebpf.readinessProbe.failureThreshold`	`3`
`ebpf.readinessProbe.periodSeconds`	`10`
`ebpf.readinessProbe.timeoutSeconds`	`3`
`ebpf.requireConfidentialCompute`	`true`
`ebpf.requireFullEnforcement`	`true`
`ebpf.requireLSM`	`true`
`ebpf.resources.limits.cpu`	`"500m"`
`ebpf.resources.limits.memory`	`"512Mi"`
`ebpf.resources.requests.cpu`	`"100m"`
`ebpf.resources.requests.memory`	`"128Mi"`
`ebpf.ringbufSize`	`16777216`
`ebpf.seccompDeploy`	`true`
`ebpf.seccompHostDir`	`"/var/lib/kubelet/seccomp"`
`ebpf.sensitivePort`	`19098`
`ebpf.socketInitImage.digest`	`"73aaf090f3d85aa34ee199857f03fa3a95c8ede2ffd4cc2cdb5b94e566b11662"`
`ebpf.socketInitImage.pullPolicy`	`"IfNotPresent"`
`ebpf.socketInitImage.repository`	`"busybox"`
`ebpf.socketInitImage.tag`	`"1.36"`
`ebpf.startupProbe.failureThreshold`	`60`
`ebpf.startupProbe.periodSeconds`	`2`
`ebpf.startupProbe.timeoutSeconds`	`3`
`ebpf.strictBpf.load`	`"audit"`
`ebpf.strictBpf.loaders`	`[]`
`ebpf.successorHandover`	`false`
`ebpf.warnOnEnforcementGaps`	`true`
`grafana.dashboards.enabled`	`null`
`grafana.dashboards.label`	`"grafana_dashboard"`
`grafana.dashboards.labelValue`	`"1"`
`imagePullSecrets`	`[]`
`installCRDs`	`true`
`metrics.prometheusRule.enabled`	`false`
`metrics.prometheusRule.labels`	`{}`
`migrateAccess.additionalSubjects`	`[]`
`migrateAccess.serviceAccount.create`	`true`
`migrateAccess.serviceAccount.name`	`"cloudtaser-migrate"`
`migrateAccess.serviceAccount.namespace`	`""`
`namespace`	`""`
`networkPolicy.acceptUnenforced`	`false`
`networkPolicy.allowBrokerIngressFromAllNamespaces`	`false`
`networkPolicy.allowKubeDNS`	`true`
`networkPolicy.allowOpenBeaconEgress`	`false`
`networkPolicy.allowOpenRegistryEgress`	`false`
`networkPolicy.allowOpenVaultEgress`	`false`
`networkPolicy.apiServerCIDR`	`""`
`networkPolicy.apiServerCIDRs`	`[]`
`networkPolicy.apiServerPorts`	`[443, 6443]`
`networkPolicy.beaconCIDR`	`""`
`networkPolicy.beaconCIDRs`	`[]`
`networkPolicy.brokerIngressNamespaceSelector`	`{}`
`networkPolicy.defaultDenyAll`	`true`
`networkPolicy.dnsCIDRs`	`[]`
`networkPolicy.enabled`	`true`
`networkPolicy.healthProbeCIDRs`	`[]`
`networkPolicy.probeImage`	`"busybox@sha256:73aaf090f3d85aa34ee199857f03fa3a95c8ede2ffd4cc2cdb5b94e566b11662"`
`networkPolicy.registryCIDRs`	`[]`
`networkPolicy.secretstoreCIDR`	`""`
`networkPolicy.secretstoreCIDRs`	`[]`
`networkPolicy.vaultCIDR`	`""`
`networkPolicy.vaultPort`	`8200`
`networkPolicy.webhookIngressCIDRs`	`[]`
`openbaoNetworkPolicy.clientNamespace`	`"cloudtaser-system"`
`openbaoNetworkPolicy.clientPodSelector.app.kubernetes.io/name`	`"cloudtaser-operator"`
`openbaoNetworkPolicy.enabled`	`false`
`openbaoNetworkPolicy.namespace`	`"openbao"`
`openbaoNetworkPolicy.podSelector.app.kubernetes.io/name`	`"openbao"`
`openbaoNetworkPolicy.port`	`8200`
`operator.admissionHA.enabled`	`false`
`operator.allowLegacyUnseal`	`false`
`operator.allowUntrustedRegistries`	`false`
`operator.appArmorProfile`	`"runtime/default"`
`operator.attestation.allowDisable`	`false`
`operator.attestation.enabled`	`null`
`operator.attestation.interval`	`""`
`operator.broker.allowHTTP`	`false`
`operator.broker.beacon.address`	`"beacon.cloudtaser.io:443"`
`operator.broker.beacon.allowInsecure`	`false`
`operator.broker.beacon.authKey`	`""`
`operator.broker.beacon.authKeyOverlapUntil`	`""`
`operator.broker.beacon.authKeyVolume.currentKeyPath`	`"auth.key"`
`operator.broker.beacon.authKeyVolume.driver`	`"secrets-store.csi.k8s.io"`
`operator.broker.beacon.authKeyVolume.enabled`	`true`
`operator.broker.beacon.authKeyVolume.previousKeyPath`	`"previous-auth.key"`
`operator.broker.beacon.authKeyVolume.readOnly`	`true`
`operator.broker.beacon.authKeyVolume.volumeAttributes.secretProviderClass`	`"cloudtaser-beacon-auth"`
`operator.broker.beacon.caCert`	`""`
`operator.broker.beacon.enabled`	`true`
`operator.broker.beacon.infoHash`	`""`
`operator.broker.beacon.initSalt`	`""`
`operator.broker.beacon.insecureSkipVerify`	`false`
`operator.broker.beacon.introduction.audience`	`"cloudtaser.io/operator-introduction"`
`operator.broker.beacon.introduction.caCert`	`""`
`operator.broker.beacon.introduction.egressCIDR`	`""`
`operator.broker.beacon.introduction.enabled`	`false`
`operator.broker.beacon.introduction.enrollmentID`	`""`
`operator.broker.beacon.introduction.expectedAuthority`	`{}`
`operator.broker.beacon.introduction.expirationSeconds`	`600`
`operator.broker.beacon.introduction.mode`	`"source"`
`operator.broker.beacon.introduction.port`	`8444`
`operator.broker.beacon.introduction.transition`	`false`
`operator.broker.beacon.introduction.url`	`""`
`operator.broker.beacon.port`	`443`
`operator.broker.beacon.runtimeAuthKey.enabled`	`false`
`operator.broker.beacon.runtimeAuthKey.image.digest`	`"73aaf090f3d85aa34ee199857f03fa3a95c8ede2ffd4cc2cdb5b94e566b11662"`
`operator.broker.beacon.runtimeAuthKey.image.pullPolicy`	`"IfNotPresent"`
`operator.broker.beacon.runtimeAuthKey.image.repository`	`"busybox"`
`operator.broker.beacon.runtimeAuthKey.image.tag`	`"1.36"`
`operator.broker.beacon.runtimeAuthKey.listenPort`	`18082`
`operator.broker.beacon.runtimeAuthKey.wireV2`	`false`
`operator.broker.beacon.spkiFingerprint`	`""`
`operator.broker.beacon.trustSystemRoots`	`true`
`operator.broker.tls.caBundle`	`""`
`operator.broker.tls.enabled`	`true`
`operator.dangerousCapabilitiesDeny`	`""`
`operator.ebpfGate.enabled`	`true`
`operator.ebpfHealthAddr`	`""`
`operator.enableNetworkPolicy`	`true`
`operator.enableReverseConnect`	`true`
`operator.enabled`	`true`
`operator.fingerprint.clusterID`	`""`
`operator.fingerprint.enabled`	`true`
`operator.fingerprint.interval`	`"5m"`
`operator.flagd.cacheSize`	`1000`
`operator.flagd.enabled`	`false`
`operator.flagd.image.pullPolicy`	`"IfNotPresent"`
`operator.flagd.image.repository`	`"ghcr.io/open-feature/flagd"`
`operator.flagd.image.tag`	`"v0.11.3"`
`operator.flagd.port`	`8013`
`operator.flagd.portEndpoint`	`""`
`operator.flagd.resources.limits.cpu`	`"50m"`
`operator.flagd.resources.limits.memory`	`"64Mi"`
`operator.flagd.resources.requests.cpu`	`"10m"`
`operator.flagd.resources.requests.memory`	`"32Mi"`
`operator.flagd.syncInterval`	`"30s"`
`operator.ha`	`false`
`operator.healthProbeBindAddress`	`":8081"`
`operator.image.digest`	`"54c86d8400797c272b860c992c9eef9597020b1ac8804c1d53ec458249f8d978"`
`operator.image.pullPolicy`	`"IfNotPresent"`
`operator.image.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-operator"`
`operator.image.tag`	`"v0.13.212"`
`operator.injectRuntimeDefaultSeccomp`	`true`
`operator.leaderElect`	`false`
`operator.livenessProbe.failureThreshold`	`3`
`operator.livenessProbe.periodSeconds`	`20`
`operator.livenessProbe.timeoutSeconds`	`5`
`operator.metrics.addr`	`"127.0.0.1:9090"`
`operator.metrics.enabled`	`false`
`operator.metrics.service.enabled`	`false`
`operator.metrics.service.port`	`9090`
`operator.metrics.serviceMonitor.enabled`	`false`
`operator.metrics.serviceMonitor.interval`	`"30s"`
`operator.metrics.serviceMonitor.path`	`"/metrics"`
`operator.podAnnotations`	`{}`
`operator.podTokenTTLSeconds`	`3600`
`operator.readinessProbe.failureThreshold`	`3`
`operator.readinessProbe.periodSeconds`	`10`
`operator.readinessProbe.timeoutSeconds`	`5`
`operator.replicaCount`	`1`
`operator.requestedScope.fallback`	`true`
`operator.resources.limits.cpu`	`"200m"`
`operator.resources.limits.memory`	`"128Mi"`
`operator.resources.requests.cpu`	`"50m"`
`operator.resources.requests.memory`	`"64Mi"`
`operator.runtimeSocketDenyPaths`	`[]`
`operator.seccomp.localhostProfile`	`"profiles/cloudtaser-memfd.json"`
`operator.secretBackend`	`"inmemory"`
`operator.secretstore`	`{}`
`operator.secretstoreDefaultBackend`	`""`
`operator.secretstorePortAddr`	`""`
`operator.secretstoreSaaSAddr`	`""`
`operator.startupProbe.failureThreshold`	`60`
`operator.startupProbe.initialDelaySeconds`	`5`
`operator.startupProbe.periodSeconds`	`5`
`operator.startupProbe.timeoutSeconds`	`3`
`operator.unsupportedHA`	`false`
`operator.vault.address`	`""`
`operator.vault.authPath`	`"auth/kubernetes"`
`operator.vault.authRole`	`"cloudtaser-operator"`
`operator.vault.kvMount`	`"secret"`
`operator.vault.namespace`	`""`
`operator.webhook.allowFailurePolicyChange`	`false`
`operator.webhook.failurePolicy`	`"Fail"`
`operator.webhook.port`	`9443`
`operator.webhook.timeoutSeconds`	`10`
`pdb.enabled`	`true`
`pdb.operator.minAvailable`	`1`
`port.image.digest`	`"e800cbe1001619954b20c4609afb19309aac5854276d738e91438c28dcd45432"`
`port.image.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-port"`
`port.image.tag`	`"v0.4.137"`
`port.metrics.addr`	`"127.0.0.1:9090"`
`port.metrics.enabled`	`false`
`port.metrics.service.enabled`	`false`
`port.metrics.service.port`	`9090`
`port.metrics.serviceMonitor.enabled`	`false`
`port.metrics.serviceMonitor.interval`	`"30s"`
`port.metrics.serviceMonitor.path`	`"/metrics"`
`port.trustJWT.audience`	`"cloudtaser.io/secret-fetch"`
`port.trustJWT.issuer`	`""`
`port.trustJWT.jwks`	`""`
`psa.kyvernoPolicyExemption.enabled`	`false`
`s3proxy.image.digest`	`"5f7649010a5898d9bb946a4cc3dca7ca4f12c886eb688c8cc517cca0d3565be3"`
`s3proxy.image.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-s3-proxy"`
`s3proxy.image.tag`	`"v0.2.61"`
`s3proxy.imagePullPolicy`	`"IfNotPresent"`
`s3proxy.vault.allowInsecure`	`false`
`s3proxy.vault.skipVerify`	`false`
`securityPosture.maxDegradedValues`	`5`
`serviceMonitor.enabled`	`false`
`serviceMonitor.interval`	`"30s"`
`serviceMonitor.labels`	`{}`
`serviceMonitor.namespace`	`""`
`serviceMonitor.scraperNamespace`	`"monitoring"`
`signatureWarning.image.digest`	`"73aaf090f3d85aa34ee199857f03fa3a95c8ede2ffd4cc2cdb5b94e566b11662"`
`signatureWarning.image.repository`	`"busybox"`
`signatureWarning.image.tag`	`"1.36"`
`upgradeGuard.allowReleaseNameOverride`	`false`
`upgradeGuard.allowSkew`	`false`
`upgradeGuard.allowUnsafeAgentRetirement`	`false`
`upgradeGuard.enabled`	`true`
`upgradeGuard.image.digest`	`"bfb8f4ab8abfd7754ef9368731f38680dc266f3091ba8198423a05e9403f8552"`
`upgradeGuard.image.pullPolicy`	`"IfNotPresent"`
`upgradeGuard.image.repository`	`"alpine/k8s"`
`upgradeGuard.image.tag`	`"1.32.9"`
`upgradeGuard.storageDriver`	`"secrets"`
`volumeShield.broker.audienceScopedToken.audience`	`"cloudtaser-vs-broker"`
`volumeShield.broker.audienceScopedToken.enabled`	`false`
`volumeShield.broker.audienceScopedToken.expirationSeconds`	`3600`
`volumeShield.broker.daemonset.enabled`	`false`
`volumeShield.broker.dekBackend`	`"vault"`
`volumeShield.broker.healthPort`	`8081`
`volumeShield.broker.image.digest`	`""`
`volumeShield.broker.image.pullPolicy`	`"IfNotPresent"`
`volumeShield.broker.image.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper"`
`volumeShield.broker.image.tag`	`""`
`volumeShield.broker.mode`	`"fdpass"`
`volumeShield.broker.nodeSelector`	`{}`
`volumeShield.broker.operatorBrokerCAConfigMap`	`"cloudtaser-operator-broker-ca"`
`volumeShield.broker.operatorBrokerURL`	`""`
`volumeShield.broker.podAnnotations`	`{}`
`volumeShield.broker.resources.limits.cpu`	`"500m"`
`volumeShield.broker.resources.limits.memory`	`"256Mi"`
`volumeShield.broker.resources.requests.cpu`	`"50m"`
`volumeShield.broker.resources.requests.memory`	`"64Mi"`
`volumeShield.broker.tolerations`	`[{"operator": "Exists"}]`
`volumeShield.broker.vaultAddr`	`""`
`volumeShield.broker.vaultCACert`	`""`
`volumeShield.broker.vaultRole`	`"cloudtaser-vs-broker"`
`volumeShield.enabled`	`false`
`volumeShield.freshness.mode`	`"vault"`
`volumeShield.freshness.timeout`	`"10s"`
`volumeShield.metrics.podMonitor.enabled`	`false`
`volumeShield.metrics.podMonitor.interval`	`"30s"`
`volumeShield.metrics.podMonitor.labels`	`{}`
`volumeShield.nonceBudget.leaseSize`	`1048576`
`volumeShield.nonceBudget.leaseTimeout`	`"10s"`
`volumeShield.nonceBudget.mode`	`""`
`volumeShield.sidecar.image.digest`	`""`
`volumeShield.sidecar.image.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper"`
`volumeShield.sidecar.image.tag`	`""`
`wrapper.healthPort`	`8199`
`wrapper.image.digest`	`"a857c7442b9a731c4ed41372146e015707c00ce01b5bede789c808210bc53723"`
`wrapper.image.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper"`
`wrapper.image.tag`	`"v0.2.209"`
`wrapper.initImage.digest`	`"577cef2113b03f284d3d149320480f375bb1fcc3dd07f9216ad0115b8b8438f2"`
`wrapper.initImage.repository`	`"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper-init"`
`wrapper.initImage.tag`	`"v0.2.209"`
`wrapper.initImagePullPolicy`	`"IfNotPresent"`
`wrapper.metrics.addr`	`"127.0.0.1:9090"`
`wrapper.metrics.enabled`	`false`

Wrapper configuration¶

Explicit entries in the wrapper's DefaultConfig() literal follow. Omitted Go fields retain their zero value until configuration readers or startup logic change them.

Field or flag	Source expression (not evaluated)	Definition
`EBPFEnrollmentTimeout`	`30 * time.Second`	`internal/config/config.go:622`
`EBPFHealthPort`	`"19099"`	`internal/config/config.go:621`
`EBPFMode`	`"enforce"`	`internal/config/config.go:620`
`HealthAddr`	`":8199"`	`internal/config/config.go:617`
`MaxRenewalFailureDuration`	`5 * time.Minute`	`internal/config/config.go:614`
`MetricsAddr`	`"127.0.0.1:9090"`	`internal/config/config.go:629`
`MetricsEnabled`	`false`	`internal/config/config.go:628`
`ReexecScrub`	`true`	`internal/config/config.go:625`
`RenewalInterval`	`30 * time.Second`	`internal/config/config.go:613`
`RequireMemfdSecret`	`true`	`internal/config/config.go:624`
`RequireMlock`	`true`	`internal/config/config.go:623`
`RevocationCheckInterval`	`30 * time.Second`	`internal/config/config.go:615`
`RevocationGrace`	`5 * time.Minute`	`internal/config/config.go:616`
`RotationStrategy`	`"restart"`	`internal/config/config.go:618`
`SecretBackend`	`"broker"`	`internal/config/config.go:619`
`SecretFetchTimeout`	`5 * time.Minute`	`internal/config/config.go:626`
`SecretFetchTransientTimeout`	`30 * time.Second`	`internal/config/config.go:627`
`VaultAuthMethod`	`"kubernetes"`	`internal/config/config.go:611`
`VaultAuthMountPath`	`"kubernetes"`	`internal/config/config.go:612`
`WatchdogEnabled`	`true`	`internal/config/config.go:631`
`WatchdogInterval`	`60 * time.Second`	`internal/config/config.go:632`
`WatchdogThreshold`	`60 * time.Second`	`internal/config/config.go:633`

Agent configuration¶

The published agent initializes its configuration in FromEnv, rather than in a DefaultConfig() function. These are the literal field expressions and subsequent environment-helper assignments; environment helper calls are shown without evaluating the build host's inputs.

Field or flag	Source expression (not evaluated)	Definition
`AgentPodUID`	`envOrFallback("AGENT_POD_UID", "")`	`internal/config/config.go:983`
`AllowDebugger`	`envBoolFallback("ALLOW_DEBUGGER", false)`	`internal/config/config.go:1064`
`AllowDisabledEnforcement`	`envBoolFallback("ALLOW_DISABLED_ENFORCEMENT", false)`	`internal/config/config.go:1249`
`AllowInsecureAudit`	`envBoolFallback("ALLOW_INSECURE_AUDIT", false)`	`internal/config/config.go:1080`
`AuditBatchSize`	`envIntFallback("AUDIT_BATCH_SIZE", 100)`	`internal/config/config.go:1095`
`AuditFlushInterval`	`envDurationFallback("AUDIT_FLUSH_INTERVAL", 5*time.Second)`	`internal/config/config.go:1100`
`BPFObjectPath`	`envOrFallback("EBPF_OBJECT_PATH", "/opt/cloudtaser/secret_monitor.o")`	`internal/config/config.go:959`
`BPFPinDir`	`envOrFallback("BPF_PIN_DIR", "/sys/fs/bpf/cloudtaser")`	`internal/config/config.go:1118`
`BrokerCAPath`	`envGetFallback("BROKER_CA_PATH")`	`internal/config/config.go:1329`
`BrokerTokenPath`	`envOrFallback("BROKER_TOKEN_PATH", "/var/run/secrets/kubernetes.io/serviceaccount/token")`	`internal/config/config.go:1328`
`BrokerURL`	`envGetFallback("BROKER_URL")`	`internal/config/config.go:1327`
`CgroupEnforce`	`envBoolFallback("CGROUP_ENFORCE", true)`	`internal/config/config.go:1074`
`ConnectAllowlistEnforce`	`envBoolFallback("CONNECT_ALLOWLIST_ENFORCE", false)`	`internal/config/config.go:1257`
`DemoBrokerCAPath`	`envOrFallback("DEMO_BROKER_CA_PATH", "")`	`internal/config/config.go:970`
`DemoBrokerTokenPath`	`envOrFallback("DEMO_BROKER_TOKEN_PATH", "/var/run/cloudtaser/broker-token/token")`	`internal/config/config.go:971`
`DemoBrokerURL`	`envOrFallback("DEMO_BROKER_URL", "")`	`internal/config/config.go:969`
`EnforceMode`	`envBoolFallback("ENFORCE_MODE", true)`	`internal/config/config.go:1020`
`EnforcementProfile`	`envOrFallback("ENFORCEMENT_PROFILE", EnforcementProfileStrict)`	`internal/config/config.go:1233`
`EventStreamListenAddr`	`envOrFallback("EVENT_STREAM_LISTEN_ADDR", "")`	`internal/config/config.go:1121`
`EventStreamTLSCertPath`	`envOrFallback("EVENT_STREAM_TLS_CERT_PATH", "")`	`internal/config/config.go:1122`
`EventStreamTLSClientCAPath`	`envOrFallback("EVENT_STREAM_TLS_CLIENT_CA_PATH", "")`	`internal/config/config.go:1124`
`EventStreamTLSKeyPath`	`envOrFallback("EVENT_STREAM_TLS_KEY_PATH", "")`	`internal/config/config.go:1123`
`FIMEnabled`	`envBoolFallback("FIM_ENABLED", false)`	`internal/config/config.go:1130`
`FailClosedOnEnforcementGap`	`envBoolFallback("FAIL_CLOSED_ON_ENFORCEMENT_GAP", true)`	`internal/config/config.go:1228`
`GRPCInsecureDevNoPeerAuth`	`envBoolFallback("GRPC_INSECURE_DEV_NO_PEER_AUTH", false)`	`internal/config/config.go:1194`
`GRPCListenAddr`	`envOrFallback("GRPC_LISTEN_ADDR", "")`	`internal/config/config.go:966`
`GRPCTLSCertPath`	`envOrFallback("GRPC_TLS_CERT_PATH", "")`	`internal/config/config.go:967`
`GRPCTLSClientCAPath`	`envOrFallback("GRPC_TLS_CLIENT_CA_PATH", "")`	`internal/config/config.go:979`
`GRPCTLSKeyPath`	`envOrFallback("GRPC_TLS_KEY_PATH", "")`	`internal/config/config.go:978`
`GlobalPrivescDetect`	`envBoolFallback("GLOBAL_PRIVESC_DETECT", true)`	`internal/config/config.go:1056`
`HealthListenAddr`	`envOrFallback("HEALTH_LISTEN_ADDR", "0.0.0.0:19099")`	`internal/config/config.go:1000`
`HealthProbeAddr`	`envOrFallback("HEALTH_PROBE_ADDR", "")`	`internal/config/config.go:968`
`HealthProxyCAPath`	`envOrFallback("HEALTH_PROXY_CA_PATH", "")`	`internal/config/config.go:974`
`HealthProxyObservationSocket`	`envOrFallback("HEALTH_PROXY_OBSERVATION_SOCKET", "")`	`internal/config/config.go:973`
`HealthStatusSocket`	`envOrFallback("HEALTH_STATUS_SOCKET", "")`	`internal/config/config.go:972`
`HealthTLSCAPath`	`envOrFallback("HEALTH_TLS_CA_PATH", "")`	`internal/config/config.go:977`
`HealthTLSCertPath`	`envOrFallback("HEALTH_TLS_CERT_PATH", "")`	`internal/config/config.go:975`
`HealthTLSKeyPath`	`envOrFallback("HEALTH_TLS_KEY_PATH", "")`	`internal/config/config.go:976`
`KernelSideKill`	`envBoolFallback("KERNEL_SIDE_KILL", true)`	`internal/config/config.go:1051`
`LogAll`	`envBoolFallback("LOG_ALL", false)`	`internal/config/config.go:1025`
`MonitoredPidsMapSize`	`envIntFallback("MONITORED_PIDS_MAP_SIZE", 65536)`	`internal/config/config.go:1090`
`NodeName`	`envOrFallback("NODE_NAME", "")`	`internal/config/config.go:982`
`PlatformCAPath`	`envOrFallback("PLATFORM_CA_PATH", "")`	`internal/config/config.go:981`
`PlatformEndpoint`	`envOrFallback("PLATFORM_ENDPOINT", "")`	`internal/config/config.go:980`
`ReactiveKill`	`envBoolFallback("REACTIVE_KILL", cfg.EnforceMode)`	`internal/config/config.go:1030`
`ReactiveKillExplicit`	`envGetFallback("REACTIVE_KILL") != ""`	`internal/config/config.go:1040`
`RequireLSMOrFail`	`envBoolFallback("REQUIRE_LSM_OR_FAIL", true)`	`internal/config/config.go:1211`
`RingbufSize`	`envIntFallback("EBPF_RINGBUF_SIZE", 1<<24)`	`internal/config/config.go:1085`
`SeccompDeploy`	`envBoolFallback("SECCOMP_DEPLOY", true)`	`internal/config/config.go:1105`
`SeccompHostDir`	`envOrFallback("SECCOMP_HOST_DIR", "/host/var/lib/kubelet/seccomp")`	`internal/config/config.go:1116`
`SeccompSourcePath`	`envOrFallback("SECCOMP_SOURCE_PATH", "/opt/cloudtaser/seccomp/cloudtaser-memfd.json")`	`internal/config/config.go:1110`
`SensitiveListenAddr`	`envOrFallback("SENSITIVE_LISTEN_ADDR", "127.0.0.1:9098")`	`internal/config/config.go:1009`
`StrictBPFEnum`	`envBoolFallback("STRICT_BPF_ENUM", false)`	`internal/config/config.go:1289`
`StrictBPFLoad`	`envBoolFallback("STRICT_BPF_LOAD", false)`	`internal/config/config.go:1264`
`VSRawPathGuardEnabled`	`envBoolFallback("VS_RAW_PATH_GUARD_ENABLED", false)`	`internal/config/config.go:1153`

Operator flags¶

The published operator registers flags rather than using a DefaultConfig() function. This inventory includes bundled helper executables; the definition column identifies the consumer. Helper-only flags do not configure the operator. Environment lookups and named constants below are source expressions, not a claim about the value on a running operator.

Field or flag	Source expression (not evaluated)	Definition
`--admission-ha`	`false`	`main.go:333`
`--allow-legacy-secret-proxy`	`envOrDefault("CLOUDTASER_ALLOW_LEGACY_SECRET_PROXY", "false") == "true"`	`main.go:321`
`--allow-legacy-unseal`	`envOrDefault("CLOUDTASER_ALLOW_LEGACY_UNSEAL", "false") == "true"`	`main.go:3211`
`--allow-untrusted-registries`	`os.Getenv("CLOUDTASER_ALLOW_UNTRUSTED_REGISTRIES") == "true"`	`main.go:388`
`--apparmor-profile`	`envOrDefault("CLOUDTASER_APPARMOR_PROFILE", "RuntimeDefault")`	`main.go:383`
`--attestation-enabled`	`os.Getenv("CLOUDTASER_ATTESTATION_ENABLED") == "true"`	`main.go:351`
`--attestation-interval`	`envDurationOrDefault("CLOUDTASER_ATTESTATION_INTERVAL", 1*time.Hour)`	`main.go:352`
`--auth-token-loopback-port`	`envIntOrDefault("CLOUDTASER_AUTH_TOKEN_LOOPBACK_PORT", 8201)`	`main.go:399`
`--beacon-address`	`os.Getenv("CLOUDTASER_BEACON_ADDRESS")`	`main.go:359`
`--beacon-allow-insecure`	`envOrDefault("CLOUDTASER_BEACON_ALLOW_INSECURE", "false") == "true"`	`main.go:379`
`--beacon-auth-key-file`	`os.Getenv("CLOUDTASER_BEACON_AUTH_KEY_FILE")`	`main.go:365`
`--beacon-auth-key-overlap-until`	`os.Getenv("CLOUDTASER_BEACON_AUTH_KEY_OVERLAP_UNTIL")`	`main.go:376`
`--beacon-ca`	`os.Getenv("CLOUDTASER_BEACON_CA")`	`main.go:361`
`--beacon-info-hash`	`os.Getenv("CLOUDTASER_BEACON_INFO_HASH")`	`main.go:360`
`--beacon-insecure-skip-verify`	`os.Getenv("CLOUDTASER_BEACON_INSECURE_SKIP_VERIFY") == "true"`	`main.go:378`
`--beacon-runtime-config-file`	`""`	`main.go:368`
`--beacon-spki-pin`	`os.Getenv("CLOUDTASER_BEACON_SPKI_PIN")`	`main.go:362`
`--beacon-trust-system-roots`	`os.Getenv("CLOUDTASER_BEACON_TRUST_SYSTEM_ROOTS") == "true"`	`main.go:377`
`--broker-allow-http`	`envOrDefault("CLOUDTASER_BROKER_ALLOW_HTTP", "false") == "true"`	`main.go:318`
`--broker-bind-address`	`envOrDefault("CLOUDTASER_BROKER_ADDR", ":8199")`	`main.go:316`
`--broker-ca-file`	`"/etc/cloudtaser/broker-ca/ca.crt"`	`internal/healthcsi/provider.go:201`
`--broker-tls-ca-bundle`	`envOrDefault("CLOUDTASER_BROKER_TLS_CA_BUNDLE", "")`	`main.go:319`
`--broker-tls-enabled`	`envOrDefault("CLOUDTASER_BROKER_TLS_ENABLED", "true")`	`main.go:317`
`--broker-url`	`""`	`internal/healthcsi/provider.go:200`
`--cert-dir`	`"/tmp/k8s-webhook-server/serving-certs"`	`main.go:307`
`--cluster-id`	`os.Getenv("CLOUDTASER_CLUSTER_ID")`	`main.go:346`
`--cosign-enforced`	`envOrDefault("CLOUDTASER_COSIGN_ENFORCED", "true") != "false"`	`main.go:385`
`--cosign-key`	`os.Getenv("CLOUDTASER_COSIGN_KEY")`	`main.go:384`
`--cosign-key-secret`	`os.Getenv("CLOUDTASER_COSIGN_KEY_SECRET")`	`main.go:386`
`--dangerous-capabilities-deny`	`envOrDefault("CLOUDTASER_DANGEROUS_CAPABILITIES_DENY", "")`	`main.go:398`
`--db-proxy-image`	`os.Getenv("CLOUDTASER_DBPROXY_IMAGE")`	`main.go:312`
`--db-proxy-image-pull-policy`	`envOrDefault("CLOUDTASER_DBPROXY_IMAGE_PULL_POLICY", "IfNotPresent")`	`main.go:315`
`--demo-signing-enabled`	`os.Getenv("CLOUDTASER_DEMO_SIGNING_ENABLED") == "true"`	`main.go:350`
`--drain-self`	`false`	`main.go:407`
`--ebpf-agent-service-account`	`envOrDefault("CLOUDTASER_EBPF_AGENT_SA", "cloudtaser-ebpf")`	`main.go:391`
`--ebpf-allow-insecure-http`	`os.Getenv("CLOUDTASER_EBPF_ALLOW_INSECURE_HTTP") == "true"`	`main.go:395`
`--ebpf-allow-insecure-tls`	`envOrDefault("CLOUDTASER_EBPF_ALLOW_INSECURE_TLS", "true") != "false"`	`main.go:396`
`--ebpf-allow-namespace-opt-out`	`os.Getenv("CLOUDTASER_EBPF_ALLOW_NAMESPACE_OPT_OUT") == "true"`	`main.go:394`
`--ebpf-daemonset-name`	`envOrDefault("CLOUDTASER_EBPF_DAEMONSET_NAME", "cloudtaser-ebpf")`	`main.go:390`
`--ebpf-health-addr`	`envOrDefault("CLOUDTASER_EBPF_HEALTH_ADDR", "cloudtaser-ebpf-agent-metrics.cloudtaser-system.svc:19099")`	`main.go:389`
`--enable-ebpf-gate`	`envOrDefault("CLOUDTASER_ENABLE_EBPF_GATE", "true") != "false"`	`main.go:393`
`--enable-network-policy`	`os.Getenv("CLOUDTASER_ENABLE_NETWORK_POLICY") == "true"`	`main.go:349`
`--enable-reverse-connect`	`envOrDefault("CLOUDTASER_ENABLE_REVERSE_CONNECT", "true") != "false"`	`main.go:353`
`--fingerprint-interval`	`5*time.Minute`	`main.go:347`
`--health-ca-file`	`"/etc/cloudtaser/health-ca/ca.crt"`	`internal/healthcsi/provider.go:202`
`--health-probe-bind-address`	`":8081"`	`main.go:305`
`--init-image`	`os.Getenv("CLOUDTASER_INIT_IMAGE")`	`main.go:310`
`--inject-runtime-default-seccomp`	`envOrDefault("CLOUDTASER_INJECT_RUNTIME_DEFAULT_SECCOMP", "true") != "false"`	`main.go:382`
`--leader-elect`	`false`	`main.go:334`
`--metrics-addr`	`"127.0.0.1:9090"`	`config.go:123`
`--metrics-bind-address`	`""`	`config.go:124`
`--metrics-enabled`	`envOrDefault("CLOUDTASER_METRICS_ENABLED", "false")`	`config.go:122`
`--node`	`os.Getenv("NODE_NAME")`	`internal/healthcsi/provider.go:203`
`--operator-introduction-config`	`""`	`main.go:366`
`--operator-introduction-transition`	`false`	`main.go:367`
`--operator-namespace`	`envOrDefault("CLOUDTASER_OPERATOR_NAMESPACE", "cloudtaser-system")`	`main.go:323`
`--operator-replicas`	`envIntOrDefault("CLOUDTASER_OPERATOR_REPLICAS", 1)`	`main.go:335`
`--operator-sa-name`	`envOrDefault("CLOUDTASER_OPERATOR_SA_NAME", "cloudtaser-operator")`	`main.go:322`
`--pod-token-ttl-seconds`	`webhookhandler.DefaultPodTokenTTLSeconds`	`main.go:309`
`--port-bind-address`	`envOrDefault("CLOUDTASER_PORT_ADDR", ":8443")`	`main.go:354`
`--port-ca-cert`	`os.Getenv("CLOUDTASER_PORT_CA_CERT")`	`main.go:357`
`--port-health-addr`	`os.Getenv("CLOUDTASER_PORT_HEALTH_ADDR")`	`main.go:404`
`--port-self-bootstrap`	`envOrDefault("CLOUDTASER_PORT_SELF_BOOTSTRAP", "false") == "true"`	`main.go:358`
`--port-tls-cert`	`os.Getenv("CLOUDTASER_PORT_TLS_CERT")`	`main.go:355`
`--port-tls-key`	`os.Getenv("CLOUDTASER_PORT_TLS_KEY")`	`main.go:356`
`--previous-beacon-auth-key-file`	`os.Getenv("CLOUDTASER_BEACON_PREVIOUS_AUTH_KEY_FILE")`	`main.go:375`
`--requested-scope-fallback`	`true`	`main.go:348`
`--require-admin-enrollment`	`adminEnrollmentDefault`	`main.go:374`
`--require-ebpf-agent-on-create`	`envOrDefault("CLOUDTASER_REQUIRE_EBPF_AGENT_ON_CREATE", "false") == "true"`	`main.go:392`
`--runtime-socket-deny-paths`	`envOrDefault("CLOUDTASER_RUNTIME_SOCKET_DENY_PATHS", "")`	`main.go:397`
`--s3-proxy-image`	`os.Getenv("CLOUDTASER_S3PROXY_IMAGE")`	`main.go:311`
`--s3-proxy-image-pull-policy`	`envOrDefault("CLOUDTASER_S3PROXY_IMAGE_PULL_POLICY", "IfNotPresent")`	`main.go:314`
`--seccomp-localhost-profile`	`os.Getenv("CLOUDTASER_SECCOMP_PROFILE")`	`main.go:381`
`--secret-backend`	`operatorSecretStoreEnv`	`main.go:342`
`--socket`	`"/provider/cloudtaser-health.sock"`	`internal/healthcsi/provider.go:199`
`--vault-address`	`os.Getenv("VAULT_ADDR")`	`main.go:324`
`--vault-auth-path`	`envFirstOrDefault("auth/kubernetes", "CLOUDTASER_SECRETSTORE_AUTH_PATH", "CLOUDTASER_VAULT_AUTH_PATH", "VAULT_AUTH_PATH")`	`main.go:343`
`--vault-auth-role`	`envFirstOrDefault("cloudtaser-operator", "CLOUDTASER_SECRETSTORE_AUTH_ROLE", "CLOUDTASER_VAULT_AUTH_ROLE", "VAULT_AUTH_ROLE")`	`main.go:344`
`--vault-default-backend`	`envFirst("CLOUDTASER_SECRETSTORE_DEFAULT_BACKEND", "CLOUDTASER_VAULT_DEFAULT_BACKEND")`	`main.go:332`
`--vault-kv-mount`	`envFirstOrDefault("secret", "CLOUDTASER_SECRETSTORE_KV_MOUNT", "CLOUDTASER_VAULT_KV_MOUNT", "VAULT_KV_MOUNT")`	`main.go:345`
`--vault-namespace`	`envFirst("CLOUDTASER_SECRETSTORE_NAMESPACE", "CLOUDTASER_VAULT_NAMESPACE")`	`main.go:380`
`--vault-port-address`	`envFirst("CLOUDTASER_SECRETSTORE_PORT_ADDR", "CLOUDTASER_VAULT_PORT_ADDR")`	`main.go:331`
`--vault-saas-address`	`envFirst("CLOUDTASER_SECRETSTORE_SAAS_ADDR", "CLOUDTASER_VAULT_SAAS_ADDR")`	`main.go:330`
`--verify-cosign-signatures`	`envOrDefault("CLOUDTASER_VERIFY_COSIGN_SIGNATURES", "true") != "false"`	`main.go:387`
`--version`	`false`	`main.go:410`
`--webhook-config-name`	`"cloudtaser-operator-webhook"`	`main.go:308`
`--webhook-port`	`9443`	`main.go:306`
`--wrapper-init-image-pull-policy`	`envOrDefault("CLOUDTASER_WRAPPER_INIT_IMAGE_PULL_POLICY", "IfNotPresent")`	`main.go:313`
`--wrapper-metrics-addr`	`envOrDefault("CLOUDTASER_WRAPPER_METRICS_ADDR", "127.0.0.1:9090")`	`main.go:401`
`--wrapper-metrics-enabled`	`envOrDefault("CLOUDTASER_WRAPPER_METRICS_ENABLED", "false")`	`main.go:400`

Certificate validity¶

Certificate or trigger	Duration (inferred from operator constants)
CA certificate	730 days
Server/client leaf certificate	90 days
Rotation threshold before expiry	30 days

The environment reference and annotation reference use the same generated source bundle. The build verifies its checksums and regenerates all facts offline. Release refreshes must also reproduce the bundle from the pinned Git tags with tests/generate_docs_facts.py --source-root.